Service calling method in hybrid cloud environment, electronic device and system

Abstract

The application relates to the computer technical field, in particular to a service calling method in a hybrid cloud environment, an electronic device and a system. The method comprises the following steps: a first private cloud platform in at least one private cloud platform receives a first calling request, wherein the first calling request is a calling request for a platform service running in a hybrid cloud environment; it is determined that the first calling request meets preset forwarding conditions for forwarding to a platform service deployed on at least one public cloud platform for processing; the first private cloud platform encrypts the first calling request, and forwards the encrypted first calling request to a first public cloud platform; it is determined that the first calling request does not meet the preset forwarding conditions; and the first private cloud platform sends the first calling request to a second platform service on the first private cloud platform. In this way, the security of external service calling on the public cloud platform can be improved, and the efficiency of processing service calling requests in the hybrid cloud environment can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a service calling method in hybrid cloud environment, electronic device and system. BACKGROUND

[0002] Cloud computing, as a new industry in recent years, has attracted extensive attention from the scientific research and industrial circles. In current commercial scenarios, platform services provided by cloud platforms and user services provided by terminal software or application programs to support the required functions often depend on each other to achieve the maximum effect. For example, platform services can provide some non-business functions that can support user services, and user services can rely on the functions provided by platform services to expand their business capabilities.

[0003] Currently, cloud platforms providing platform services are mainly divided into two categories based on the difference in running environment: public clouds and private clouds. Among them, the public cloud provides a platform service solution that can rely on a cloud service provider, such as Ali Cloud TM , Tencent Cloud TM , etc. The platform service is deployed on the public cloud, and the user terminal needs to access the public cloud through the public network to call the corresponding platform service. The private cloud provides a platform service solution that requires user enterprises to provide intranet servers and middleware to deploy all or part of the required platform services. At present, the more widely used platform service solution is to use a hybrid cloud that combines public clouds and private clouds to provide platform services. In this way, the technical advantages of public clouds and private clouds can be combined to provide more comprehensive and secure platform services for users.

[0004] Although, at present, a border router can be set in the public cloud and the private cloud, and the border routers in the public cloud and the private cloud are connected through a physical dedicated line to build a hybrid cloud environment, which realizes private network intercommunication in the hybrid cloud environment and enables the public cloud and the private cloud to share data and the platform services provided by each other. However, in the above hybrid cloud environment, the border router cannot accurately identify whether the service calling request from the user terminal is for the platform service provided by the public cloud or the platform service provided by the private cloud, which easily leads to a long forwarding time of the service calling request in the hybrid cloud environment, thus resulting in a large service calling delay and a long response time of the user terminal, which is not conducive to improving the user experience. SUMMARY

[0005] The application provides a service calling method in a hybrid cloud environment, an electronic device and a system. The service calling request for the platform service running in the hybrid cloud environment is accessed through the private cloud platform with higher security, and the service calling request for the external service on the public cloud is encrypted and then forwarded to the public cloud platform, so as to improve the security of the process of calling the public cloud platform service of the service end of the business system. In addition, when the service calling request is accessed, the running environment to which the service calling request corresponds is distinguished, so that the processing efficiency of the cloud platform providing the hybrid cloud environment for the service calling request is improved, the service calling request of the service end is responded more quickly, the data processing efficiency of the service end is improved, and the use experience of the user is improved.

[0006] In a first aspect, the application provides a service calling method applied to a cloud platform providing a hybrid cloud environment. The cloud platform includes at least one private cloud platform and at least one public cloud platform. The method includes: receiving, by a first private cloud platform in the at least one private cloud platform, a first calling request, wherein the first calling request is a calling request for a platform service running in the hybrid cloud environment; determining that the first calling request meets a preset forwarding condition for forwarding to a platform service deployed on the at least one public cloud platform for processing; encrypting, by the first private cloud platform, the first calling request; and forwarding, by the first private cloud platform, the encrypted first calling request to a first public cloud platform, wherein the preset forwarding condition includes determining that a target service corresponding to the first calling request is a first platform service provided by the first public cloud platform; determining that the first calling request does not meet the preset forwarding condition; and sending, by the first private cloud platform, the first calling request to a second platform service, wherein the second platform service is a service provided by the first private cloud platform.

[0007] For example, the cloud platform providing the hybrid cloud environment includes a private cloud platform and a public cloud platform. The private cloud platform is responsible for accessing the service calling request for each platform service on the cloud platform, i.e., the first calling request described above. It can be understood that in the service calling method provided by the application, the private cloud platform is responsible for accessing the service calling request, and therefore the platform service on the cloud platform described above or the platform service running in the hybrid cloud environment described above, for example, can be an internal service running in the private cloud environment provided by the private cloud platform, including the second platform service described above. The platform service on the cloud platform described above, for example, can also be an external service running in the public cloud environment provided by the public cloud platform, including the first platform service described above. In other embodiments, the platform service running in the private cloud environment and the platform service running in the public cloud environment can also be described as other types of names, which are not limited herein.

[0008] Therefore, the service calling scheme provided by the first aspect can be used to uniformly receive the service calling request by the private cloud platform with high security in the process of processing the calling request for the platform service in the hybrid cloud environment. Then, the private cloud platform can encrypt and forward the received service calling request to the public cloud platform for processing when it is determined that the received service calling request is the calling request for the external service provided by the public cloud platform, i.e., the preset forwarding condition is met. In this way, the security of the external service calling on the public cloud platform can be improved, and the efficiency of processing the service calling request in the hybrid cloud environment can be improved.

[0009] In a possible implementation of the first aspect, the cloud platform has a preset target service list, the target service list is used to record the related information of one or more platform services provided by the first public cloud platform, and the determination that the first calling request meets the preset forwarding condition for forwarding to the platform service deployed on at least one public cloud platform for processing includes: the first private cloud platform compares the related information of the target service with the related information of each platform service in the target service list; and the first private cloud platform determines that the related information of the target service matches the related information of the first platform service in the target service list, and determines that the first calling request meets the preset forwarding condition.

[0010] In a possible implementation of the first aspect, the cloud platform has a preset second service list, the target service list is used to record the related information of one or more platform services provided by the first private cloud platform, and the determination that the first calling request meets the preset forwarding condition for forwarding to the platform service deployed on at least one public cloud platform for processing includes: the first private cloud platform compares the related information of the target service with the related information of each platform service in the second service list; and the first private cloud platform determines that the related information of the target service has no matching information record in the second service list, and determines that the first calling request meets the preset forwarding condition.

[0011] In a possible implementation of the first aspect, the determination that the first calling request does not meet the preset forwarding condition includes: the first private cloud platform determines that the related information of the target service matches the related information of the second platform service in the second service list, and determines that the first calling request does not meet the preset forwarding condition.

[0012] In a possible implementation of the first aspect, the target service list or the second service list is preset on the first private cloud platform; or the target service list or the second service list is preset in a data storage space provided by the first public cloud platform to the first private cloud platform.

[0013] In a possible implementation of the first aspect, the related information of the platform service includes at least one of the following: identification information of the first platform service or the second platform service; public cloud environment information to which the first platform service belongs or private cloud environment information to which the second platform service belongs; path information of the first platform service or the second platform service.

[0014] In a possible implementation of the first aspect, the first private cloud platform includes a first key preset for the first calling request that meets a preset forwarding condition, and the encrypting the first calling request includes:

[0015] The first private cloud platform encrypts the first calling request by using the first key.

[0016] In a possible implementation of the first aspect, the sending the first calling request to the second platform service includes: the first private cloud platform confirming that a requestor of the first calling request has a calling permission for the second platform service, and sending the first calling request to the second platform service.

[0017] It can be understood that when the private cloud platform receives a service calling request for a platform service in the hybrid cloud environment, the private cloud platform can first perform authentication, for example, confirming whether the requestor of the first calling request has a calling permission for the first platform service or the second platform service. Then, for the first calling request that passes the authentication, the first calling request is forwarded to the first platform service or the public cloud platform where the second platform service is located. In this way, the service calling request accessing the hybrid cloud environment can be filtered, and the related resources in the hybrid cloud environment can be prevented from being occupied by the service calling request without permission.

[0018] In a possible implementation of the first aspect, the first private cloud platform includes a first gateway module and a pre-deployed routing service, and the method includes: the first gateway module receiving the first calling request for the target service; determining that the first calling request meets a preset forwarding condition of being forwarded to a platform service deployed on at least one public cloud platform for processing, and the first gateway module sending a forwarding request to the routing service; in response to the forwarding request, the routing service encrypting the first calling request and forwarding the encrypted first calling request to the first public cloud platform; determining that the first calling request does not meet the preset forwarding condition, and the first gateway module sending the first calling request to the second platform service.

[0019] That is, the private cloud platform can access the service calling request through the gateway module. The gateway module can determine whether the service calling request received by the private cloud platform meets a preset forwarding condition. When the service calling request meets the forwarding condition, the gateway module on the private cloud platform can forward the received service calling request to the public cloud platform, for example, to the first public cloud platform.

[0020] In a possible implementation of the first aspect, the first public cloud platform comprises a second gateway module, and forwarding the encrypted first invocation request to the first public cloud platform comprises: the routing service sends the encrypted first invocation request to the second gateway module, and the second gateway module sends the first invocation request to the first platform service if it is determined that the requester of the first invocation request has the invocation authority.

[0021] In a second aspect, the present application provides an electronic device, comprising: one or more processors; one or more memories; the one or more memories store one or more programs, when the one or more programs are executed by the one or more processors, the electronic device is caused to run a cloud platform providing a hybrid cloud environment, and perform the service invocation method provided in the first aspect and various possible implementations of the first aspect.

[0022] In a third aspect, the present application provides a service system, comprising a server and a client, wherein the server runs on a cloud platform providing a hybrid cloud environment, the cloud platform comprises at least one private cloud platform and at least one public cloud platform, and the server responds to the service invocation request sent by the client by performing the service invocation method provided in the first aspect and various possible implementations of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 Fig. 1 shows a hybrid environment service invocation scenario provided by an embodiment of the present application.

[0024] Figure 2 Fig. 2 shows a software structure of a private cloud and a public cloud in a hybrid cloud environment provided by an embodiment of the present application.

[0025] Figure 3 Fig. 3 shows a process of a cloud platform providing a hybrid cloud environment responding to a service invocation request sent by a user terminal provided by an embodiment of the present application.

[0026] Figure 4 Fig. 4 shows an implementation flowchart of a service invocation method in a hybrid cloud environment provided by an embodiment of the present application.

[0027] Figure 5 Fig. 5 shows an electronic device structure for running a cloud platform providing a hybrid cloud environment provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be described in detail below with reference to the drawings in the specification and specific implementation manners.

[0029] For the convenience of those skilled in the art to understand the schemes in the embodiments of the present application, some concepts and terms related to the embodiments of the present application are explained first.

[0030] (1) Public cloud is a cloud platform mode for providing public computing resources and platform services to the public. For example, the public cloud can be a resource provided by an internet data center (IDC) service provider or a third party, such as application computing and storage resources. These resources can be deployed in the service provider's premises, and users can obtain these resources and use them through a public network such as the Internet. The advantage of the public cloud is low cost and excellent scalability. The disadvantages are lack of control over cloud resources, security of confidential data, network performance and matching problems.

[0031] (2) Private cloud is a cloud platform mode that extends and optimizes the traditional data center of an enterprise, and can provide storage capacity and processing capacity for various functions. "Private" more refers to the fact that such a platform is a non-shared resource, rather than a security advantage. The private cloud is built for a single customer and is exclusively used by the customer. Therefore, the data, security and service quality provided by these private clouds are better guaranteed than public clouds.

[0032] (3) Hybrid cloud is the current mainstream cloud platform mode. In the hybrid cloud mode, the cloud platform is composed of two different modes, namely private cloud and public cloud. The private cloud and the public cloud platform are still independent entities, but they are bound to each other through standardized or proprietary technology, and can transplant data and applications between each other, thereby realizing data sharing and interaction between the platform services they provide. In the case of applying the hybrid cloud mode, the enterprise user can deploy secondary applications and data to the public cloud to fully utilize the advantages of the public cloud in scalability and cost, while deploying critical applications and data to the private cloud for higher security.

[0033] Figure 1 According to the embodiments of the present application, a service calling scenario diagram of a hybrid environment is shown.

[0034] As shown in Figure 1 , the scenario includes a user terminal 100 and a cloud platform providing a hybrid cloud environment, which can include at least one private cloud 200 and at least one public cloud 300. The user terminal 100 can run a client that provides various user services, such as an insurance business system software or application program product that provides insurance services, policy management, etc., without limitation.

[0035] It can be understood that in the above hybrid cloud environment, the private cloud 200 and the public cloud 300 can respectively deploy platform services for supporting user service to implement various functions, for example, some platform services can provide computing resources for processing the calculation of a large number of insurance data, and provide storage resources for storing the information of the insurance company's policyholder, etc., which is not limited here.

[0036] In order to distinguish the platform services provided by the private cloud 200 and the public cloud 300, the platform services provided by the private cloud 200 are referred to as internal services, and the platform services provided by the public cloud 300 are referred to as external services in the embodiments of the present application. In the embodiments of the present application, for security considerations and to optimize the resource structure, the user can choose to deploy fewer internal services on the private cloud 200 to provide necessary business functions, and more general function services that can be universally provided to tenants on the public cloud can be deployed on the public cloud 300, that is, the above-mentioned external services. This is not limited here.

[0037] It can be understood that in the above hybrid cloud environment, Figure 1 In the scenario shown, the user service provided by the client running on the user terminal 100 can need to obtain internal services provided by the hybrid cloud environment to implement corresponding functions, or can need to obtain external services to implement corresponding functions. As described above, the private cloud 200 and the public cloud 300 supporting the hybrid cloud environment can respectively deploy edge routers and establish physical dedicated line connections to implement data sharing and service interaction, etc., and then the user terminal 100 can obtain the external services provided by the public cloud 300 through the private cloud 200. However, in this hybrid cloud environment, the private cloud 200 cannot timely distinguish whether the accessed service call request is for the internal services provided by the private cloud 200 or for the external services provided by the public cloud 300. Therefore, it can cause the forwarding time of the service call request in the hybrid cloud environment to be too long, and further cause the service call delay to be large, and the user terminal response time to be long, which is not conducive to improving the user experience.

[0038] In order to solve the above problems, the embodiments of the present application provide a service call method in a hybrid cloud environment, applied to a cloud platform. The cloud platform can run on an electronic device with rich hardware resources such as a server or a server cluster, and the cloud platform includes a public cloud and a private cloud, wherein the private cloud provides a private cloud environment in the hybrid cloud environment, and the public cloud provides a public cloud environment in the hybrid cloud environment.

[0039] Specifically, the method pre-configures a service list on a private cloud in a hybrid cloud environment, the service list can include information about each external service provided by a public cloud, and the service list can be preset in the form of a file in a common access space of the private cloud or the hybrid cloud environment. Further, the method deploys a routing service on the private cloud for forwarding service call requests to the public cloud, and uses the pre-configured service list as an API gateway on the private cloud to determine whether to forward a received service call request to the public cloud through the routing service. The API gateway is an application programming interface (API) gateway for receiving service call requests. The API gateway can direct service call requests that meet the preset forwarding conditions to the preset routing service, which forwards the service call requests to the public cloud.

[0040] For example, the service call request that meets the preset forwarding conditions can be the same as the API request corresponding to the pre-configured platform service in the service list. For the service call request that does not meet the preset forwarding conditions, for example, the API request for a service other than the pre-configured platform service in the service list, the API gateway can forward the service call request to the corresponding internal service on the private cloud after authenticating the service call request according to existing processing logic. The authentication can be, for example, a check of whether the requester of the service call request has the authority to call the requested service. The specific check method can be, for example, a check according to the tenant authority of the requester in the corresponding cloud, without limitation.

[0041] In this way, in the hybrid cloud environment, the service call request from the user terminal can be forwarded differently, so as to accurately call the corresponding platform service on the public cloud and the private cloud, improve the response efficiency of the service call request, and ultimately improve the response efficiency of the user terminal to user operations, which is beneficial to improving the user experience. In order to ensure the security of forwarding service call requests from multiple private clouds to the same public cloud for processing, a multi-tenant isolation mechanism can be applied on the public cloud to isolate data in different tenant spaces provided by different private clouds, which can further improve the security of calling external services on the public cloud.

[0042] It can be understood that in some embodiments, the above service list can be preset in a group, for example, only the external service list for recording the information related to the external service provided by the public cloud is preset, or only the internal service list for recording the information related to the internal service provided by the private cloud is preset. At this time, if the platform service corresponding to the service call request is on the external service list or not on the internal service list, it can be judged that the request meets the preset forwarding condition and needs to be forwarded through the routing service. On the contrary, if the platform service corresponding to the service call request is not on the external service list or not on the internal service list, it can be judged that the request does not meet the preset forwarding condition. In other embodiments, the above service list can also be preset in two groups, for example, the above internal service list and external service list can be preset at the same time, which is not limited here.

[0043] It can be understood that when the routing service forwards the service call request meeting the preset forwarding condition to the public cloud, the related data packet of the service call request can be encrypted using the preconfigured key, and then the encrypted service call request data packet is forwarded to the public cloud for processing. In this way, the security of accessing the public cloud to call the external service can also be improved.

[0044] It can be understood that the electronic device to which the service call method in the hybrid cloud environment provided by the present application is applicable, for example, can be a server, a server cluster, a supercomputer and other electronic devices embedded or coupled with multiple processors and capable of accessing a network for providing various hardware resources, etc., which is not limited here.

[0045] Figure 2 According to an embodiment of the present application, a software structure schematic diagram of a private cloud and a public cloud in a hybrid cloud environment is shown.

[0046] As shown in Figure 2 The private cloud 200 included in the hybrid cloud environment can include a gateway module 201, a configuration module 202, an authentication module 203 and an interface module 204. It can be understood that in other embodiments, the private cloud 200 can also include more or less functional modules than Figure 2 It is not limited here.

[0047] The gateway module 201 is used to receive the service call request sent by the user terminal, and can be used for authentication, authorization, forwarding of the service call request, and controlling the number of access requests when the request is large, that is, flow limiting, etc. It can be understood that the gateway module 201 mainly accesses the service call request or other API request of the private cloud 200 to play a role in security control, which is to prevent unauthorized access and protect the backend service such as the internal service provided by the private cloud 200 from being affected by excessive requests to cause service exceptions.

[0048] Configuration module 202 is the configuration center on private cloud 200, used for data management of configuration data corresponding to internal services provided by private cloud 200. For example, it manages the environment information of the corresponding internal service operation and the database resource path information that needs to be called during runtime. In this embodiment, configuration module 202 can also add or update external service-related information obtained by private cloud 200, such as the identification information of external services provided by public cloud 300, the public cloud environment information, and service call path information, to a preset service list for use by gateway module 201. In addition, configuration module 202 can also be used to configure and manage key information set for service call requests that need to be forwarded. This key information can be used by the routing service deployed on private cloud 200 to encrypt the service call requests that need to be forwarded. Then, the routing service sends the encrypted service call request data packet to the public cloud to improve the security of accessing external services from public cloud 300.

[0049] The authentication module 203 is used to authenticate the received service call requests or other API requests. For example, it verifies whether the requester of the service call request has the permission to call the corresponding service, or whether the requester has the right to use the API corresponding to the requested service. It can be understood that the authentication module 203 can be called by the aforementioned gateway module 201 to authenticate various API requests.

[0050] Interface module 204 is used to call the API provided by public cloud 300 to forward service call requests to external services to public cloud 300.

[0051] Continue to refer to Figure 2 As shown, the public cloud 300 included in this hybrid cloud environment may include a gateway module 301, a configuration module 302, an authentication module 303, and a user module 304. It can be understood that the public cloud 300 may also include more than [other components]. Figure 2 The public cloud 300 may include more or fewer functional modules, such as in other embodiments, a multilingual module that supports multilingual recognition and processing, an audit module that supports auditing, a product definition module that supports defining projects or service products, and email modules, SMS modules, etc., without limitation.

[0052] Specifically, gateway module 301 is used to receive service call requests forwarded by the routing service deployed on private cloud 200 through the aforementioned interface module 204, and to perform authentication and rate limiting on the service call requests. It can be understood that gateway module 301 primarily performs security control on forwarded service call requests on public cloud 300, both to prevent unauthorized access and to protect backend services, such as external services provided by public cloud 300, from service anomalies caused by excessive requests.

[0053] The configuration module 302 is a configuration center on the public cloud 300, configured to manage configuration data corresponding to external services provided by the public cloud 300. For example, environment information for running corresponding services, database resource path information required for runtime calling, and the like are managed. In the embodiments of the present application, the configuration module 302 can also add or update identification information corresponding to the service information provided by the public cloud 300, information of the running environment, and service calling path information, and the like to a preset service list, and configure the service list in a space available for the gateway module 201 of the private cloud 200 to call, so as to be called by the gateway module 201.

[0054] The authentication module 303 is configured to perform permission authentication on the received service calling request or other API request, and can be called by the gateway module 301 to perform authentication on various API requests.

[0055] The user module 304 is configured to manage user logged account information, related tenant information, and associated other account information, including adding, modifying, deleting corresponding information records, and the like.

[0056] It can be understood that the above-mentioned modules constituting the private cloud 200 or the public cloud 300 can also be microservices deployed in the corresponding private cloud environment or public cloud environment to provide corresponding functions, which are not limited herein.

[0057] It can be understood that based on the above Figure 2 The structure of the private cloud 200 and the public cloud 300 in the hybrid cloud environment shown in the above Figure 2 The process of deploying a routing service in the hybrid cloud environment shown in the above

[0058] Figure 3 According to the embodiments of the present application, a process diagram of a cloud platform in a hybrid cloud environment responding to a service calling request issued by a user terminal is shown.

[0059] As shown in Figure 3As shown, the platform services provided by the cloud platform providing the hybrid cloud environment can include the internal services 210 provided by the private cloud 200 and the external services 310 provided by the public cloud 300. Among them, the internal services 210 deployed on the private cloud 200 can include a routing service 211 for forwarding service call requests to the public cloud 300. The routing service 211 on the private cloud 200 can cooperate with the gateway module 201 to perform shunting processing on the received service call requests. It can be understood that the above-mentioned internal services 210 and external services 310 can constitute a service end of a business system deployed on a cloud platform, for example, a service end of an insurance business system, which provides various service supports related to the insurance business for a client end of the insurance business system.

[0060] With reference to the foregoing, the hybrid cloud environment can be used to provide a service call method. Figure 3 As shown, for example, a client end of a corresponding business system can be installed on the user terminal 100. The user terminal 100 can send a corresponding service call request to the service end 410 in response to the operation of the user on the client end interface. The service call request can access the cloud platform through the gateway module 201 of the private cloud 200, that is, it can first access the private cloud environment in the hybrid cloud environment.

[0061] The gateway module 201 on the private cloud 200 can determine whether the currently received service call request meets the condition of being forwarded to the public cloud 300 according to a preset service list, and divert the service call request meeting the preset forwarding condition to the routing service 211. In turn, the routing service 211 can forward the service call request to the public cloud 300. The service call request that does not meet the preset forwarding condition can be authenticated by the gateway module 201, and in the case of passing the authentication, the service call request is sent to the corresponding internal service 210 for response.

[0062] The public cloud 300 can access the service call request forwarded by the routing service 211 through the gateway module 301. In turn, the gateway module 301 on the public cloud 300 can send the request to the corresponding external service 310 for response in the case of passing the authentication of the forwarded service call request.

[0063] That is, the processing path of the service call request corresponding to the external service provided by the public cloud 300 can be: gateway module 201→routing service 210→public cloud 300→gateway module 301→external service 310.

[0064] In contrast, the processing path of the service call request corresponding to the internal service provided by the private cloud 200 can be: gateway module 201→internal service 210.

[0065] Specifically, the specific implementation process of the service call method provided by the present application will be introduced in more detail in combination with the interaction flowchart.

[0066] Figure 4 An implementation flowchart of a service calling method in a hybrid cloud environment is shown according to an embodiment of the present application.

[0067] As shown in Figure 4 , the interaction flow can involve the interaction between the gateway module 201, the internal service 210 and the routing service 211 on the private cloud 200, and the gateway module 301 and the external service 310 on the public cloud 300.

[0068] Specifically, the interaction flow can include the following steps.

[0069] 401: The gateway module 201 receives a service calling request.

[0070] Exemplarily, the user terminal 100 can send a corresponding service calling request to the server 410 in response to a user operation to request the corresponding business service to provide a corresponding service function to perform corresponding data processing. At this time, the gateway module 201 on the private cloud 200 can receive the service calling request sent by the user terminal 100. As an example, the service calling request can be an http request, etc., which is not limited herein.

[0071] It can be understood that in the embodiments of the present application, the service calling request accessing the hybrid cloud environment for processing can be received by default by the gateway module 201 on the private cloud 200. The above service calling request can be, for example, a service calling request for requesting a premium calculation service in an insurance business system, or a service calling request for statistical service of historical business data. The premium calculation service associated with the insurance business belongs to the business service, which can be deployed on the private cloud 200, and the statistical service with low association with the insurance business belongs to the non-business service, which can be deployed on the public cloud 300. In other embodiments, the service calling request received by the gateway module 201 also includes service calling requests for other business services and non-business services, which are not enumerated and described herein.

[0072] 402: The gateway module 201 authenticates the received service calling request.

[0073] Exemplarily, the gateway module 201 on the private cloud 200 can first authenticate the received service calling request to filter some interference of unauthorized users requesting to call the corresponding service. In this way, the service resources provided by the hybrid cloud environment can focus on responding to service calling requests with authorization. The authentication process can also be, for example, a request party verification of the corresponding service calling request to check whether the request party has the authorization to call the requested service. The specific verification method can be, for example, to verify the tenant authorization of the request party on the private cloud 200, etc., which is not limited herein.

[0074] In some embodiments, the gateway module 201 on the private cloud 200 can also perform the following step 403 to determine whether the received service invocation request needs to be forwarded to the public cloud 300 for processing, and then perform the following steps 404-409 to forward the service invocation request to the public cloud 300 for processing if the determination result is no.

[0075] 403: The gateway module 201 determines whether the platform service corresponding to the service invocation request is in the preset service list.

[0076] If the determination result is yes, it indicates that the platform service corresponding to the service invocation request is an external service provided by the public cloud 300, and the following steps 404-409 can be performed to forward the service invocation request to the public cloud 300 for processing.

[0077] If the determination result is no, it indicates that the platform service corresponding to the service invocation request is an internal service provided by the private cloud 200, and the following steps 409-410 can be performed to process the service invocation request on the private cloud 200.

[0078] Exemplarily, the service list can be preconfigured in the hybrid cloud environment to record the internal services provided by the private cloud or the external services provided by the public cloud, and the gateway module 201 on the private cloud 200 can use the service list to determine whether the received service invocation request needs to be forwarded to the public cloud 300 for processing. The service list can be preconfigured by the configuration module 202 on the private cloud 200 or by the configuration module 302 on the public cloud 300, but the corresponding invocation path of the service list after presetting or updating can be provided to the gateway module 201 on the private cloud 200. Then, the gateway module 201 can determine whether the received service invocation request needs to be forwarded to the public cloud 300 for processing by determining whether the platform service corresponding to the service invocation request is in the preset service list.

[0079] It can be understood that, as described above, in some embodiments, the service list can be preconfigured in one group, for example, only an external service list for recording information about the external services provided by the public cloud is preconfigured, or only an internal service list for recording information about the internal services provided by the private cloud is preconfigured. In some other embodiments, the service list can be preconfigured in two groups, for example, the internal service list and the external service list can be preconfigured at the same time, which is not limited herein.

[0080] 404: The gateway module 201 requests the routing service 210 to forward the service invocation request.

[0081] Exemplarily, for a service invocation request requiring forwarding to the public cloud 300 for processing, such as a service invocation request for an external service 310 deployed on the public cloud 300, the gateway module 201 can request the routing service 210 deployed on the private cloud 200 to perform unified forwarding. It can be understood that if the corresponding judgment result is yes when the gateway module 201 performs the above step 403, it indicates that the received service invocation request needs to be forwarded to the public cloud 300 for processing.

[0082] 405: The routing service 210 encrypts the service invocation request requiring forwarding.

[0083] Exemplarily, the routing service 210 can perform encryption processing on the service invocation request requiring forwarding to the public cloud 300 based on the key pre-configured by the configuration module 202 of the private cloud 200. Correspondingly, the configuration module 302 of the public cloud 300 can pre-set a corresponding decryption mechanism to decrypt the received encrypted service invocation request and continue processing.

[0084] 406: The routing service 210 forwards the encrypted service invocation request to the gateway module 301. The service invocation request is a service invocation request for an external service on the public cloud 300.

[0085] Exemplarily, the routing service 210 can forward the above service invocation request to the gateway module 301 on the public cloud 300 in response to the request of the gateway module 201. At this time, the platform service requested to be invoked by the service invocation request can be a call request for an external service 310 provided by the public cloud 300, so the service invocation request is a service invocation request for an external service.

[0086] 407: The gateway module 301 authenticates the forwarded service invocation request.

[0087] Exemplarily, the gateway module 301 can authenticate the service invocation request forwarded by the routing service 210 on the private cloud 200 according to the pre-set authentication logic. The authentication process, for example, can be to verify whether the requestor of the corresponding service invocation request has the permission to call the requested service, and the specific verification method, for example, can be to verify according to the tenant permission of the requestor on the public cloud 300, etc., which is not limited herein.

[0088] It can be understood that the authentication logic adopted by the gateway module 201 on the private cloud 200 in the above step 402 can be different from the authentication logic adopted by the gateway module 301 on the public cloud 300 in this step 407. In this way, re-authenticating the already authenticated service invocation request on the public cloud 300 can better guarantee the security and execution efficiency of the external service provided by the public cloud 300.

[0089] 408: The gateway module 301 sends the service invocation request of which the authentication is passed to the corresponding external service.

[0090] Exemplarily, the gateway module 301 can forward the service invocation request of which the authentication is passed to the corresponding requested external service 310 on the public cloud 300.

[0091] 409: The external service 310 triggers the running and provides the corresponding service function to execute the corresponding data processing in response to the service invocation request.

[0092] It can be understood that the data processing result executed by the external service 310 can also be forwarded to the user terminal 100 through the private cloud 200, and then fed back to the user.

[0093] 410: The gateway module 201 sends the service invocation request to the corresponding internal service.

[0094] Exemplarily, the gateway module 201 can forward the service invocation request of which the authentication is passed to the corresponding requested internal service 210 on the private cloud 200.

[0095] 411: The internal service 210 triggers the running and provides the corresponding service function to execute the corresponding data processing in response to the service invocation request.

[0096] Based on the execution flow of the steps 401 to 411 shown above Figure 4 The service invocation method in the hybrid cloud environment provided by the embodiment of the present application uses the gateway on the private cloud to access the service invocation request, and then forwards the service invocation request which needs to invoke the external service provided by the public cloud after the encryption via the routing service deployed on the private cloud. In this way, the platform services deployed on the private cloud and the public cloud can be quickly and accurately invoked, and the high security of the private cloud can be used to provide security guarantee for the external service invocation process of the public cloud environment.

[0097] Figure 5 According to the embodiment of the present application, a structure schematic diagram of an electronic device 500 is shown. In the embodiment of the present application, the electronic device 500 can be a server cluster or a supercomputer running the cloud platform providing the hybrid cloud environment described above, etc. In some other embodiments, the electronic device 500 can also run the service end of some business system, for example, the service end of an insurance business system, etc., which is not limited herein.

[0098] As Figure 5As shown, in some embodiments, electronic device 500 can include one or more processors 504, system control logic 508 connected to at least one of processors 504, system memory 512 connected to system control logic 508, non-volatile memory (NVM) 516 connected to system control logic 508, and network interface 520 connected to system control logic 508.

[0099] In some embodiments, processor 504 can include one or more single core or multicore processors. In some embodiments, processor 504 can include any combination of general-purpose processors and special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In embodiments where electronic device 500 employs an eNB (evolved node b) or RAN (radio access network) controller, processor 504 can be configured to perform various conforming embodiments, for example, as described in Figures 1 to 4 the illustrated embodiments.

[0100] In some embodiments, system control logic 508 can include any suitable interface controllers to provide for any suitable interface to at least one of processors 504 and / or any suitable device or component in communication with system control logic 508.

[0101] In some embodiments, system control logic 508 can include one or more memory controllers to provide an interface to system memory 512. System memory 512 can be used to load and store data and / or instructions. In some embodiments, memory 512 of electronic device 500 can include any suitable volatile memory, such as suitable dynamic random access memory (DRAM).

[0102] NVM / memory 516 can include one or more tangible, non-transitory computer-readable media used to store data and / or instructions. In some embodiments, NVM / memory 516 can include any suitable non-volatile memory, such as flash memory, and / or any suitable non-volatile storage device, such as at least one of a hard disk drive (HDD), a compact disc (CD) drive, a digital versatile disc (DVD) drive.

[0103] The NVM / storage 516 can include a portion of the storage resources installed on the device of the electronic device 500, or it can be accessed by the device but not necessarily part of the device. For example, the NVM / storage 516 can be accessed over a network via the network interface 520.

[0104] In particular, the system memory 512 and the NVM / storage 516 can include, respectively, a temporary copy and a permanent copy of the instructions 524. The instructions 524 can include instructions that, when executed by at least one of the processors 504, cause the electronic device 500 to implement the methods illustrated in FIGS. 1-4. Figure 4 In some embodiments, the instructions 524, hardware, firmware, and / or software components thereof can additionally / alternatively be placed in the system control logic 508, the network interface 520, and / or the processors 504.

[0105] The network interface 520 can include a transceiver to provide a radio interface for the electronic device 500 to communicate with any other suitable device (e.g., a front end module, an antenna, etc.) over one or more networks. In some embodiments, the network interface 520 can be integrated with other components of the electronic device 500. For example, the network interface 520 can be integrated with at least one of the processors 504, the system memory 512, the NVM / storage 516, and firmware devices (not shown) having instructions that, when executed by at least one of the processors 504, cause the electronic device 500 to implement the methods illustrated in FIGS. 1-4. Figure 4

[0106] The network interface 520 can further include any suitable hardware and / or firmware to provide a multiple-input multiple-output radio interface. For example, the network interface 520 can be a network adapter, a wireless network adapter, a telephone modem, and / or a wireless modem.

[0107] In some embodiments, at least one of the processors 504 can be packaged with logic for one or more controllers of the system control logic 508 to form a system-in-package (SiP). In some embodiments, at least one of the processors 504 can be integrated on the same die with logic for one or more controllers of the system control logic 508 to form a system on chip (SoC).

[0108] The electronic device 500 can further include an input / output (I / O) device 532. The I / O device 532 can include a user interface to enable a user to interact with the electronic device 500; a peripheral component interface to enable a peripheral component to interact with the electronic device 500.

[0109] ​In some embodiments, the peripheral component interface can include, but is not limited to, a non-volatile memory port, an audio jack, and a power interface.

[0110] The disclosure of the present embodiments also relates to an apparatus for performing operations in text. This apparatus can be specially constructed for the required purposes, or it can comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program can be stored in a computer readable medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, application specific integrated circuits (ASICs), or any type of media suitable for storing electronic instructions, and each can be coupled to a computer system bus. Furthermore, the computers described in the specification can include a single processor or can be architectures involving multiple processors related by a computer network.

[0111] Further, the language used in the specification has been principally selected for readability and instructional purposes and can not have been selected to delineate or circumscribe the disclosed subject matter. Accordingly, the present embodiments are intended to be illustrative, not limiting, of the scope of the concepts discussed herein.

Claims

1. A service invocation method, characterized in that, A cloud platform for providing a hybrid cloud environment, the cloud platform including at least one private cloud platform and at least one public cloud platform, the cloud platform having a preset target service list and a second service list, the target service list being used to record relevant information of one or more platform services provided by the first public cloud platform, and the second service list being used to record relevant information of one or more platform services provided by the first private cloud platform; The relevant information of the platform service includes at least one of the following: identification information of the first platform service or the second platform service, public cloud environment information to which the first platform service belongs or private cloud environment information to which the second platform service belongs, and path information of the first platform service or the second platform service. And the method includes: The first private cloud platform in the at least one private cloud platform receives a first call request, wherein the first call request is a call request for a platform service running in the hybrid cloud environment; The first private cloud platform compares the relevant information of the target service with the relevant information of each platform service in the target service list, and determines that the relevant information of the target service matches the relevant information of the first platform service in the target service list. The first private cloud platform then compares the relevant information of the target service with the relevant information of each platform service in the second service list, and determines that there is no matching information record for the relevant information of the target service in the second service list. The first private cloud platform encrypts the first call request and forwards the encrypted first call request to the first public cloud platform. The first private cloud platform determines that the target service of the first call request is the first platform service provided by the first public cloud platform. If the first call request is determined to be inconsistent with the preset forwarding conditions, the first private cloud platform will send the first call request to the second platform service, wherein the second platform service is a service provided by the first private cloud platform.

2. The method according to claim 1, characterized in that, The step of determining that the first call request does not meet the preset forwarding conditions includes: The first private cloud platform determines that the relevant information of the target service matches the relevant information of the second platform service in the second service list, and determines that the first call request does not meet the preset forwarding conditions.

3. The method according to claim 1, characterized in that, The target service list or the second service list is preset on the first private cloud platform; or... The target service list or the second service list is preset in the data storage space provided by the first public cloud platform to the first private cloud platform.

4. The method according to claim 1, characterized in that, The first private cloud platform includes a first key preset for a first call request that meets the preset forwarding conditions, and... The encryption of the first call request includes: The first private cloud platform uses the first key to encrypt the first call request.

5. The method according to claim 1, characterized in that, Sending the first invocation request to the second platform service includes: The first private cloud platform confirms that the requester of the first call request has the authority to call the service of the second platform, and sends the first call request to the service of the second platform.

6. The method according to any one of claims 1, characterized in that, The first private cloud platform includes a first gateway module and a pre-deployed routing service, and the method includes: The first gateway module receives a first invocation request for the target service; If the first call request is determined to meet the preset forwarding conditions for being forwarded to a platform service deployed on the at least one public cloud platform for processing, the first gateway module sends a forwarding request to the routing service. In response to the forwarding request, the routing service encrypts the first call request and forwards the encrypted first call request to the first public cloud platform; If the first call request is determined not to meet the preset forwarding conditions, the first gateway module will send the first call request to the second platform service.

7. The method according to claim 6, characterized in that, The first public cloud platform includes a second gateway module, and the step of forwarding the encrypted first call request to the first public cloud platform includes: The routing service sends the encrypted first call request to the second gateway module, and the second gateway module, after determining that the requester of the first call request has the calling permission, sends the first call request to the first platform service.

8. An electronic device, characterized in that, include: One or more processors; One or more memories; the one or more memories store one or more programs that, when executed by the one or more processors, cause the electronic device to run a cloud platform providing a hybrid cloud environment and perform the service invocation method of any one of claims 1 to 7.

9. A business system, characterized in that, The system includes a server and a client, wherein the server runs on a cloud platform providing a hybrid cloud environment, the cloud platform including at least one private cloud platform and at least one public cloud platform, and the server responds to a service invocation request from the client by executing the service invocation method of any one of claims 1 to 7.

Images