User resource management method, system, device and storage medium

Abstract

This application provides a user resource management method, system, device, and storage medium. In this embodiment, when a bastion host manages user resources across VPC environments, it can request a network channel between the bastion host and an unbound VPC from a management service node deployed in a private network. The management service node can respond to the bastion host's request and establish a network channel between the bastion host and the unbound VPC using private network interface technology. In this way, the bastion host can manage user resources in other VPCs across VPC environments based on this network channel, realizing cross-VPC user resource management by the bastion host. Furthermore, since both the bastion host and the management service node are located in a private network, the devices involved in the aforementioned cross-VPC user resource management by the bastion host do not need to be exposed to the public network, reducing the public network exposure of the process and helping to improve the security of user resources in the VPC environment.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a user resource management method, system, device and storage medium. Background Technology

[0002] Bastion hosts, in a specific network environment, use various technical means to monitor and record the operations of maintenance personnel on servers, network devices, security devices, databases, and other devices within the network to protect the network and data from intrusion and damage from external and internal users. This enables centralized alarms, timely handling, and auditing to determine responsibility.

[0003] In a cloud computing environment, a bastion host manages user resources and can generally only operate and maintain user resources in a single Virtual Private Cloud (VPC) environment. Once a bastion host is bound to a certain VPC, user resources in other VPC environments cannot be imported into the bastion host, and the bastion host cannot manage user resources in other VPC environments. Summary of the Invention

[0004] This application provides a user resource management method, system, device, and storage medium to enable bastion hosts to manage user resources across VPCs.

[0005] In a first aspect, embodiments of this application provide a user resource management method applicable to management service nodes; the management service node and the bastion host are located in a dedicated network; the method includes:

[0006] The network channel request sent by the bastion host is obtained; the bastion host is bound to a first virtual private cloud (VPC); the network channel request is used to request a network channel between the bastion host and a second VPC; the second VPC is not bound to the bastion host.

[0007] In response to the network channel request, a network channel is established between the bastion host and the second VPC using private network interface technology, so that the bastion host can manage user resources in the second VPC environment based on the network channel.

[0008] Secondly, embodiments of this application also provide a user resource management method, applicable to a bastion host, wherein the bastion host is set up in a private network and bound to a first virtual private cloud (VPC); the method includes:

[0009] The request is made to the management service node located on the private network to provide a network channel between the bastion host and the second VPC, so that the management service node can establish a network channel between the bastion host and the second VPC using private network interface technology; the second VPC is not bound to the bastion host;

[0010] User resources in the second VPC environment are managed based on the network channel between the bastion host and the second VPC.

[0011] Thirdly, this application also provides a resource management system, comprising a bastion host and a management service node deployed on a dedicated network; the system further includes: a first virtual private cloud (VPC) bound to the bastion host and a second VPC not bound to the bastion host; user resources are configured in the first VPC and the second VPC environments; the bastion host is used to manage the user resources in the first VPC environment;

[0012] The control service node is used to execute the steps in the user resource management method provided in the first aspect above;

[0013] The bastion host is used to perform the steps in the user resource management method provided in the second aspect above.

[0014] Fourthly, embodiments of this application also provide an electronic device, including: a memory, a processor, and a communication component; wherein the memory is used to store a computer program;

[0015] The processor is coupled to the memory and the communication component to execute the computer program for performing the steps in the method executed by the above-mentioned management service node, and / or the steps in the method executed by the above-mentioned bastion host.

[0016] Fifthly, embodiments of this application also provide a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform steps in the method executed by the aforementioned management service node, and / or steps in the method executed by the aforementioned bastion host.

[0017] In this embodiment, when a bastion host manages user resources across VPC environments, it can request a network channel between the bastion host and an unbound VPC from a management service node deployed in a private network. The management service node can respond to the bastion host's request and establish a network channel between the bastion host and the unbound VPC using private network interface technology. In this way, the bastion host can manage user resources in other VPCs across VPC environments based on this network channel, thus realizing cross-VPC user resource management by the bastion host. On the other hand, since both the bastion host and the management service node are located in a private network, the devices involved in the aforementioned cross-VPC user resource management by the bastion host do not need to be exposed to the public network, reducing the exposure surface during the process and helping to improve the security of user resources in the VPC environment. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 An example diagram of a management system for managing user resources across VPC environments using a traditional bastion host solution;

[0020] Figure 2 This is a schematic diagram of the structure of the resource management system provided in an embodiment of this application;

[0021] Figure 3 This application provides a schematic diagram illustrating the process of a bastion host managing user resources across a VPC environment.

[0022] Figure 4 This is a schematic diagram of the single-channel connection creation process provided in an embodiment of this application;

[0023] Figure 5 This is a schematic diagram illustrating the arbitrary channel connection creation process provided in the embodiments of this application;

[0024] Figure 6 and Figure 7 A flowchart illustrating the user resource management method provided in this application embodiment;

[0025] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] User resources refer to the tangible or intangible assets owned by a user, located in a Virtual Private Cloud (VPC) environment. User assets in a VPC environment include, but are not limited to, one or more of the following: user servers, network devices, security devices, databases, and Elastic Compute Service (ECS) instances. "Multiple" refers to two or more types. Databases include, but are not limited to, relational database services (RDS) and object storage services (OSS) databases.

[0028] In a cloud computing environment, a bastion host manages user resources and can generally only operate and maintain user resources in a single Virtual Private Cloud (VPC) environment. Once a bastion host is bound to a certain VPC, user resources in other VPC environments cannot be imported into the bastion host, and the bastion host cannot manage user resources in other VPC environments.

[0029] In practical applications, there is a need for bastion hosts to manage user resources across VPC environments. In traditional solutions, the bastion host manages user resources across VPC environments. For example... Figure 1 As shown, before managing and maintaining user resources across VPCs, in the managed VPC environment (such as...) Figure 1 Configure a network proxy server in both VPC-A and VPC-B. This network proxy server communicates with user resources within the VPC environment via the VPC's internal network. That is... Figure 1 As shown, the network proxy server can access user resources within a VPC environment through the VPC's private Internet Protocol (IP) address. The network proxy server and the bastion host communicate via the public internet. Generally, this communication is achieved through a public server load balancing (SLB) service. In this way, the bastion host and user resources in multiple VPC environments can communicate through the network proxy server. Subsequently, the administrator corresponding to the bastion host can log in to the bastion host and manage user resources across multiple VPC environments through the network links between the bastion host and these VPCs, enabling cross-VPC user resource management by the bastion host.

[0030] In the above scheme, the bastion host needs to apply for a public network SLB when managing user resources across VPCs, which increases the risk exposure and poses certain security risks.

[0031] To address the aforementioned technical problems, some embodiments of this application provide a novel solution for bastion hosts to manage user resources across VPCs. Specifically, when a bastion host manages user resources across a VPC environment, it can request a network channel between the bastion host and an unbound VPC from a management service node deployed in a private network. The management service node can respond to the bastion host's request and establish a network channel between the bastion host and the unbound VPC using private network interface technology. In this way, the bastion host can manage user resources in other VPCs across VPC environments based on this network channel, thus realizing cross-VPC user resource management by the bastion host.

[0032] On the other hand, since both the bastion host and the management service node are located in a private network, the devices involved in the bastion host's management of user resources across VPC environments do not need to be exposed to the public network. This reduces the exposure surface of the bastion host in the process of managing user resources across VPC environments and helps to improve the security of user resources in the VPC environment.

[0033] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0034] It should be noted that the same reference numerals denote the same object in the following figures and embodiments. Therefore, once an object is defined in one figure or embodiment, it does not need to be discussed further in subsequent figures and embodiments.

[0035] Figure 2 This is a schematic diagram of the structure of a resource management system provided in an embodiment of this application. Figure 2 As shown, the resource management system includes a bastion host 10 and a management service node 20 that provides management services to the bastion host 10. To improve resource security, the bastion host 10 and the management service node 20 can be deployed in a private network. This private network can be a VPC or a Virtual Private Network (VPN), etc. The bastion host 10 and the management service node 20 can be deployed in the same private network or in different private networks. Generally, the bastion host 10 and the management service node 20 are deployed in different private networks.

[0036] There can be one or more bastion hosts. "Multiple" means two or more. Figure 2 The illustration only shows two bastion hosts (10 units), but this is not intended to be limiting. Figure 2In this setup, two bastion hosts are configured in different VPC environments (such as VPC-C and VPC-D). Bastion host 10 can be a single server device, a cloud-based server array, a virtual machine (VM) running within a cloud-based server array, or a cloud server (such as ECS). Alternatively, bastion host 10 can also refer to other computing devices with corresponding service capabilities, such as computers or other terminal devices (running service programs).

[0037] The management service node 20 refers to the server-side device that provides management services to the bastion host 10, and generally has the capability to undertake and guarantee services. The management service node 20 can be a single server device, a cloud-based server array, a virtual machine (VM) running within a cloud-based server array, or a cloud server (such as ECS). Alternatively, the management service node 20 can also refer to other computing devices with corresponding service capabilities, such as computers or other terminal devices (running service programs).

[0038] The management services provided by the management service node 20 to the bastion host 10 include, but are not limited to, network management services. These network management services include, but are not limited to, one or more of the following: private network interface services, reverse access services, and virtual network services. "Multiple" refers to two or more of these. The private network interface services include, but are not limited to, one or more of the following: Single Tunnel services, Any Tunnel services, and Elastic Network Interface (ENI) services. Figure 2 The illustrations only depict single-channel connection service and arbitrary channel connection service, but this does not constitute a limitation.

[0039] Single Tunnel is an Application Load Balancer (ALB) service that connects VPCs and the classic network. The classic network, also known as the infrastructure network, refers to a shared public network resource pool where all users on the public cloud operate without logical isolation. Users' internal IP addresses are assigned by the system, and the same internal IP address cannot be assigned to different users.

[0040] A single tunnel access cloud service instance serves only one VPC. Users within other VPCs or in the classic network cannot access this cloud service instance. The cloud service instance in a single-channel connection applies for a single-channel virtual IP (VIP) address on the ALB and mounts the backend server to this VIP to provide access to the VPC. This VIP carries the user's VPC attribute and occupies the user's VPC IP address.

[0041] Any Tunnel is also an ALB service that enables network connectivity between VPCs and between a VPC and the classic network. Any Tunnel can connect to all VPCs within the same region, making it suitable for shared cloud services. Cloud service instances in Any Tunnel provide access to VPCs by applying for an Any Tunnel VIP on ALB and attaching their backend servers to that VIP. This VIP does not carry user VPC attributes and does not occupy the user VPC's IP address.

[0042] An Elastic Network Interface (ENI) is a virtual network interface card that provides elastic networking capabilities to elastic cloud servers. It is a virtual network interface in a private network used to connect cloud servers to the private network.

[0043] Reverse access is the opposite of forward access. Forward access involves a user accessing a cloud server (such as an ECS) within a VPC, and then the user's resources calling the cloud service. Reverse access, on the other hand, refers to the cloud service actively accessing the cloud server (such as an ECS) within the VPC. Specifically, bidirectional Network Address Translation (NAT) can be performed through the VPC's virtual gateway to enable the cloud service to actively access the cloud server within the VPC. In this embodiment, the cloud server within the VPC refers to a bastion host, and the cloud service refers to the management service provided by the management service node 20.

[0044] Generally, bastion host 10 is bound to a VPC, and bastion host 10 can manage user resources in the VPC environment it is bound to. Figure 2 In the VPC-C environment, bastion host 10 is bound to the first VPC; in the VPC-D environment, bastion host 10 is bound to the second VPC. The second VPC is not bound to bastion host 10 in the VPC-C environment. The following explanation uses bastion host 10 in the VPC-C environment as an example.

[0045] Bastion Host 10 and the first VPC can communicate via the VPC virtual network adapter. The virtual network adapter supports bidirectional access. Bidirectional access means that Bastion Host 10 can access user resources in the first VPC environment; user resources in the first VPC environment can also access Bastion Host 10.

[0046] Users can log in to bastion host 10 via the public network SLB, and bastion host 10 manages user resources in the first VPC environment bound to bastion host 10. Specifically, the SLB node in the public network receives the login request and obtains the destination virtual IP address of bastion host 10 from the login request; it further assigns a physical IP address of bastion host 10 to the destination virtual IP address; and sends the login request to the bastion host 10 corresponding to the physical IP address. Bastion host 10 can respond to the login request and perform permission verification. If the verification is successful, login to bastion host 10 is allowed, enabling users to log in to bastion host 10 via the public network SLB.

[0047] Of course, in some embodiments, there is no public network SLB. Users can log in to bastion host 10 through user resources in the first VPC environment and the aforementioned VPC virtual network interface card. Specifically, users can send login requests to bastion host 10 through the virtual network interface card on the user resources of the first VPC. Bastion host 10 can perform permission verification on the login request, and allow login to bastion host 10 after successful verification, thus enabling users to log in to bastion host 10 through the virtual network interface card.

[0048] In practical applications, there is a need for bastion hosts to manage user resources across VPC environments. This refers to a bastion host managing user resources in VPC environments that are not bound to it. For example, after logging into bastion host 10, a user can initiate a user resource management request to bastion host 10. This request may include the identifier of the VPC to be managed. Accordingly, bastion host 10 can receive the user resource management request and, if the identifier of the VPC to be managed includes the identifier of a VPC not bound to bastion host 10, determine that cross-VPC environment user resource management is required. In this embodiment, for ease of description and distinction, VPCs not bound to bastion host 10 in the VPC-C environment are uniformly defined as second VPCs. There can be one or more second VPCs, where "multiple" refers to two or more. Figure 2 and Figure 3 The illustration uses only one second VPC as an example, but this is not intended to limit the scope. The following explanation uses a bastion host 10 in a VPC-C environment managing user resources in a second VPC environment as an example. In the following system embodiments, the bastion host 10 is always... Figure 2 and Figure 3 This explanation will use a bastion host located in a VPC-C environment as an example.

[0049] In this case, the bastion host 10 in the VPC-C environment manages user resources in the same way in each second VPC environment. The following example uses any second VPC to illustrate the process of the bastion host 10 managing user resources across VPC environments.

[0050] like Figure 2 and Figure 3 As shown, when managing user resources in the second VPC environment, the bastion host 10 can request the management service node 20 to provide a network channel between the bastion host 10 and the second VPC (corresponding to...). Figure 2 and Figure 3 Step 1).

[0051] Specifically, bastion host 10 can access management service node 20 via single-channel or arbitrary-channel connection technology to request management service node 20 to provide a network channel between bastion host 10 and the second VPC. Generally, since management service node 20 provides management services to multiple bastion hosts 10, the network channel between bastion host 10 and management service node 20 can be an arbitrary-channel connection. The single-channel or arbitrary-channel connection between bastion host 10 and management service node 20 is created during the deployment of the resource management system.

[0052] Based on a single-channel or arbitrary-channel connection between the bastion host 10 and the management service node 20, the bastion host 10 can send a network channel request to the management service node 20 through this connection. This network channel request includes the identifier of the VPC to be managed. In this embodiment, the identifier of the VPC to be managed is the identifier of the second VPC. Combined with... Figure 2 and Figure 3 Bastion host 10 requests a network channel between itself and the second VPC by sending a network channel request to management service node 20. Figure 2 Step 1 and Figure 3 Step 1).

[0053] Accordingly, the management service node 20 can respond to the bastion host's request and establish a network channel between the bastion host 10 and the second VPC using private network interface technology (corresponding to...). Figure 2 and Figure 3 Step 2).

[0054] In some embodiments, the private network interface technology is the Elastic Network Interface (ENI) technology. Accordingly, the management service node 20 can respond to a network channel request sent by the bastion host and use ENI technology to establish a network channel between the bastion host 10 and the second VPC.

[0055] Specifically, the management service node 20 can apply for an elastic network interface card (NIC) in the second VPC and attach the NIC to the private network (such as the VPC) where the bastion host 10 resides. Then, the management service node 20 can configure the routing information of the NIC in the private network (VPC) where the bastion host 10 resides to obtain a network channel between the bastion host 10 and the second VPC. In this way, the bastion host 10 can access the second VPC through the routing information of the NIC.

[0056] In other embodiments, the private network interface technology is either a single-tunnel connection technology or an arbitrary-tunnel connection technology. Accordingly, the management service node 20 can, in response to a request from the bastion host, establish a network tunnel between the bastion host 10 and the second VPC using either single-tunnel or arbitrary-tunnel connection technology. Figure 2 and Figure 3 Step 2).

[0057] Based on the working principle of the Single Tunnel or Any Tunnel technology, the management service node 20 can obtain the target IP address of the target ALB in the Single Tunnel or Any Tunnel connection.

[0058] Specifically, for single-channel connection technology, the management service node 20 can call the VPC's Application Programming Interface (API) to obtain the IP address assigned to the VPC where the bastion host 10 resides. The VPC's API can be an Open API, implemented as a cloud service, such as Software as a Service (SaaS).

[0059] Furthermore, a first available IP address can be selected from the IP addresses allocated to the VPC where the bastion host 10 resides. Then, a virtual instance can be created in the VPC based on this first IP address. The IP address of this virtual instance is the first IP address. In a single-channel connection embodiment, the first IP address of the virtual address can be used as the target IP address of the target ALB in the single-channel connection. Figure 4 In this configuration, the IP address range of the VPC where bastion host 10 resides is xxx0 / 24; the IP address of the bastion host is xxx1; and the IP address of the virtual instance is xxx2. Correspondingly, the IP address of the target ALB in a single-channel connection is xxx2. Figure 4 In this context, ALB is the target ALB.

[0060] For arbitrary channel connection technology, a fixed network segment can be set for the arbitrary channel connection. Here, a network segment refers to the portion of a computer network where devices using the same physical layer can communicate directly. The network segment may include IP addresses and subnet masks. Accordingly, when obtaining the target IP address of the target ALB in an arbitrary channel connection, the management service node 20 can select a free second IP address from the pre-set IP addresses contained in the network segment allocated to the arbitrary channel connection as the target IP address.

[0061] In other embodiments, the arbitrary channel connection technology can also create virtual instances within the VPC where the bastion host resides. Accordingly, the management service node 20 can select a free second IP address from the IP addresses included in the pre-configured network segment allocated by the arbitrary channel connection; and create a virtual instance within the VPC where the bastion host resides based on the second IP address; the IP address of this virtual instance is the second IP address. Furthermore, the second IP address of the virtual instance can be used as the target IP address of the target ALB.

[0062] exist Figure 5 In the VPC-C environment, the IP address range of the bastion host 10 within the VPC-C is xxx0 / 24; the IP address of the bastion host is xxx1; the network segment can include the IP address range zzz0 / 24; and the IP address of the virtual instance is zzz1. Correspondingly, the IP address of the target ALB in any tunnel connection is zzz1. Figure 5 In this context, ALB refers to the target ALB, and in the IP address zzz1:80 of the target ALB, 80 represents the port number. Figure 5 In this context, the IP address range of VPC-D is www0 / 24; the IP address of the bastion host under this VPC-D is www1. Figure 5 In this context, both VPC-C and VPC-D can be connected to ALB.

[0063] In addition to determining the target IP address of the target ALB in a single-channel or arbitrary-channel connection, the management service node 20 can also call the VPC API to obtain the IP address of the second VPC. Specifically, the management service node 20 can call the VPC API to obtain the IP address of the user resources in the second VPC environment based on the identifier of the second VPC; from the IP address of the user resources in the second VPC environment, select the IP address of the target user resource as the IP address of the second VPC.

[0064] Optionally, the management service node 20 can select any user resource from the user resources in the second VPC environment as the target user resource, and use the IP address of the target user resource as the IP address of the second VPC. Alternatively, the management service node 20 can select a user resource of a specified type from the user resources in the second VPC environment as the target user resource, and use the IP address of the target user resource as the IP address of the second VPC, and so on.

[0065] Furthermore, the management service node 20 can call the SLB service API to create a single-channel connection or arbitrary-channel connection between the bastion host 10 and the second VPC based on the IP address of the target ALB and the IP address of the second VPC (corresponding to...). Figure 3 Step 2, "Call the API to create a single-channel or arbitrary-channel connection between the bastion host and the second VPC," serves as the network channel between the bastion host 10 and the second VPC, thus establishing a network channel between them. In this way, the bastion host 10 can manage user resources within the second VPC environment based on this network channel. Figure 2 Step 3 and Figure 3 Step 4).

[0066] In this embodiment, when the bastion host manages user resources across VPC environments, it can request a network channel between the bastion host and an unbound VPC from the management service node deployed in the private network. The management service node can respond to the bastion host's request and establish a network channel between the bastion host and the unbound VPC using single-channel connection technology or arbitrary-channel connection technology. In this way, the bastion host can manage user resources in other VPCs across VPC environments based on this network channel, realizing cross-VPC environment management of user resources by the bastion host.

[0067] On the other hand, since both the bastion host and the management service node are located in a private network, the devices involved in the bastion host's management of user resources across VPC environments do not need to be exposed to the public network. This reduces the public network exposure of the bastion host's management of user resources across VPC environments and helps improve the security of user resources in the VPC environment.

[0068] Furthermore, any bastion host in the resource management system can be used to manage user resources in any VPC environment, fully utilizing the bastion host's operational capabilities and saving operational resources to some extent. Especially compared to Figure 1 The traditional solution shown requires configuring a network proxy server for each VPC. The embodiments of this application do not require additional configuration of a network proxy server, which can save operation and maintenance resources and reduce operation and maintenance costs.

[0069] In the embodiment of creating a single-channel connection between bastion host 10 and the second VPC, the management service node 20 can call the target IP address of the target ALB in the single-channel connection to create a target ALB; the IP address of the target ALB is the target IP address; further, the tunnel identifier that the target ALB supports access can be set to the tunnel identifier of the VPC where the bastion host 10 is located, and the user resources (such as ECS) corresponding to the IP address of the second VPC can be mounted to the target ALB, and the tunnel type of the target ALB can be set to a single-channel connection, thereby realizing the creation of a single-channel connection between bastion host 10 and the second VPC, that is, establishing a network channel between bastion host 10 and the second VPC.

[0070] In the embodiment of creating an arbitrary channel connection between bastion host 10 and the second VPC, the management service node 20 can call the target IP address of the target ALB in the arbitrary channel connection to create a target ALB; the IP address of the target ALB is the target IP address; further, the user resources (such as ECS) corresponding to the IP address of the second VPC can be mounted to the target ALB, and the tunnel type of the target ALB can be set to arbitrary channel connection, thereby realizing the creation of an arbitrary channel connection between bastion host 10 and the second VPC, that is, establishing a network channel between bastion host 10 and the second VPC.

[0071] After establishing a network channel between the bastion host 10 and the second VPC, the management service node 20 can return a channel creation success message to the bastion host 10 via reverse access (corresponding to...). Figure 3 Step 3). This successful channel creation message indicates that the network channel between bastion host 10 and the second VPC has been successfully created.

[0072] Optionally, the management service node 20 can send a successful channel creation message to the bastion host 10 via the VPC virtual gateway, enabling reverse access to the bastion host 10. Specifically, the VPC virtual gateway stores the NAT address mapping relationship of the VPC where the bastion host 10 resides; the management service node 20 can send a successful channel creation message to the VPC virtual gateway. The VPC virtual gateway can use the public IP address of the bastion host 10 to query the NAT address mapping relationship and determine the bastion host's private IP address. Furthermore, the VPC virtual gateway can send a successful channel creation message to the bastion host's private IP address, thereby enabling the management service node 20 to access the bastion host 10 in reverse.

[0073] Correspondingly, bastion host 10 can respond to the successful channel creation message and manage user resources in the second VPC environment based on the network channel between bastion host 10 and the second VPC (corresponding to...). Figure 3 Step 4).

[0074] In some embodiments, the bastion host 10 can also display a successful channel creation message on the operation and maintenance interface for the administrators of the bastion host to view. The administrators of the bastion host can promptly learn that the network channel between the bastion host 10 and the second VPC has been successfully created through the successful channel creation message displayed on the operation and maintenance interface. In this way, administrators can access user resources in the second VPC environment through the bastion host 10 and manage and / or maintain these user resources, enabling the bastion host to manage user resources across VPC environments.

[0075] In this embodiment, after the network channel between the bastion host 10 and the second VPC is successfully established, the management service node 20 can also store the correspondence between the identifier of the second VPC and the target IP address of the target ALB. Optionally, the management service node 20 can store the correspondence between the identifier of the second VPC and the target IP address of the target ALB in the correspondence between the identifier of the VPC and the IP address of the ALB. In the correspondence between the identifier of the VPC and the IP address of the ALB, the ALB is the ALB in the single-channel connection or any-channel connection corresponding to the VPC, and the ALB carries user resources in the VPC environment.

[0076] Based on the aforementioned mapping between the VPC identifier and the ALB IP address, the bastion host 10 requests the management service node 20 to provide a network channel between itself and the second VPC. This can be achieved by the bastion host 10 requesting the IP address of the ALB in the single-channel connection or arbitrary-channel connection corresponding to the second VPC from the management service node 20, thereby requesting a network channel between the bastion host and the second VPC. The ALB in the single-channel connection or arbitrary-channel connection corresponding to the second VPC carries user resources within the second VPC environment.

[0077] Specifically, the bastion host 10 can send a network channel request to the management service node 20; the network channel request may include: the identifier of the second VPC, in order to request the IP address of the ALB in the single channel connection or any channel connection corresponding to the second VPC from the management service node 20.

[0078] Accordingly, the management service node 20 can respond to the bastion host's request by using the identifier of the second VPC to query the mapping relationship between the maintained VPC identifier and the ALB IP address. If the IP address of the ALB corresponding to the identifier of the second VPC is found in the mapping relationship between the VPC identifier and the ALB IP address, it indicates that the network channel between the bastion host 10 and the second VPC has been successfully established. Then, the management service node 20 can send the IP address of the ALB corresponding to the identifier of the second VPC to the bastion host 10 via reverse access. For a detailed implementation of how the management service node 20 sends the IP address of the ALB corresponding to the identifier of the second VPC to the bastion host 10 via reverse access, please refer to the above-mentioned content regarding the management service node 20 sending a channel creation success message to the bastion host 10 via reverse access, which will not be repeated here.

[0079] Accordingly, the bastion host 10 can manage user resources within the second VPC environment based on the IP address of the ALB corresponding to the identifier of the second VPC. Specifically, the bastion host 10 can send management commands for user resources within the second VPC environment to the ALB corresponding to the identifier of the second VPC based on the IP address of the ALB. The ALB can then send the management commands for user resources within the second VPC environment to the user resources within the second VPC environment. User resources can respond to these management commands by performing corresponding management operations, thereby enabling the bastion host to manage user resources across VPC environments.

[0080] Of course, if the IP address of the ALB corresponding to the identifier of the second VPC is not found in the mapping between the VPC identifier and the IP address of the ALB, it means that the network channel between the bastion host 10 and the second VPC has not yet been established. In this case, the management service node 20 can perform the above-described operation of establishing a network channel between the bastion host 10 and the second VPC using single-channel connection technology or arbitrary-channel connection technology. For the specific implementation method of the management service node 20 establishing a network channel between the bastion host 10 and the second VPC using single-channel connection technology or arbitrary-channel connection technology, and the specific implementation method of the bastion host 10 managing user resources in the second VPC environment across VPCs based on the network channels between the other second VPCs, please refer to the above embodiments, which will not be repeated here.

[0081] In addition to the system embodiments described above, this application also provides a user resource management method, which will be described below as an example.

[0082] Figure 6 This is a flowchart illustrating a user resource management method provided in an embodiment of this application. The method is applicable to bastion hosts. The bastion host and management service node are located in a private network, and the bastion host is bound to a first VPC. Figure 6 As shown, this user resource management method mainly includes:

[0083] 601. Request the management service node to provide a network channel between the bastion host and the second VPC, so that the management service node can establish a network channel between the bastion host and the second VPC using private network interface technology; the second VPC is not bound to the bastion host.

[0084] 602. Manage user resources in the second VPC environment based on the network channel between the bastion host and the second VPC.

[0085] Figure 7 This is a flowchart illustrating a user resource management method provided in an embodiment of this application. The method is applicable to management service nodes. A bastion host and a management service node are located in a private network, and the bastion host is bound to a first VPC. For example... Figure 7 As shown, this user resource management method mainly includes:

[0086] 701. Obtain the network channel request sent by the bastion host; the bastion host is bound to the first VPC; the network channel request is used to request a network channel between the bastion host and the second VPC; the second VPC is not bound to the bastion host.

[0087] 702. In response to a network channel request, a network channel is established between the bastion host and the second VPC using private network interface technology, so that the bastion host can manage user resources in the second VPC environment based on the network channel.

[0088] In this embodiment, the management service node provides management services to the bastion host, including but not limited to network management services. Network management services include, but are not limited to, one or more of the following: Elastic Interface Card (ENI) service, Single Tunnel service, Any Tunnel service, reverse access service, and virtual network service. "Multiple" refers to two or more of these.

[0089] Generally, a bastion host is bound to a VPC, and the bastion host can manage user resources within that VPC. The bastion host and the first VPC it's bound to can communicate via the VPC's virtual network adapter. The virtual network adapter supports bidirectional access. Bidirectional access means that the bastion host can access user resources within the first VPC, and user resources within the first VPC can also access the bastion host.

[0090] Users can log in to the bastion host via the public network SLB, and the bastion host manages the user resources in the first VPC environment bound to the bastion host. Of course, in some embodiments, there is no public network SLB. Users can log in to the bastion host using the user resources in the first VPC environment and the aforementioned VPC virtual network interface card.

[0091] In practical applications, there is a need for bastion hosts to manage user resources across VPC environments. This cross-VPC user resource management refers to the bastion host managing user resources in VPC environments that are not bound to it. For example, after logging into the bastion host, a user can initiate a user resource management request. This request may include the identifier of the VPC to be managed. Accordingly, the bastion host can receive the user resource management request and, if the identifier of the VPC to be managed includes the identifier of a VPC not bound to the bastion host, determine that cross-VPC user resource management is required. In this embodiment, the second VPC refers to a VPC that is not bound to the bastion host of the first VPC mentioned above.

[0092] In step 601, when the bastion host has the ability to manage user resources in the second VPC environment, it may request the management service node to provide a network channel between the bastion host and the second VPC.

[0093] Specifically, the bastion host can access the management service node via single-channel or arbitrary-channel connection technology to request the management service node to provide a network channel between the bastion host 10 and the second VPC. Generally, since the management service node provides management services to multiple bastion hosts 10, the network channel between the bastion host and the management service node can be an arbitrary-channel connection. The single-channel or arbitrary-channel connection between the bastion host and the management service node is created during the deployment of the resource management system.

[0094] Based on a single-channel or arbitrary-channel connection between the bastion host and the management service node, the bastion host can send a network channel request to the management service node through this connection. This network channel request includes the identifier of the VPC to be managed. In this embodiment, the identifier of the VPC to be managed is the identifier of the second VPC. The bastion host requests a network channel between itself and the second VPC by sending this request.

[0095] Accordingly, the management service node can obtain a network channel request in step 701; and in step 702, in response to the network channel request, it can establish a network channel between the bastion host and the second VPC using private network interface technology.

[0096] Among them, the private network interface technology can be: Elastic Network Interface (ENI), Single Tunnel technology, or Any Tunnel technology.

[0097] In some embodiments, the private network interface technology is implemented as an elastic network interface card (NIC). Then, in response to a network channel request sent by the bastion host, an ENI (Engineering Interface) technology can be used to establish a network channel between the bastion host and the second VPC.

[0098] Specifically, an elastic network interface card (NIC) can be requested in the second VPC, and then attached to the private network (such as the VPC) where the bastion host resides. Afterwards, routing information for the NIC can be configured in the private network (VPC) where the bastion host resides to establish a network channel between the bastion host and the second VPC. In this way, the bastion host can access the second VPC through the routing information of the NIC.

[0099] In other embodiments, the private network interface technology is implemented as a single-tunnel connection or an any-tunnel connection. Based on the working principle of the single-tunnel connection or any-tunnel connection, the management service node can obtain the target IP address of the target ALB in the single-tunnel connection or any-tunnel connection.

[0100] Specifically, for single-channel connection technology, the IP address assigned to the VPC where the bastion host resides can be obtained by calling the VPC's Application Programming Interface (API). The VPC's API can be an Open API.

[0101] Furthermore, a first available IP address can be selected from the IP addresses allocated to the VPC where the bastion host resides. Then, a virtual instance can be created within the VPC based on this first IP address. The IP address of this virtual instance is the first IP address. In a single-channel connection embodiment, the first IP address of the virtual address can be used as the target IP address of the target ALB in the single-channel connection.

[0102] For arbitrary channel connection technology, a fixed network segment can be set for the arbitrary channel connection. The network segment may include IP addresses and subnet masks. Accordingly, obtaining the target IP address of the target ALB in the arbitrary channel connection can be achieved by selecting a second available IP address from the IP addresses contained in the pre-set network segment allocated to the arbitrary channel connection as the target IP address.

[0103] In other embodiments, the arbitrary channel connection technology can also create virtual instances within the VPC where the bastion host resides. Accordingly, obtaining the target IP address of the target ALB in the arbitrary channel connection can be achieved by: selecting a free second IP address from the IP addresses contained in the network segment pre-configured by the arbitrary channel connection; and creating a virtual instance in the VPC where the bastion host resides based on the second IP address; the IP address of this virtual instance is the second IP address. Furthermore, the second IP address of the virtual instance can be used as the target IP address of the target ALB.

[0104] In addition to determining the target IP address of the target ALB in a single-channel or arbitrary-channel connection, the VPC API can be called to obtain the IP address of the second VPC. Specifically, the VPC API can be called to obtain the IP address of the user resources in the second VPC environment based on the identifier of the second VPC; from the IP address of the user resources in the second VPC environment, the IP address of the target user resource can be selected as the IP address of the second VPC.

[0105] Optionally, one user resource can be selected from the user resources in the second VPC environment as the target user resource, and its IP address can be used as the IP address of the second VPC. Alternatively, a user resource of a specified type can be selected from the user resources in the second VPC environment as the target user resource, and its IP address can be used as the IP address of the second VPC, and so on.

[0106] Furthermore, the SLB service API can be invoked to create a single-channel connection or any channel connection between the bastion host 10 and the second VPC based on the IP address of the target ALB and the IP address of the second VPC. This serves as the network channel between the bastion host 10 and the second VPC, thus establishing a network channel between the bastion host 10 and the second VPC. Therefore, in step 602, for the bastion host, user resources within the second VPC environment can be managed based on the network channel between the bastion host and the second VPC.

[0107] In this embodiment, when the bastion host manages user resources across VPC environments, it can request a network channel between the bastion host and an unbound VPC from the management service node deployed in the private network. The management service node can respond to the bastion host's request and establish a network channel between the bastion host and the unbound VPC using private network interface technology. In this way, the bastion host can manage user resources in other VPCs across VPC environments based on this network channel, realizing cross-VPC environment user resource management by the bastion host.

[0108] On the other hand, since both the bastion host and the management service node are located in a private network, the devices involved in the bastion host's management of user resources across VPC environments do not need to be exposed to the public network. This reduces the public network exposure of the bastion host's management of user resources across VPC environments and helps improve the security of user resources in the VPC environment.

[0109] Furthermore, any bastion host in the resource management system can be used to manage user resources in any VPC environment, fully utilizing the bastion host's operational capabilities and saving operational resources to some extent. Especially compared to Figure 1 The traditional solution shown requires configuring a network proxy server for each VPC. The embodiments of this application do not require additional configuration of a network proxy server, which can save operation and maintenance resources and reduce operation and maintenance costs.

[0110] In the embodiment of creating a single-channel connection between the bastion host and the second VPC, the management service node can call the SLB API to create a target ALB based on the target IP address of the target ALB in the above single-channel connection; the IP address of the target ALB is the target IP address; further, the tunnel identifier that the target ALB supports accessing can be set to the tunnel identifier of the VPC where the bastion host is located, and the user resources (such as ECS) corresponding to the IP address of the second VPC can be mounted to the target ALB, and the tunnel type of the target ALB can be set to single-channel connection, thereby realizing the creation of a single-channel connection between the bastion host and the second VPC, that is, establishing a network channel between the bastion host and the second VPC.

[0111] In the embodiment of creating an arbitrary channel connection between the bastion host and the second VPC, the management service node can call the SLB API to create a target ALB based on the target IP address of the target ALB in the above arbitrary channel connection; the IP address of the target ALB is the target IP address; further, the user resources (such as ECS) corresponding to the IP address of the second VPC can be mounted to the target ALB, and the tunnel type of the target ALB can be set to arbitrary channel connection, thereby realizing the creation of an arbitrary channel connection between the bastion host 10 and the second VPC, that is, establishing a network channel between the bastion host 10 and the second VPC.

[0112] After establishing a network channel between the bastion host and the second VPC, the management service node can return a channel creation success message to the bastion host via reverse access. This success message indicates that the network channel between the bastion host and the second VPC has been successfully created.

[0113] Optionally, the management service node can send a successful channel creation message to the bastion host via the VPC virtual gateway, enabling reverse access to the bastion host. Specifically, the VPC virtual gateway stores the NAT address mapping relationship of the VPC where the bastion host resides; the management service node can send a successful channel creation message to the VPC virtual gateway. The VPC virtual gateway can use the bastion host's public IP address to query the NAT address mapping relationship and determine the bastion host's private IP address. Furthermore, the VPC virtual gateway can send the successful channel creation message to the bastion host's private IP address, thereby enabling the management service node to access the bastion host in reverse.

[0114] Accordingly, the bastion host can respond to the successful creation message of the channel and manage user resources in the second VPC environment based on the network channel between the bastion host and the second VPC.

[0115] In some embodiments, the bastion host can also display a successful channel creation message on the operation and maintenance interface for the administrators of the bastion host to view. The administrators can promptly learn that the network channel between the bastion host and the second VPC has been successfully created through the successful channel creation message displayed on the operation and maintenance interface. In this way, administrators can access user resources in the second VPC environment through the bastion host and manage and / or maintain these user resources, enabling the bastion host to manage user resources across VPC environments.

[0116] In this embodiment, after the network channel between the bastion host and the second VPC is successfully established, the management service node can also store the mapping relationship between the identifier of the second VPC and the target IP address of the target ALB. Optionally, the management service node can store the mapping relationship between the identifier of the second VPC and the target IP address of the target ALB in the mapping relationship between the identifier of the VPC and the IP address of the ALB. In the mapping relationship between the identifier of the VPC and the IP address of the ALB, the ALB is the ALB in the single-channel connection or any channel connection corresponding to the VPC, and the ALB carries user resources in the VPC environment.

[0117] Based on the aforementioned mapping between the VPC identifier and the ALB IP address, the bastion host requests the management service node to provide a network channel between the bastion host and the second VPC. This can be achieved by the bastion host 10 requesting the IP address of the ALB in the single-channel connection or arbitrary-channel connection corresponding to the second VPC from the management service node 20, in order to request a network channel between the bastion host and the second VPC. The ALB in the single-channel connection or arbitrary-channel connection corresponding to the second VPC carries user resources within the second VPC environment.

[0118] Specifically, the bastion host can send a network channel request to the management service node; the network channel request may include: the identifier of the second VPC, in order to request the IP address of the ALB in the single channel connection or any channel connection corresponding to the second VPC from the management service node.

[0119] Accordingly, in response to a network channel request, the management service node can use the identifier of the second VPC to query the mapping between the maintained VPC identifier and the IP address of the ALB. If the IP address of the ALB corresponding to the identifier of the second VPC is found in the mapping between VPC identifiers and ALB IP addresses, it indicates that the network channel between the bastion host and the second VPC has been successfully created. The management service node can then send the IP address of the ALB corresponding to the identifier of the second VPC to the bastion host via reverse access. For a detailed implementation of how the management service node sends the IP address of the ALB corresponding to the identifier of the second VPC to the bastion host via reverse access, please refer to the above-mentioned content regarding the management service node sending a channel creation success message to the bastion host via reverse access; it will not be repeated here.

[0120] Accordingly, the bastion host can manage user resources within the second VPC environment based on the IP address of the ALB corresponding to the identifier of the second VPC. Specifically, the bastion host can send management commands for user resources within the second VPC environment to the corresponding ALB based on the IP address of the ALB corresponding to the identifier of the second VPC; the ALB can then send the management commands for user resources within the second VPC environment to the user resources within the second VPC environment. User resources can respond to these management commands by performing corresponding management operations, thereby enabling the bastion host to manage user resources across VPC environments.

[0121] Of course, if the IP address of the ALB corresponding to the identifier of the second VPC is not found in the mapping between the VPC identifier and the IP address of the ALB, it means that the network channel between the bastion host and the second VPC has not been created. In this case, the management service node can perform the above operation to establish the network channel between the bastion host and the second VPC using single-channel connection technology or arbitrary channel connection technology.

[0122] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 601 and 602 can be device A; or the execution subject of step 601 can be device A, and the execution subject of step 602 can be device B; and so on.

[0123] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 601, 602, etc., are merely used to distinguish different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0124] Accordingly, embodiments of this application also provide a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the steps in the aforementioned user resource management methods.

[0125] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device mainly includes: a memory 80a, a processor 80b, and a communication component 80c. The memory 80a is used to store computer programs.

[0126] In some embodiments, the electronic device is implemented as a bastion host. The bastion host is located on a private network and is bound to a first VPC. A processor 80b is coupled to a memory 80a and a communication component 80c for executing a computer program to: request a management service node located on the private network to provide a network channel between the bastion host and a second VPC via the communication component 80c, so that the management service node can establish a network channel between the bastion host and the second VPC using private network interface technology; the second VPC is not bound to the bastion host; and, based on the network channel between the bastion host and the second VPC, manage user resources in the second VPC environment.

[0127] Optionally, the processor 80b is also used to: obtain a successful channel creation message provided by the management service node through reverse access via the communication component 80c; the successful channel creation message is used to indicate that the network channel between the bastion host and the second VPC has been successfully created; and display the successful channel creation message on the operation and maintenance interface via the display component 80d for the administrators of the bastion host to view.

[0128] Optionally, the processor 80b is further configured to: obtain a user resource management request via the communication component 80c; and, if the user resource management request includes the identifier of the second VPC, execute the step of requesting the management service node to provide a network channel between the bastion host and the second VPC.

[0129] In this embodiment, the electronic device acting as a bastion host accesses the management service node using single-channel or arbitrary-channel connection technology. The electronic device acting as the bastion host and user resources in the first VPC environment access each other bidirectionally through a virtual network interface card (NIC).

[0130] In other embodiments, the electronic device is implemented as a management service node. The management service node and the bastion host are located on a private network. Accordingly, the processor 80b is configured to: obtain a network channel request sent by the bastion host via the communication component 80c; the bastion host is bound to a first VPC; the network channel request is used to request a network channel between the bastion host and a second VPC; the second VPC is not bound to the bastion host; and, in response to the network channel request, establish a network channel between the bastion host and the second VPC using private network interface technology, so that the bastion host can manage user resources in the second VPC environment based on the network channel.

[0131] Optionally, the private network interface technology can be a resilient network interface card (NIC), a single-channel connection technology, or an arbitrary-channel connection technology. Accordingly, when the processor 80b establishes a network channel between the bastion host and the second VPC using the private network interface technology in response to a network channel request, it specifically performs the following: In response to a network channel request, it establishes a network channel between the bastion host and the second VPC using a resilient NIC, a single-channel connection technology, or an arbitrary-channel connection technology.

[0132] Optionally, when processor 80b establishes a network channel between the bastion host and the second VPC in response to a network channel request using single-channel connection technology or arbitrary-channel connection technology, it specifically performs the following steps: obtaining the identifier of the second VPC from the network channel request; querying the maintained mapping relationship between the VPC identifier and the ALB IP address using the second VPC identifier; if the IP address of the ALB corresponding to the second VPC identifier is not found, then performing the operation of establishing a network channel between the bastion host and the second VPC using single-channel connection technology or arbitrary-channel connection technology. Correspondingly, if the IP address of the ALB corresponding to the second VPC identifier is found, the IP address of the ALB corresponding to the second VPC identifier is sent to the bastion host via reverse access, so that the bastion host can manage user resources in the second VPC environment based on the IP address of the ALB corresponding to the second VPC identifier.

[0133] Furthermore, when the processor 80b establishes a network channel between the bastion host and the second VPC using single-channel connection or arbitrary-channel connection technology, it is specifically used to: obtain the target IP address of the target ALB in the single-channel connection or arbitrary-channel connection; call the VPC's API to obtain the IP address of the second VPC; and call the SLB's API to create a single-channel connection or arbitrary-channel connection between the bastion host and the second VPC based on the target IP address and the IP address of the second VPC, as a network channel.

[0134] Furthermore, when the processor 80b calls the SLB API to create a single-channel connection between the bastion host and the second VPC based on the target IP address and the IP address of the second VPC, it specifically performs the following steps: calling the SLB API to create a target ALB based on the target IP address; the IP address of the target ALB is the target IP address; the tunnel identifier that the target ALB supports accessing is set to the tunnel identifier of the VPC where the bastion host is located; and the user resources corresponding to the IP address of the second VPC are mounted to the target ALB, and the tunnel type of the target ALB is set to a single-channel connection, so as to obtain a single-channel connection between the bastion host and the second VPC.

[0135] Optionally, when the processor 80b calls the SLB API to create an arbitrary channel connection between the bastion host and the second VPC based on the target IP address and the IP address of the second VPC, it specifically performs the following steps: calling the SLB API to create a target ALB based on the target IP address; the IP address of the target ALB is the target IP address; the user resources corresponding to the IP address of the second VPC are mounted to the target ALB, and the tunnel type of the target ALB is set to an arbitrary channel connection, so as to obtain an arbitrary channel connection between the bastion host and the second VPC.

[0136] Optionally, when the processor 80b obtains the target IP address of the target ALB in a single-channel connection, it specifically performs the following steps: calls the VPC's API to obtain the IP address allocated to the VPC where the bastion host is located; selects an idle first IP address from the IP addresses allocated to the VPC where the bastion host is located; creates a virtual instance in the VPC where the bastion host is located based on the first IP address; the IP address of the virtual instance is the first IP address; and uses the first IP address of the virtual instance as the target IP address of the target ALB.

[0137] Optionally, when the processor 80b obtains the target IP address of the target ALB in an arbitrary channel connection, it specifically performs the following steps: selects an idle second IP address from the IP addresses contained in the network segments supported by the pre-configured arbitrary channel connection as the target IP address; or, selects an idle second IP address from the network segments allocated to the pre-configured arbitrary channel connection; creates a virtual instance in the VPC where the bastion host is located based on the second IP address; the IP address of the virtual instance is the second IP address; and uses the second IP address of the virtual instance as the target IP address of the target ALB.

[0138] Optionally, the processor 80b is further configured to: after establishing a network channel between the bastion host and the second VPC, return a channel creation success message to the bastion host via a reverse access method, so that the bastion host can respond to the channel creation success message to perform operations to manage user resources in the second VPC environment based on the network channel; wherein, the channel creation success message is used to indicate that the network channel between the bastion host and the second VPC has been successfully created.

[0139] In some alternative implementations, such as Figure 8 As shown, the electronic device may further include components such as a power supply component 80e. In some embodiments, the electronic device may be a terminal device such as a computer, mobile phone, or workstation. Accordingly, the electronic device may also include optional components such as an audio component 80f. Figure 8 The diagram only shows some components and does not mean that the electronic device must contain them. Figure 8 The inclusion of all components does not imply that an electronic device can only include... Figure 8 The components shown.

[0140] In this embodiment, when the bastion host manages user resources across VPC environments, it can request a network channel between the bastion host and an unbound VPC from a management service node deployed in a private network. The management service node can respond to the bastion host's request and establish a network channel between the bastion host and the unbound VPC using private network interface technology. In this way, the bastion host can manage user resources in other VPCs across VPC environments based on this network channel, realizing cross-VPC user resource management by the bastion host. On the other hand, since both the bastion host and the management service node are located in a private network, the devices involved in the aforementioned cross-VPC user resource management by the bastion host do not need to be exposed to the public network, reducing the exposure surface during the process and helping to improve the security of user resources in the VPC environment.

[0141] In this embodiment, the memory is used to store computer programs and can be configured to store various other data to support operation on its host device. The processor can execute the computer programs stored in the memory to implement corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Electrically Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0142] In the embodiments of this application, the processor can be any hardware processing device capable of executing the above-described method logic. Optionally, the processor can be a central processing unit (CPU), graphics processing unit (GPU), or microcontroller unit (MCU); it can also be a programmable device such as a field-programmable gate array (FPGA), programmable array logic (PAL), general array logic (GAL), or complex programmable logic device (CPLD); or an application-specific integrated circuit (ASIC) chip; or an advanced RISC machine (ARM) or system on chip (SoC), etc., but is not limited thereto.

[0143] In this embodiment, the communication component is configured to facilitate wired or wireless communication between its host device and other devices. The device housing the communication component can access wireless networks based on communication standards, such as Wireless Fidelity (WiFi), 2G or 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In another exemplary embodiment, the communication component may also be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), or other technologies.

[0144] In embodiments of this application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0145] In this embodiment, a power supply component is configured to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0146] In embodiments of this application, the audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), which is configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals. For example, in devices with voice interaction capabilities, voice interaction with the user can be achieved through the audio component.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0148] It should be noted that the terms "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0149] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0150] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (or systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0151] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0153] In a typical configuration, a computing device includes one or more processors (such as a CPU), input / output interfaces, network interfaces, and memory.

[0154] Memory may include non-persistent storage in computer-readable media, such as random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0155] Computer storage media are readable storage media, also known as removable media. Removable and non-removable media can be used to store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. As defined in this article, computer-readable media do not include transient computer-readable media, such as modulated data signals and carrier waves.

[0156] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0157] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for user resource management, characterized by, The application is suitable for a management and control service node; The management and control service node and the bastion host are arranged in a special network; the method comprises: Obtaining a network channel request sent by the bastion host; the bastion host is bound with a first virtual private cloud (VPC); the bastion host has a management authority of user resources in a first VPC environment; the network channel request is used to request a network channel between the bastion host and a second VPC; the second VPC is not bound with the bastion host; a special network where the bastion host is located is a third VPC; In response to the network channel request, a network channel between the bastion host and the second VPC is established by using a private network interface technology; wherein the bastion host manages user resources in the second VPC environment based on the network channel.

2. The method of claim 1, wherein, The private network interface technology is a single-channel connection technology or an arbitrary channel connection technology or a flexible network card technology; in response to the network channel request, the network channel between the bastion host and the second VPC is established by using the private network interface technology, comprising: In response to the network channel request, the network channel between the bastion host and the second VPC is established by using the single-channel connection technology or the arbitrary channel connection technology or the flexible network card technology.

3. The method of claim 2, wherein, In response to the network channel request, the network channel between the bastion host and the second VPC is established by using the single-channel connection technology or the arbitrary channel connection technology, comprising: From the network channel request, the identification of the second VPC is obtained; The identification of the second VPC is used to query a corresponding relationship between the identification of the VPC and an Internet protocol (IP) address of an application load balancing (ALB) maintained; If the IP address of the ALB corresponding to the identification of the second VPC is not queried, the operation of establishing the network channel between the bastion host and the second VPC by using the single-channel connection technology or the arbitrary channel connection technology is performed.

4. The method of claim 3, wherein, Further comprising: If the IP address of the ALB corresponding to the identification of the second VPC is queried, the IP address of the ALB corresponding to the identification of the second VPC is sent to the bastion host by a reverse access mode, so that the bastion host manages the user resources in the second VPC environment based on the IP address of the ALB corresponding to the identification of the second VPC.

5. The method of claim 2, wherein, The network channel between the bastion host and the second VPC is established by using the single-channel connection or the arbitrary channel connection technology, comprising: Obtaining a target IP address of a target ALB in the single-channel connection or the arbitrary channel connection; Calling an application programming interface (API) of the VPC to obtain an IP address of the second VPC; Calling an API of a server load balancing service (SLB) to create a single-channel connection or an arbitrary channel connection between the bastion host and the second VPC as the network channel based on the target IP address and the IP address of the second VPC.

6. The method of claim 5, wherein, Calling an API of a server load balancing service (SLB) to create a single-channel connection or an arbitrary channel connection between the bastion host and the second VPC, comprising: An API of the SLB is invoked to create the target ALB based on the target IP address; the IP address of the target ALB is the target IP address; A tunnel identifier supported by the target ALB is set to a tunnel identifier of a VPC where the bastion host is located; A user resource corresponding to an IP address of the second VPC is mounted to the target ALB, and a tunnel type of the target ALB is set to single-channel connection, so as to obtain single-channel connection between the bastion host and the second VPC; Or, An API of the SLB is invoked to create the target ALB based on the target IP address; the IP address of the target ALB is the target IP address; A user resource corresponding to an IP address of the second VPC is mounted to the target ALB, and a tunnel type of the target ALB is set to single-channel connection, so as to obtain single-channel connection between the bastion host and the second VPC.

7. The method of claim 5, wherein, Obtaining a target IP address of a target ALB in single-channel connection, comprising: An API of a VPC is invoked to obtain an IP address allocated by a VPC where the bastion host is located; a first idle IP address is selected from the IP address allocated by the VPC where the bastion host is located; A virtual instance is created in the VPC where the bastion host is located based on the first IP address; an IP address of the virtual instance is the first IP address; The first IP address of the virtual instance is used as the target IP address of the target ALB.

8. The method of claim 5, wherein, Obtaining a target IP address of a target ALB in arbitrary-channel connection, comprising: An idle second IP address is selected from IP addresses contained in a network segment supported by the arbitrary-channel connection, as the target IP address; Or, An idle second IP address is selected from a network segment allocated by the arbitrary-channel connection; a virtual instance is created in the VPC where the bastion host is located based on the second IP address; an IP address of the virtual instance is the second IP address; and the second IP address of the virtual instance is used as the target IP address of the target ALB.

9. The method of claim 1, wherein, Further comprising: After establishing a network channel between the bastion host and the second VPC, a channel creation success message is returned to the bastion host in a reverse access mode; wherein the bastion host performs an operation of managing a user resource in the second VPC environment based on the network channel in response to the channel creation success message; The channel creation success message is used to indicate that the network channel between the bastion host and the second VPC is successfully created.

10. A method for user resource management, characterized by, The method is suitable for a bastion host, the bastion host is arranged in a special network and is bound with a first virtual private cloud (VPC); the bastion host has a management right of a user resource in a first VPC environment; a special network where the bastion host is located is a third VPC; the method comprises: The request is set to the management and control service node of the private network to provide the network channel between the bastion host and the second VPC, so that the management and control service node establishes the network channel between the bastion host and the second VPC by using a private network interface technology; the second VPC is not bound with the bastion host; Based on the network channel between the bastion host and the second VPC, the user resources in the second VPC environment are managed.

11. The method of claim 10, wherein, Also includes: Obtain the channel creation success message provided by the management and control service node through the reverse access mode; The channel creation success message is used to indicate that the network channel between the bastion host and the second VPC is successfully created; Display the channel creation success message on the operation and maintenance interface for the management personnel of the bastion host to view.

12. A resource management system, characterized by The bastion host and the management and control service node deployed in the private network; the system further comprises: a first virtual private cloud VPC bound with the bastion host and a second VPC not bound with the bastion host; user resources are set in the first VPC and the second VPC environments; the bastion host has the management authority of the user resources in the first VPC environment; the private network where the bastion host is located is a third VPC; The management and control service node is used to execute the steps in the method of any one of claims 1-9; The bastion host is used to execute the steps in the method of claim 10 or 11.

13. An electronic device, comprising: It includes: Memory, processor and communication components; wherein the memory is used to store computer programs; The processor is coupled to the memory and the communication component, and is used to execute the computer program to execute the steps in the method executed by the management and control service node in claim 12, and / or the steps in the method executed by the bastion host in claim 12.

14. A computer readable storage medium having stored thereon computer instructions, wherein, When the computer instructions are executed by one or more processors, the one or more processors execute the steps in the method executed by the management and control service node in claim 12, and / or the steps in the method executed by the bastion host in claim 12.

Images