A security group management method, device, equipment and storage medium

Abstract

The present invention discloses a security group management method, device, equipment and storage medium, which are applied to the field of information security technology and are used for centralized security group management of different cloud platforms. In this scheme, after determining the target cloud platform based on the security group operation instruction and converting the security group operation instruction into the API operation corresponding to the target cloud platform, the target cloud platform interface is first determined based on the target cloud platform session corresponding to the target cloud platform, so that after converting the API operation into the API operation instruction, it is sent to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction and realizes the security group management of the target cloud platform. In this application, by parsing the security group operation instruction, the target cloud platform can be directly made to perform the corresponding security group operation, so as to realize the security group management of different cloud platforms based on the security group operation instruction, and meet the conditions of unified management of different cloud platforms and convenient operation.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security group management method, device, equipment and storage medium. Background Art

[0002] A security group is a virtual firewall that controls the inbound and outbound traffic of virtual machine instances within the security group, thereby improving the security of virtual machine instances. Security groups have state detection and packet filtering capabilities, and users can divide security domains in the cloud based on the characteristics of security groups and the configuration of security group rules.

[0003] Although the cloud platform in the existing technology has a distributed firewall inside and can achieve capabilities similar to security groups, the security management of cloud platforms in different regions and with multiple versions is still a major problem. The existing technology cannot achieve the centralized establishment of security group models for cloud platforms in different regions and with multiple versions.

[0004] Based on this, how to centrally manage security groups on different cloud platforms is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0005] The purpose of the present invention is to provide a security group management method, device, equipment and storage medium. By parsing the security group operation instructions, the target cloud platform can be directly made to perform corresponding security group operations, so as to realize the security group management of different cloud platforms based on the security group operation instructions, and meet the conditions of unified management of different cloud platforms and convenient operation.

[0006] In order to solve the above technical problems, the present invention provides a security group management method, comprising:

[0007] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction;

[0008] Convert the security group operation instruction into an API operation corresponding to the target cloud platform;

[0009] determining a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform;

[0010] The API operation is converted into an API operation instruction, and sent to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction.

[0011] In an optional manner, the security group operation instructions include one or more combinations of security group creation operation instructions, security group deletion operation instructions, security group attribute modification operation instructions, security group rule addition operation instructions, security group rule deletion operation instructions, virtual machine security group addition operation instructions, and virtual machine security group removal operation instructions.

[0012] In an optional manner, after receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0013] Receiving the security group operation instruction through the instruction receiving module;

[0014] A target cloud platform is determined based on the security group operation instruction.

[0015] In an optional manner, the instruction receiving module is a button or a human-computer interaction platform.

[0016] In an optional manner, after receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0017] After receiving the security group operation instruction, determine the cloud platform type and cloud platform version corresponding to the security group operation instruction through a preset adaptation rule;

[0018] The target cloud platform is determined based on the cloud platform type and the cloud platform version.

[0019] In an optional manner, the target cloud platform is NSX-T platform, openstack, Alibaba Cloud or AWS.

[0020] In an optional manner, determining the target cloud platform interface based on the target cloud platform session corresponding to the target cloud platform includes:

[0021] Determine a target cloud platform identifier of the target cloud platform;

[0022] Searching for a target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool through a one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool;

[0023] Authentication information of the target cloud platform interface is determined based on the target cloud platform session to determine the target cloud platform interface.

[0024] In an optional manner, converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction includes:

[0025] Convert the API operation into the API operation instruction;

[0026] Establishing a connection with the target cloud platform through the target cloud platform interface;

[0027] Send the API operation instruction to the target cloud platform.

[0028] In an optional manner, the API operation instruction includes a cloud platform distributed firewall operation API instruction or a cloud platform group object operation API command.

[0029] In an optional manner, after converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, the method further includes:

[0030] When the API operation instruction is the cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform.

[0031] In an optional manner, after converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, the method further includes:

[0032] When the API operation instruction is the cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group.

[0033] According to another aspect of an embodiment of the present invention, there is provided a security group management device, including:

[0034] A first determining unit, configured to determine a target cloud platform based on the security group operation instruction after receiving the security group operation instruction;

[0035] A first conversion unit, configured to convert the security group operation instruction into an API operation corresponding to the target cloud platform;

[0036] A second determining unit, configured to determine a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform;

[0037] The second conversion unit is used to convert the API operation into an API operation instruction, and send it to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction.

[0038] According to another aspect of an embodiment of the present invention, a security group management device is provided, including:

[0039] Memory for storing computer programs;

[0040] A processor is used to implement the steps of the security group management method as described above when executing the computer program.

[0041] In an optional manner, the method further includes:

[0042] The instruction receiving module is used to receive security group operation instructions.

[0043] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a security group management device / apparatus to perform operations of the security group management method as described above.

[0044] The present application provides a security group management method, device, equipment and storage medium, which are applied to the field of information security technology and are used for centralized security group management of different cloud platforms. In this scheme, after determining the target cloud platform based on the security group operation instruction and converting the security group operation instruction into the API operation corresponding to the target cloud platform, the target cloud platform interface is first determined based on the target cloud platform session corresponding to the target cloud platform, so that after converting the API operation into the API operation instruction, it is sent to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction and realizes the security group management of the target cloud platform. In this application, by parsing the security group operation instruction, the target cloud platform can be directly made to perform the corresponding security group operation, so as to realize the security group management of different cloud platforms based on the security group operation instruction, and meet the conditions of unified management of different cloud platforms and convenient operation.

[0045] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the prior art and the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1A schematic diagram of a process flow of a security group management method provided by the present invention;

[0048] Figure 2 A specific flow chart of a security group management method provided by the present invention;

[0049] Figure 3 A schematic diagram of the structure of a security group management device provided by the present invention;

[0050] Figure 4 A schematic diagram of the structure of a security group management device provided by the present invention. DETAILED DESCRIPTION

[0051] The core of the present invention is to provide a security group management method, device, equipment and storage medium. By parsing the security group operation instructions, the target cloud platform can directly perform corresponding security group operations to achieve security group management of different cloud platforms based on security group operation instructions, thereby meeting the conditions for unified management of different cloud platforms and convenient operation.

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Please refer to Figure 1 , Figure 1 A schematic diagram of a process flow of a security group management method provided by the present invention, the method comprising:

[0054] S11: after receiving the security group operation instruction, determine the target cloud platform based on the security group operation instruction;

[0055] In order to ensure the safe and stable operation of the cloud platform, it is necessary to manage the security group of the cloud platform to control the inbound and outbound traffic of each virtual machine under the cloud platform and improve the security of the virtual machines. Although the cloud platform usually has the ability to implement security groups such as distributed firewalls, the cloud platform can only use its own distributed firewall to provide security group management functions for the virtual machines within its own management scope. Due to the large number of cloud platforms and different versions of the same cloud platform, the existing technology cannot centrally manage the security groups of different cloud platforms and different versions of cloud platforms. Therefore, it is impossible to centrally maintain and unify the maintenance of each cloud platform, resulting in high costs for cloud platform security maintenance.

[0056] In order to solve the above technical problems, in this application, after receiving the security group operation instruction, the target cloud platform is first determined based on the security group operation instruction, that is, the user can specify the target cloud platform that needs to be operated when sending the security group operation instruction, and the type, version and region of the target cloud platform are not restricted. Preferably, the target cloud platform can be but not limited to NSX-T platform, openstack, Alibaba Cloud or AWS (Amazon Web Services). Of course, users can add other cloud platforms to the security group according to their own needs. Based on this, it can be seen that in this application, users can achieve security group management of different cloud platforms only through security group operation instructions.

[0057] Among them, the security group operation instructions may include but are not limited to a combination of one or more of the following: security group creation operation instructions, security group deletion operation instructions, security group attribute modification operation instructions, security group rule addition operation instructions, security group rule deletion operation instructions, virtual machine security group addition operation instructions, and virtual machine security group removal operation instructions.

[0058] The security group creation operation instruction is to create a security group, which may include cloud platforms of different types and versions, so as to realize the centralized management of cloud platforms of different regions, types and versions. The security group deletion operation instruction is to delete the established security group. Of course, after deleting the security group, the cloud platforms in the security group are not managed by the deleted security group. The security group attribute modification operation instruction is to modify the attribute information in the security group, such as the name, location and type of the security group, which is not limited in this application. The security group rule operation instruction is to add rules in the security group, such as conditions or rules for accessing virtual machines. Of course, this application is not limited in this. Correspondingly, the security group rule deletion operation instruction is to delete certain rules in the security group, such as conditions for joining the security group, which is not limited in this application. The virtual machine joins the security group operation instruction is an instruction to add the virtual machine to the security group. The virtual machine does not belong to the security group management before sending the security group operation instruction. After joining the security group, when accessing the virtual machine, the rules of the security group must be followed, otherwise it cannot be accessed at will. Correspondingly, the virtual machine security group removal operation instruction is an instruction to delete the virtual machine in the security group. Before sending the virtual machine security group removal operation instruction, the virtual machine belongs to the security group management. Of course, an additional step can be added to determine whether the virtual machine corresponding to the virtual machine security group removal operation instruction belongs to the security group management. If it does, the virtual machine security group removal operation instruction can be executed. If it does not, the virtual machine security group removal operation instruction may not be executed, and it must also be reported to the host computer so that the user can resend the virtual machine removal operation instruction light operation.

[0059] In addition, as a preferred embodiment, after receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes: receiving the security group operation instruction through the instruction receiving module; determining the target cloud platform based on the security group operation instruction.

[0060] It can be seen that when determining the target cloud platform based on the security group operation instruction after receiving the security group operation instruction, it can be specifically but not limited to receiving the security group operation instruction through the instruction receiving module, so as to determine the target cloud platform based on the security group operation instruction after receiving the security group operation instruction. Such a setting can facilitate the processor to directly perform subsequent operations according to the received security group operation instruction, save the operation complexity of the processor, save the operating resources of the processor, and improve the operating speed of the processor.

[0061] In addition, the instruction receiving module can be but is not limited to a button or a human-computer interaction platform. When sending a security group operation instruction, the user can select the target cloud platform that needs to perform security group management through the button, and select the specific management operation through the button, that is, the management operation corresponding to the converted API (Application Program Interface) operation instruction, wherein the button can be a code instruction button, and the user selects the target cloud platform by pressing each button corresponding to the target cloud platform and pressing the buttons in sequence. For example, the button sequence corresponding to the NSX-T platform is 101, and the user can select the target cloud platform by pressing button 1, button 0 and button 1 in sequence. The button sequence corresponding to the security group creation operation instruction is 011, and the user can select the management operation corresponding to the security group creation operation instruction by pressing button 0, button 1 and button 1 in sequence. For example, the user presses 101011 in sequence, and the security group operation instruction received by the processor is the NSX-T platform executing the security group creation operation instruction.

[0062] When the user sends a security group operation instruction through the human-computer interaction platform, the user can directly touch or select the corresponding security group operation instruction on the human-computer interaction platform using the mouse pointer, which is simple to operate and saves time.

[0063] Of course, this application does not limit the way in which users send security group operation instructions, as long as they can specify the target cloud platform and the corresponding operations.

[0064] S12: convert the security group operation instructions into the corresponding API operations of the target cloud platform;

[0065] Before performing security group management on the target cloud platform based on the security group operation instructions, the security group operation instructions are first converted into the corresponding API operations of the target cloud platform to ensure that the subsequent target cloud platform can recognize the corresponding API operation instructions, thereby realizing the management of the target cloud platform.

[0066] Taking the NSX-T platform as an example, the security group operation instructions need to be converted into the corresponding API operations of the NSX-T platform, so that the NSX-T platform can execute the corresponding API operation instructions, ensure the effectiveness of the security group management of NSX-T, and ensure the safe operation of each virtual machine under the NSX-T platform. It should be noted that NSX-T is a commercial software-defined network product developed by VMware, which provides an agile software-defined infrastructure for building cloud computing application environments.

[0067] S13: Determine the target cloud platform interface based on the target cloud platform session corresponding to the target cloud platform;

[0068] In order to send the API operation instruction to the target cloud platform, it is necessary to first determine the target cloud platform interface according to the target cloud platform session corresponding to the target cloud platform to achieve connection with the target cloud platform, so as to be able to exchange information with the target cloud platform.

[0069] Still taking the target cloud platform as the NSX-T platform as an example, the NSX-T platform interface is determined based on the NSX-T platform session of the NSX-T platform, thereby achieving a communication connection with the NSX-T platform, so as to send instructions or other information to the NSX-T platform.

[0070] S14: Convert the API operation into an API operation instruction, and send it to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction.

[0071] By converting API operations into API operation instructions, after sending them to the target cloud platform through the target cloud platform interface, the target cloud platform can execute the API operation instructions to achieve security group management of the target cloud platform, that is, to achieve security group management of each virtual machine under the target cloud platform.

[0072] Taking the target cloud platform as the NSX-T platform as an example, after determining the NSX-T platform interface, establish a communication connection with the NSX-T platform, convert the API operation into an API operation instruction, and send the API operation instruction to the NSX-T platform through the NSX-T platform interface. After the NSX-T platform executes the API operation instruction, it realizes the security group management of the NSX-T platform.

[0073] Among them, the API operation instructions may include but are not limited to cloud platform distributed firewall operation API instructions or cloud platform group object operation API commands.

[0074] The cloud platform distributed firewall operation API instructions mean that the cloud platform uses its own distributed firewall to manage the security groups of the virtual machines under its management. The cloud platform group object operation API commands mean that the cloud platform uses its own group objects to manage the security groups of the virtual machines under its management to ensure the safe operation of the virtual machines in the security group. Of course, this application does not limit the specific meaning of the API operation instructions.

[0075] As a preferred embodiment, after converting the API operation into an API operation instruction and sending it to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, it also includes:

[0076] When the API operation instruction is a cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform.

[0077] Specifically, if the API operation instruction is a cloud platform distributed firewall operation API instruction, the target cloud platform can call its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machines under its management, that is, a combination of one or more of the security group creation operation instructions, security group deletion operation instructions, security group attribute modification operation instructions, security group rule addition operation instructions and security group rule deletion operation instructions, so as to realize security group management of the virtual machines under the target cloud platform and ensure the safe operation of the virtual machines.

[0078] As a preferred embodiment, after converting the API operation into an API operation instruction and sending it to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, it also includes:

[0079] When the API operation instruction is a cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group.

[0080] Specifically, if the API operation instruction is a cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group, implement the virtual machine to join the security group operation instruction and / or the virtual machine to remove the security group operation instruction, that is, select the virtual machine that needs to be managed by the security group. Of course, not all virtual machines under the same cloud platform need security group management, and this application does not limit this.

[0081] In summary, in this application, by parsing the security group operation instructions, the target cloud platform can be directly enabled to perform corresponding security group operations, so as to realize the security group management of different cloud platforms based on the security group operation instructions, and meet the conditions of unified management and convenient operation of different cloud platforms.

[0082] Based on the above embodiments:

[0083] Please refer to Figure 2 , Figure 2 A specific flow chart of a security group management method provided by the present invention.

[0084] As a preferred embodiment, after receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0085] After receiving the security group operation instruction, determine the cloud platform type and cloud platform version corresponding to the security group operation instruction through the preset adaptation rules;

[0086] Determine the target cloud platform based on the cloud platform type and cloud platform version.

[0087] In this embodiment, when receiving a security group operation instruction and determining the target cloud platform based on the security group operation instruction, the cloud platform type and cloud platform version corresponding to the security group operation instruction can be determined by the preset adaptation rule. The format of the preset adaptation rule can be but is not limited to<type,version> Of course, based on this, the format of the security group operation instruction is also<type,version> , where type defines the cloud platform type, including NSX-T platform, openstack, Alibaba Cloud or AWS, and version defines the cloud platform version, including 2.5, 3.1, 3.2, etc., which are not limited in this application. For example, based on the preset adaptation rules, it is determined that the cloud platform type corresponding to the security group operation instruction is NSX-T platform, and the cloud platform version is 2.5, then the target cloud platform is NSX-T platform version 2.5.

[0088] Based on this, the target cloud platform can be directly determined, so that security group management can be performed on the target cloud platform.

[0089] As a preferred embodiment, determining the target cloud platform interface based on the target cloud platform session corresponding to the target cloud platform includes:

[0090] Determine the target cloud platform identifier of the target cloud platform;

[0091] Through the one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool, searching for the target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool;

[0092] The authentication information of the target cloud platform interface is determined based on the target cloud platform session to determine the target cloud platform interface.

[0093] When determining the target cloud platform interface, first determine the target cloud platform identifier of the target cloud platform. At the same time, a one-to-one correspondence between the cloud platform identifier and the cloud platform session is pre-set in the preset connection pool. The target cloud platform session corresponding to the target cloud platform identifier is searched from the preset connection pool. For example, the cloud platform identifier of the NSX-T platform is NSX-T, or the id of the NSX-T platform, or the unique UUID of the NSX-T platform. Of course, this application does not limit this.

[0094] After the target cloud platform session is determined, the cloud platform session can call the authentication information of the target cloud platform interface. For example, if the upper-level security group cloud management platform manages 100 NSX-T platforms, it is necessary to find the target cloud platform interface corresponding to the target NSX-T platform from the 100 NSX-T platforms to connect to the target cloud platform.

[0095] By setting a preset connection pool, you can directly obtain the target cloud platform session from the preset connection pool. There is no need to log in to different cloud platforms separately for separate management. You only need to issue security group management operation instructions on the upper-level unified platform to achieve security group management of multiple cloud platforms.

[0096] As a preferred embodiment, the API operation is converted into an API operation instruction, and sent to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, including:

[0097] Convert API operations into API operation instructions;

[0098] Establish a connection with the target cloud platform through the target cloud platform interface;

[0099] Send API operation instructions to the target cloud platform.

[0100] In this embodiment, in order to enable the target cloud platform to execute API operation instructions, it is necessary to establish a connection with the target cloud platform through the target cloud platform interface, and then send the API operation instructions to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instructions and realizes security group management of the target cloud platform.

[0101] Based on this, when the target cloud platform executes the API operation instruction, it actually converts the distributed firewall or group object of the underlying target cloud platform into the security group model operation of the unified management plane. That is, the security group management operation instruction is to call the distributed firewall or group object of the target cloud platform to realize the upper-level security group management of the target cloud platform.

[0102] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of a security group management device provided by the present invention, the device comprising:

[0103] A first determining unit 310 is configured to determine a target cloud platform based on the security group operation instruction after receiving the security group operation instruction;

[0104] A first conversion unit 320 is used to convert the security group operation instruction into an API operation corresponding to the target cloud platform;

[0105] A second determining unit 330, configured to determine a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform;

[0106] The second conversion unit 340 is used to convert the API operation into an API operation instruction, and send it to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction.

[0107] In an optional manner, the security group operation instructions include one or more combinations of security group creation operation instructions, security group deletion operation instructions, security group attribute modification operation instructions, security group rule addition operation instructions, security group rule deletion operation instructions, virtual machine security group addition operation instructions, and virtual machine security group removal operation instructions.

[0108] In an optional manner, the first determining unit is specifically configured to:

[0109] Receiving the security group operation instruction through the instruction receiving module;

[0110] A target cloud platform is determined based on the security group operation instruction.

[0111] In an optional manner, the instruction receiving module is a button or a human-computer interaction platform.

[0112] In an optional manner, the first determining unit is specifically configured to:

[0113] After receiving the security group operation instruction, determine the cloud platform type and cloud platform version corresponding to the security group operation instruction through the preset adaptation rule;

[0114] The target cloud platform is determined based on the cloud platform type and the cloud platform version.

[0115] In an optional manner, the target cloud platform is NSX-T platform, openstack, Alibaba Cloud or AWS.

[0116] In an optional manner, the second determining unit is specifically configured to:

[0117] Determine a target cloud platform identifier of the target cloud platform;

[0118] Searching for a target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool through a one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool;

[0119] Authentication information of the target cloud platform interface is determined based on the target cloud platform session to determine the target cloud platform interface.

[0120] In an optional manner, the second conversion unit is specifically used for:

[0121] Convert the API operation into the API operation instruction;

[0122] Establishing a connection with the target cloud platform through the target cloud platform interface;

[0123] Send the API operation instruction to the target cloud platform.

[0124] In an optional manner, the API operation instruction includes a cloud platform distributed firewall operation API instruction or a cloud platform group object operation API command.

[0125] In an optional manner, the security group management device converts the API operation into an API operation instruction in the second conversion unit, and sends it to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, and is further used to:

[0126] When the API operation instruction is the cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform.

[0127] In an optional manner, the security group management device converts the API operation into an API operation instruction in the second conversion unit, and sends it to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, and is further used to:

[0128] When the API operation instruction is the cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group.

[0129] For an introduction to a security group management system provided by the present invention, please refer to the above method embodiment, and the present invention will not be repeated here.

[0130] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of a security group management device provided by the present invention. The specific embodiments of the present invention do not limit the specific implementation of the security group management device.

[0131] like Figure 4 As shown, the security group management device may include: a processor (processor) 402, a communication interface (Communications Interface) 404, a memory (memory) 406, and a communication bus 408.

[0132] The processor 402, the communication interface 404, and the memory 406 communicate with each other via the communication bus 408. The communication interface 404 is used to communicate with other devices such as a client or other server network elements. The processor 402 is used to execute the program 410, which can specifically execute the relevant steps in the above-mentioned embodiment of the security group management method.

[0133] Specifically, the program 410 may include program code including computer executable instructions.

[0134] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the security group management device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0135] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0136] Program 410 may be specifically called by processor 402 to enable the security group management device to perform the following operations:

[0137] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction;

[0138] Convert the security group operation instruction into an API operation corresponding to the target cloud platform;

[0139] determining a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform;

[0140] The API operation is converted into an API operation instruction, and sent to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction.

[0141] In an optional manner, the security group operation instructions include one or more combinations of security group creation operation instructions, security group deletion operation instructions, security group attribute modification operation instructions, security group rule addition operation instructions, security group rule deletion operation instructions, virtual machine security group addition operation instructions, and virtual machine security group removal operation instructions.

[0142] In an optional manner, the program 410 is called by the processor 402 to enable the security group management device to perform the following operations:

[0143] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0144] Receiving the security group operation instruction through the instruction receiving module;

[0145] A target cloud platform is determined based on the security group operation instruction.

[0146] In an optional manner, the instruction receiving module is a button or a human-computer interaction platform.

[0147] In an optional manner, the program 410 is called by the processor 402 to enable the security group management device to perform the following operations:

[0148] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0149] After receiving the security group operation instruction, determine the cloud platform type and cloud platform version corresponding to the security group operation instruction through the preset adaptation rule;

[0150] The target cloud platform is determined based on the cloud platform type and the cloud platform version.

[0151] In an optional manner, the target cloud platform is NSX-T platform, openstack, Alibaba Cloud or AWS.

[0152] In an optional manner, the program 410 is called by the processor 402 to enable the security group management device to perform the following operations:

[0153] Determining a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform includes:

[0154] Determine a target cloud platform identifier of the target cloud platform;

[0155] Searching for a target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool through a one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool;

[0156] Authentication information of the target cloud platform interface is determined based on the target cloud platform session to determine the target cloud platform interface.

[0157] In an optional manner, the program 410 is called by the processor 402 to enable the security group management device to perform the following operations:

[0158] Converting the API operation into an API operation instruction, and sending the instruction to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction, including:

[0159] Convert the API operation into the API operation instruction;

[0160] Establishing a connection with the target cloud platform through the target cloud platform interface;

[0161] Send the API operation instruction to the target cloud platform.

[0162] In an optional manner, the API operation instruction includes a cloud platform distributed firewall operation API instruction or a cloud platform group object operation API command.

[0163] In an optional manner, the program 410 is called by the processor 402 to enable the security group management device to perform the following operations:

[0164] After converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, the method further includes:

[0165] When the API operation instruction is the cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform.

[0166] In an optional manner, the program 410 is called by the processor 402 to enable the security group management device to perform the following operations:

[0167] After converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, the method further includes:

[0168] When the API operation instruction is the cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group.

[0169] In an optional manner, the security group management device further includes:

[0170] The instruction receiving module is used to receive security group operation instructions.

[0171] For an introduction to a security group management device provided by the present invention, please refer to the above method embodiment, and the present invention will not be repeated here.

[0172] An embodiment of the present invention provides a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on a security group management device / apparatus, the security group management device / apparatus executes the security group management method in any of the above method embodiments.

[0173] The executable instructions may be specifically used to enable the security group management device / apparatus to perform the following operations:

[0174] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction;

[0175] Convert the security group operation instruction into an API operation corresponding to the target cloud platform;

[0176] determining a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform;

[0177] The API operation is converted into an API operation instruction, and sent to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction.

[0178] In an optional manner, the security group operation instructions include one or more combinations of security group creation operation instructions, security group deletion operation instructions, security group attribute modification operation instructions, security group rule addition operation instructions, security group rule deletion operation instructions, virtual machine security group addition operation instructions, and virtual machine security group removal operation instructions.

[0179] In an optional manner, the executable instruction enables the security group management device / apparatus to perform the following operations:

[0180] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0181] Receiving the security group operation instruction through the instruction receiving module;

[0182] A target cloud platform is determined based on the security group operation instruction.

[0183] In an optional manner, the instruction receiving module is a button or a human-computer interaction platform.

[0184] In an optional manner, the executable instruction enables the security group management device / apparatus to perform the following operations:

[0185] After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes:

[0186] After receiving the security group operation instruction, determine the cloud platform type and cloud platform version corresponding to the security group operation instruction through the preset adaptation rule;

[0187] The target cloud platform is determined based on the cloud platform type and the cloud platform version.

[0188] In an optional manner, the target cloud platform is NSX-T platform, openstack, Alibaba Cloud or AWS.

[0189] In an optional manner, the executable instruction enables the security group management device / apparatus to perform the following operations:

[0190] Determining a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform includes:

[0191] Determine a target cloud platform identifier of the target cloud platform;

[0192] Searching for a target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool through a one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool;

[0193] Authentication information of the target cloud platform interface is determined based on the target cloud platform session to determine the target cloud platform interface.

[0194] In an optional manner, the executable instruction enables the security group management device / apparatus to perform the following operations:

[0195] Converting the API operation into an API operation instruction, and sending the instruction to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction, including:

[0196] Convert the API operation into the API operation instruction;

[0197] Establishing a connection with the target cloud platform through the target cloud platform interface;

[0198] Send the API operation instruction to the target cloud platform.

[0199] In an optional manner, the API operation instruction includes a cloud platform distributed firewall operation API instruction or a cloud platform group object operation API command.

[0200] In an optional manner, the executable instruction enables the security group management device / apparatus to perform the following operations:

[0201] After converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, the method further includes:

[0202] When the API operation instruction is the cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform.

[0203] In an optional manner, the executable instruction enables the security group management device / apparatus to perform the following operations:

[0204] After converting the API operation into an API operation instruction and sending the instruction to the target cloud platform through the target cloud platform interface so that the target cloud platform executes the API operation instruction, the method further includes:

[0205] When the API operation instruction is the cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group.

[0206] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the above method embodiment, and the present invention will not be repeated here.

[0207] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0208] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security group management method, characterized in that: include: After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction; Convert the security group operation instruction into an API operation corresponding to the target cloud platform; determining a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform; Convert the API operation into an API operation instruction, and send it to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction; the API operation instruction includes a cloud platform distributed firewall operation API instruction or a cloud platform group object operation API command; When the API operation instruction is the cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform; When the API operation instruction is the cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group; The security group operation instruction includes a combination of one or more of a security group creation operation instruction, a security group deletion operation instruction, a security group attribute modification operation instruction, a security group rule addition operation instruction, a security group rule deletion operation instruction, a virtual machine security group addition operation instruction, and a virtual machine security group removal operation instruction; wherein, when the virtual machine corresponding to the virtual machine security operation instruction belongs to the step of security group management, the virtual machine security operation instruction can be executed, and when it does not belong, the virtual machine security operation instruction is not executed, and it is also necessary to report to the host computer so that the user can resend the virtual machine removal operation instruction; Wherein, after receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes: Receiving the security group operation instruction through the instruction receiving module; Determine a target cloud platform based on the security group operation instruction; Wherein, determining the target cloud platform interface based on the target cloud platform session corresponding to the target cloud platform includes: Determine a target cloud platform identifier of the target cloud platform; Searching for a target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool through a one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool; Authentication information of the target cloud platform interface is determined based on the target cloud platform session to determine the target cloud platform interface.

2. The security group management method according to claim 1, characterized in that: The instruction receiving module is a button or a human-computer interaction platform.

3. The security group management method according to claim 1, characterized in that: After receiving the security group operation instruction, determining the target cloud platform based on the security group operation instruction includes: After receiving the security group operation instruction, determine the cloud platform type and cloud platform version corresponding to the security group operation instruction through a preset adaptation rule; The target cloud platform is determined based on the cloud platform type and the cloud platform version.

4. The security group management method according to claim 1, characterized in that: The target cloud platform is NSX-T platform, openstack, Alibaba Cloud or AWS.

5. The security group management method according to claim 1, characterized in that: Converting the API operation into an API operation instruction, and sending the instruction to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction, including: Convert the API operation into the API operation instruction; Establishing a connection with the target cloud platform through the target cloud platform interface; Send the API operation instruction to the target cloud platform.

6. A security group management device, characterized in that: include: A first determining unit, configured to determine a target cloud platform based on the security group operation instruction after receiving the security group operation instruction; A first conversion unit, configured to convert the security group operation instruction into an API operation corresponding to the target cloud platform; A second determining unit, configured to determine a target cloud platform interface based on a target cloud platform session corresponding to the target cloud platform; A second conversion unit is used to convert the API operation into an API operation instruction, and send it to the target cloud platform through the target cloud platform interface, so that the target cloud platform executes the API operation instruction; the API operation instruction includes a cloud platform distributed firewall operation API instruction or a cloud platform group object operation API command; The security group management device is also used for: when the API operation instruction is the cloud platform distributed firewall operation API instruction, the target cloud platform calls its own distributed firewall to execute the cloud platform group creation command or policy adjustment of the virtual machine under the target cloud platform; when the API operation instruction is the cloud platform group object operation API command, the target cloud platform calls its own group object to add the target virtual machine corresponding to the cloud platform group object operation API command to the security group or delete it from the security group; The security group operation instruction includes a combination of one or more of a security group creation operation instruction, a security group deletion operation instruction, a security group attribute modification operation instruction, a security group rule addition operation instruction, a security group rule deletion operation instruction, a virtual machine security group addition operation instruction, and a virtual machine security group removal operation instruction; wherein, when the virtual machine corresponding to the virtual machine security operation instruction belongs to the step of security group management, the virtual machine security operation instruction can be executed, and when it does not belong, the virtual machine security operation instruction is not executed, and it is also necessary to report to the host computer so that the user can resend the virtual machine removal operation instruction; The first determining unit is used to: receive the security group operation instruction through the instruction receiving module; determine the target cloud platform based on the security group operation instruction; Among them, the second determination unit is used to: determine the target cloud platform identifier of the target cloud platform; search for the target cloud platform session corresponding to the target cloud platform identifier from the preset connection pool through the one-to-one correspondence between the cloud platform identifier and the cloud platform session in the preset connection pool; determine the authentication information of the target cloud platform interface based on the target cloud platform session to determine the target cloud platform interface.

7. The security group management device according to claim 6, characterized in that: The second conversion unit is used to: convert the API operation into the API operation instruction; establish a connection with the target cloud platform through the target cloud platform interface; and send the API operation instruction to the target cloud platform.

8. A security group management device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the security group management method as described in any one of claims 1-5.

9. A computer-readable storage medium, characterized in that: The storage medium stores at least one executable instruction, and when the executable instruction is executed on the security group management device / apparatus, the security group management device / apparatus performs the operation of the security group management method as described in any one of claims 1-5.

Images