Cloud network topology generation method, device, equipment and medium

Abstract

The present disclosure provides a cloud network topology generation method, device, equipment and medium, which can be applied to the field of cloud computing technology. The method comprises: obtaining server resource information and network connection information of a network created by a target tenant, wherein the network is composed of network segments, each network segment corresponds to at least one router, the router is used to collect routing policy information, and the network connection information is used to represent the association relationship between server resources in the network; configuring the server resource information and the routing policy information to preset network topology areas respectively, wherein the preset network topology areas are constructed according to the network segments and the routing policy information; and based on the network connection information, the server resource information and the routing policy information in the preset network topology areas are connected in direction respectively, and a network topology graph is generated.

Description

Technical Field

[0001] This disclosure relates to the field of cloud computing technology, and in particular to cloud network topology generation methods, apparatus, devices and media. Background Technology

[0002] Cloud service providers can create Virtual Private Clouds (VPCs) for tenants on the public cloud. A VPC is a logically isolated network space defined by the tenant within the public cloud; it is a network space that tenants can customize. Tenants have complete control over the private network environment, flexibly deploying cloud nodes and forming complex network topologies among them.

[0003] In the process of implementing this disclosure, it was found that existing solutions for generating network topologies for application systems are mostly designed for traditional data centers. This type of network infrastructure is relatively simple and cannot generate cloud network topologies or intuitively display the network topology relationships between various nodes in the cloud in the current more widely used cloud environment. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a method, apparatus, device, medium and program product for generating cloud network topology.

[0005] According to a first aspect of this disclosure, a method for generating a cloud network topology is provided, comprising:

[0006] Obtain server resource information and network connection information of the network created by the target tenant. The network is composed of network segments, each corresponding to at least one router. Routers are used to collect routing policy information, and network connection information is used to characterize the relationship between server resources in the network.

[0007] Server resource information and routing policy information are configured onto preset network topology areas, which are constructed based on network segments and routing policy information; and

[0008] Based on network connection information, directed connections are made to server resource information and routing policy information in the preset network topology areas to generate a network topology map.

[0009] According to embodiments of this disclosure, the preset network topology region is composed of cloud network regions and non-cloud network regions, and the network includes N, where N is an integer greater than or equal to 2;

[0010] The methods also include:

[0011] Based on the network segments corresponding to N networks, construct N cloud network regions;

[0012] Based on the type of routing policy information, construct different types of non-cloud network regions.

[0013] According to embodiments of this disclosure, server resource information and routing policy information are configured onto preset network topology areas, including:

[0014] Once it is determined that the address and network segment of the server resource related to the server resource information match, the server resource information is configured to the corresponding cloud network area.

[0015] If the type of routing policy information matches the type of non-cloud network area, the routing policy information will be configured to the corresponding non-cloud network area.

[0016] According to embodiments of this disclosure, the network includes a virtual private cloud, and the server resource information includes information about cloud hosts;

[0017] This includes obtaining server resource information and network connection information for the network created by the target tenant, including:

[0018] Obtain information about the cloud hosts of the virtual private cloud created by the target tenant through the cloud interface;

[0019] By deploying an agent on a cloud server for monitoring, network connection information can be obtained in real time.

[0020] According to embodiments of this disclosure, network connection information includes: source address information and destination address information; routing policy information includes leased network segment information;

[0021] Specifically, based on network connection information, directed connections are made to server resource information and routing policy information in preset network topology areas to generate a network topology map, including:

[0022] The direction of the connection is determined based on the source and destination address information;

[0023] Based on the direction of the connection, directed line segments are used to connect the information of the cloud host with the information of the dedicated line network segment to generate a network topology diagram.

[0024] According to embodiments of this disclosure, the network connection information further includes: destination port information and protocol information;

[0025] This includes generating a network topology map by performing directed connections on server resource information and routing policy information in a preset network topology area based on network connection information, and further comprising:

[0026] Directed line segments are marked using destination port information and protocol information.

[0027] According to embodiments of this disclosure, the non-cloud network area includes: the Internet area, the leased line area, and the virtual private network area; the routing policy information includes Internet network segment information, leased line network segment information, and virtual private network segment information;

[0028] Specifically, when it is determined that the type of routing policy information matches the type of non-cloud network area, the routing policy information is configured to the corresponding non-cloud network area, including:

[0029] Configure the internet network segment information to the internet zone;

[0030] Configure the dedicated line network segment information to the dedicated line area;

[0031] Configure the VPN segment information to the VPN zone.

[0032] A second aspect of this disclosure provides a cloud network topology generation apparatus, comprising:

[0033] The acquisition module is used to acquire server resource information and network connection information of the network created by the target tenant. The network is composed of network segments, each corresponding to at least one router. The router is used to collect routing policy information, and the network connection information is used to characterize the relationship between server resources in the network.

[0034] The configuration module is used to configure server resource information and routing policy information to preset network topology areas, where the preset network topology areas are constructed based on network segments and routing policy information; and

[0035] The generation module is used to generate a network topology map by making directed connections between server resource information and routing policy information in a preset network topology area based on network connection information.

[0036] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the cloud network topology generation method described above.

[0037] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the above-described cloud network topology generation method.

[0038] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described cloud network topology generation method.

[0039] According to embodiments of this disclosure, by acquiring server resource information of the network created by the target tenant, and fully combining the characteristics of the cloud network architecture, routing policy information collected by the routers of the network segment and the network segment constructing a preset network topology area, and by acquiring network connection information, combined with server resource information and routing policy information, a more accurate and intuitive network topology diagram is drawn. This facilitates the configuration of cloud network access relationships by operation and maintenance personnel, helps guide operation and maintenance personnel to troubleshoot network access failures, and can also provide information support for application system migration, expansion, planning and splitting, etc. It at least partially solves the problem that in the current more widely used cloud environment, existing solutions for generating network topologies for application systems cannot generate cloud network topologies or intuitively display the network topology relationships of various nodes in the cloud. Attached Figure Description

[0040] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0041] Figure 1 The illustration schematically depicts application scenarios of cloud network topology generation methods, apparatuses, devices, media, and program products according to embodiments of this disclosure;

[0042] Figure 2 A flowchart illustrating a cloud network topology generation method according to an embodiment of the present disclosure is shown schematically.

[0043] Figure 3 A flowchart illustrating a cloud network topology generation method according to another embodiment of the present disclosure is shown schematically;

[0044] Figure 4 A schematic diagram of a network topology according to an embodiment of the present disclosure is shown.

[0045] Figure 5 This schematic diagram illustrates a structural block diagram of a cloud network topology generation apparatus according to an embodiment of the present disclosure;

[0046] Figure 6 A schematic diagram of the acquisition module of the cloud network topology generation apparatus according to an embodiment of the present disclosure is shown; and

[0047] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a cloud network topology generation method according to an embodiment of the present disclosure. Detailed Implementation

[0048] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0049] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0050] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0051] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0052] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0053] In the technical solutions of this disclosure, user authorization or consent is obtained before acquiring or collecting user personal information.

[0054] In the process of implementing this disclosure, it was discovered that the cloud network architecture is divided into two layers: underlay and overlay. The underlay provides physical network architecture support and carries physical machine nodes; the overlay is a virtual network layer built on the underlay. The network on the cloud tenant side is all in the overlay layer. After the cloud tenant plans and creates a VPC network segment, it can then host various cloud resources (cloud hosts, bare metal, load balancers, cloud databases, etc.). After the cloud host is created, an internal network IP address will be randomly generated within the selected VPC network segment. All cloud networks forward traffic through this IP address.

[0055] In traditional data center architecture, a set of physical machines is deployed for each application system. Each machine is managed by the operation and maintenance management platform, and network connection data is collected uniformly. Combined with the configuration management database (CMDB) information of the operation and maintenance management platform, a network topology diagram can be easily generated. However, in the cloud environment where the application is more widely used today, this network topology implementation scheme cannot generate cloud network topology, nor can it intuitively display the network topology relationship between various nodes in the cloud.

[0056] An overlay is a logical network built on top of a physical network. In the field of network technology, overlay refers to a virtualization technology model superimposed on a network architecture. An overlay network is also a network, but it is built on top of an underlay network. Overlay network nodes communicate through virtual or logical links, and its implementation is mainly based on IP technology. There are various overlay network technologies, generally employing tunneling technologies such as TRILL, VxLAN, GRE, and NVGRE.

[0057] Underlay refers to the physical infrastructure network devices, the basic forwarding architecture of the data center. Ethernet was originally designed as a distributed network architecture without a central control node; nodes learn network reachability information through protocol transmission. Underlay is the fundamental physical infrastructure in data center scenarios, ensuring routable reachability between any two points, and it incorporates traditional network technologies.

[0058] The embodiments of this disclosure provide a cloud network topology generation method, including: obtaining server resource information and network connection information of a network created by a target tenant, wherein the network is composed of network segments, each network segment corresponds to at least one router, the router is used to collect routing policy information, and the network connection information is used to characterize the association relationship between server resources in the network; configuring the server resource information and routing policy information onto a preset network topology area, wherein the preset network topology area is constructed based on the network segments and routing policy information; and performing directed connections on the server resource information and routing policy information in the preset network topology area based on the network connection information to generate a network topology map.

[0059] Figure 1 The illustration schematically depicts an application scenario of a cloud network topology generation method, apparatus, device, medium, and program product according to embodiments of the present disclosure.

[0060] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0061] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0062] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0063] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0064] It should be noted that the cloud network topology generation method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the cloud network topology generation device provided in this disclosure embodiment can generally be located in server 105. The cloud network topology generation method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the cloud network topology generation device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0065] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0066] The following will be based on Figure 1 The described scene, through Figures 2-4 The cloud network topology generation method of the disclosed embodiments is described in detail.

[0067] Figure 2 A flowchart illustrating a cloud network topology generation method according to an embodiment of the present disclosure is shown.

[0068] like Figure 2 As shown, the cloud network topology generation method 200 of this embodiment includes operations S210 to S230.

[0069] In operation S210, server resource information and network connection information of the network created by the target tenant are obtained. The network is composed of network segments, each corresponding to at least one router. The router is used to collect routing policy information, and the network connection information is used to characterize the relationship between server resources in the network.

[0070] According to embodiments of this disclosure, network connection information can be obtained using network packet capture methods, with common tools including tcpdump and wireshark. Network connection information can also be obtained in real-time by deploying an agent on a cloud host for monitoring. Server resource information can be obtained through a configuration interface. This server resource information may include, for example, at least one of the following: cloud host information, load balancer information, cloud database information, and file storage information. Network connection information may include, for example, source address information, destination address information, destination port information, and protocol information. Routing policy information may include destination address information and next-hop type information. For example, next-hop type information may include network segment information of the peer tenant network, information of a Network Address Translation (NAT) gateway, information of a leased line gateway, and information of a Virtual Private Network (VPN) gateway.

[0071] In operation S220, server resource information and routing policy information are configured to preset network topology areas, which are constructed based on network segments and routing policy information.

[0072] According to embodiments of this disclosure, server resource information is configured to a region associated with the server resource information within a preset network topology region. Routing policy information is configured to a region associated with the routing policy information within the preset network topology region.

[0073] For example, the network can include Virtual Private Clouds (VPCs). All VPCs created by the target tenant can be retrieved, and each VPC can be designated as a separate region. Similarly, each piece of routing policy information can be designated as a separate region, collectively forming a preset network topology region. Server resource information for the corresponding VPC can be configured into its respective region. Routing policy information can also be configured into its respective region. Alternatively, the address numbers of server resource information and routing policy information can be mapped to preset network topology regions.

[0074] In operation S230, based on network connection information, directed connections are made to the server resource information and routing policy information in the preset network topology area to generate a network topology map.

[0075] According to embodiments of this disclosure, directed connections can be established between server resource information, between routing policy information, or between server resource information and routing policy information, based on network connection information.

[0076] According to the embodiments of this disclosure, by obtaining server resource information of the network created by the target tenant, and fully combining the characteristics of the cloud network architecture, routing policy information collected by the router of the network segment and the network segment constructing a preset network topology area are used. By obtaining network connection information, combined with server resource information and routing policy information, a more accurate and intuitive network topology map is drawn. This facilitates the configuration of cloud network access relationships by operation and maintenance personnel, helps guide operation and maintenance personnel to troubleshoot network access failures, and can also provide information support for application system migration, expansion, planning and splitting, etc. It at least partially solves the problem that in the current cloud environment where applications are more widely used, existing solutions for generating network topologies for application systems cannot generate cloud network topologies or intuitively display the network topology relationships of various nodes in the cloud.

[0077] Figure 3 A flowchart illustrating a cloud network topology generation method according to another embodiment of the present disclosure is shown.

[0078] like Figure 3 As shown, the cloud network topology generation method 300 of this embodiment may include operations S310 to S320 in addition to operations S210 to S230.

[0079] It should be noted that the preset network topology region consists of cloud network regions and non-cloud network regions, and there are N networks, where N is an integer greater than or equal to 2.

[0080] When operating S310, N cloud network regions are constructed based on the network segments corresponding to N networks.

[0081] According to embodiments of this disclosure, each network segment can be divided into a region to obtain a cloud network region.

[0082] When operating the S320, different types of non-cloud network areas are constructed based on the type of routing policy information.

[0083] According to embodiments of this disclosure, routing policy information of various types can be grouped into a region based on the type to which the routing policy information belongs, thus obtaining different types of non-cloud network regions.

[0084] According to embodiments of this disclosure, by constructing N cloud network regions and different types of non-cloud network regions, the cloud network topology is divided into its respective regions, which is beneficial for drawing a more accurate and intuitive network topology diagram.

[0085] According to embodiments of this disclosure, configuring server resource information and routing policy information onto preset network topology areas may include:

[0086] If the address and network segment of the server resource related to the server resource information are determined to match, the server resource information is configured to the corresponding cloud network area; if the type of the routing policy information is determined to match the type of the non-cloud network area, the routing policy information is configured to the corresponding non-cloud network area.

[0087] According to embodiments of this disclosure, each cloud network region and non-cloud network region in the preset network topology area corresponds to an IP network segment, and the IP network segments of each region do not overlap.

[0088] According to embodiments of this disclosure, addresses related to server resource information and routing policy information can be mapped to corresponding regions. Alternatively, IP network segments can be matched with the addresses of server resources associated with the server resource information; if a match is found, configuration can be performed. Alternatively, the type of routing policy information and the type of non-cloud network region can be matched; if a match is found, configuration can be performed.

[0089] According to embodiments of this disclosure, by determining whether the address and network segment of the server resources related to the server resource information match, and by determining whether the type of the routing policy information matches the type of the non-cloud network area, it is possible to accurately configure it to the preset network topology area, which is beneficial for generating an accurate network topology map.

[0090] According to embodiments of this disclosure, the network may include a virtual private cloud, and the server resource information may include information about cloud hosts.

[0091] Obtaining server resource information and network connection information of the network created by the target tenant may include:

[0092] Information about the cloud hosts in the virtual private cloud created by the target tenant is obtained through the cloud interface; network connection information is obtained in real time by deploying a proxy monitoring on the cloud hosts.

[0093] According to embodiments of this disclosure, information about all virtual private cloud hosts created by a target tenant can be obtained by configuring a cloud interface. Simultaneously, routing policy information from routing tables can be collected via a router. An agent monitoring service can be deployed on each cloud host to periodically obtain network connection information in real time using the netstat command.

[0094] According to embodiments of this disclosure, information about cloud hosts in a virtual private cloud created by a target tenant can be accurately obtained through a cloud interface. By deploying a proxy monitoring service on the cloud host, network connection information can be obtained in real time, which is beneficial for generating a network topology map.

[0095] According to embodiments of this disclosure, network connection information may include: source address information and destination address information; routing policy information may include leased network segment information.

[0096] Specifically, based on network connection information, directed connections are made to server resource information and routing policy information in a preset network topology area to generate a network topology map, which may include:

[0097] Based on the source and destination address information, the direction of the connection is determined; based on the direction of the connection, directed line segments are used to connect the information of the cloud host with the information of the leased network segment to generate a network topology diagram.

[0098] According to embodiments of this disclosure, the leased network segment information may include the name of the leased network segment and the corresponding IP address. The cloud server information may include the name of the cloud server and the corresponding IP address.

[0099] For example, information about cloud servers and dedicated network segments can be connected in a directed manner through peering connections.

[0100] According to embodiments of this disclosure, by determining the direction of the connection and making directed connections, the generated network topology graph can intuitively display the relationship between various nodes in the network topology graph.

[0101] According to embodiments of this disclosure, the network connection information may further include: destination port information and protocol information.

[0102] Among them, based on network connection information, directed connections are made to server resource information and routing policy information in the preset network topology area to generate a network topology map. It may also include marking directed line segments using destination port information and protocol information.

[0103] According to embodiments of this disclosure, marking can be done by connecting protocol information and destination port information using connectors and then marking them on a directed line segment.

[0104] According to the embodiments of this disclosure, marking directed line segments makes it easier for operation and maintenance personnel to configure cloud network access relationships, helps guide operation and maintenance personnel to troubleshoot network access failures, and can also provide information support for application system migration, expansion, planning and splitting, etc.

[0105] According to embodiments of this disclosure, the non-cloud network area may include: the Internet area, the leased line area, and the virtual private network area; the routing policy information may include Internet network segment information, leased line network segment information, and virtual private network segment information.

[0106] Specifically, when it is determined that the type of routing policy information matches the type of non-cloud network area, configuring the routing policy information to the corresponding non-cloud network area may include:

[0107] Configure the Internet network segment information to the Internet zone; configure the leased line network segment information to the leased line zone; configure the VPN network segment information to the VPN zone.

[0108] According to embodiments of this disclosure, by configuring information of the corresponding type to the corresponding area, the generated network topology map can be displayed intuitively, which is beneficial for further application of the network topology map.

[0109] According to embodiments of this disclosure, the non-cloud network area may further include an underlay area.

[0110] Figure 4 A schematic diagram of a network topology according to an embodiment of the present disclosure is shown.

[0111] like Figure 4 As shown, it is possible to obtain N VPC network segments (such as VPC1, VPC2…VPCN) created by tenant A, along with their corresponding server resource information, such as load balancer information, cloud host information, cloud database information, and file storage information. The N VPC network segments correspond to N cloud network zones. Routing policy information can include internet network segment information, leased line network segment information, and virtual private network (VPN) network segment information. Internet network segment information belongs to the NAT gateway and corresponds to the internet zone. Leased line network segment information belongs to the leased line gateway and corresponds to the leased line zone. VPN network segment information belongs to the VPN gateway and corresponds to the VPN zone. Routing policy information can also include the VPC network segment information of the peer tenant.

[0112] Network access between different VPCs can be achieved through peering connections. Internet access to cloud hosts is achieved through a public network load balancer, while Internet outbound access is achieved through a NAT gateway. The leased line gateway and VPN gateway can connect to the leased line and VPN networks of the on-premises environment, respectively. The leased line gateway and VPN gateway can achieve peering connections with cloud hosts and third-party clients, respectively. Tenant A can achieve peering connections with the VPC of tenant B.

[0113] It should be noted that a peer-to-peer connection can represent a bidirectional directed connection, as shown by the double arrows in the diagram. A directed connection can be shown by the single arrow in the diagram.

[0114] According to the embodiments of this disclosure, the applicable scenarios are extended to the cloud environment, which has a wider current application scope. Based on the characteristics of the cloud environment, the network element information of nodes such as VPC, load balancer, cloud host, cloud database, leased line, NAT gateway, peer-to-peer connection, and VPN gateway of the cloud environment are added to the original network topology diagram. The generated network topology diagram can more intuitively show the network architecture of the cloud environment.

[0115] Based on the above-described cloud network topology generation method, this disclosure also provides a cloud network topology generation apparatus. The following will be combined with... Figures 5-6 The device is described in detail.

[0116] Figure 5 A schematic block diagram of a cloud network topology generation apparatus according to an embodiment of the present disclosure is shown.

[0117] like Figure 5 As shown, the cloud network topology generation device 500 of this embodiment includes an acquisition module 510, a configuration module 520 and a generation module 530.

[0118] The acquisition module 510 is used to acquire server resource information and network connection information of the network created by the target tenant. The network is composed of network segments, each corresponding to at least one router. Routers are used to collect routing policy information, and network connection information is used to characterize the relationships between server resources in the network. In one embodiment, the acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0119] The configuration module 520 is used to configure server resource information and routing policy information onto a preset network topology area, wherein the preset network topology area is constructed based on network segments and routing policy information. In one embodiment, the configuration module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0120] The generation module 530 is used to generate a network topology map by performing directed connections on server resource information and routing policy information in a preset network topology area based on network connection information. In one embodiment, the generation module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0121] According to embodiments of this disclosure, the cloud network topology generation device 500 may further include a first construction module and a second construction module. The preset network topology region is composed of cloud network regions and non-cloud network regions, and the network includes N networks, where N is an integer greater than or equal to 2.

[0122] The first building module is used to construct N cloud network regions based on the network segments corresponding to N networks.

[0123] The second building module is used to construct different types of non-cloud network areas based on the type of routing policy information.

[0124] According to embodiments of this disclosure, the configuration module 520 may further include a first sub-configuration unit and a second sub-configuration unit.

[0125] The first sub-configuration unit is used to configure the server resource information to the corresponding cloud network area when it is determined that the address and network segment of the server resource related to the server resource information match.

[0126] The second sub-configuration unit is used to configure the routing policy information to the corresponding non-cloud network area when it is determined that the type of the routing policy information matches the type of the non-cloud network area.

[0127] According to embodiments of this disclosure, the acquisition module 510 may further include a first sub-acquisition unit and a second sub-acquisition unit. The network may include a virtual private cloud, and the server resource information may include information about cloud hosts.

[0128] The first sub-acquisition unit is used to obtain information about the cloud hosts of the virtual private cloud created by the target tenant through the cloud interface.

[0129] The second sub-acquisition unit is used to acquire network connection information in real time by deploying an agent on the cloud host for monitoring.

[0130] According to embodiments of this disclosure, the generation module 530 may further include a first sub-generation unit and a second sub-generation unit. The network connection information may include source address information and destination address information; the routing policy information may include leased network segment information.

[0131] The first sub-generation unit is used to determine the direction of the connection based on the source address information and the destination address information.

[0132] The second sub-generation unit is used to generate a network topology diagram by using directed line segments to connect the information of the cloud host with the information of the leased network segment according to the direction of the connection.

[0133] According to embodiments of this disclosure, any plurality of modules among the acquisition module 510, configuration module 520, and generation module 530 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 510, configuration module 520, and generation module 530 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these. Alternatively, at least one of the acquisition module 510, configuration module 520, and generation module 530 may be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0134] Figure 6 A schematic diagram of the acquisition module of the cloud network topology generation apparatus according to an embodiment of the present disclosure is shown.

[0135] like Figure 6 As shown, the acquisition module may include a first sub-acquisition module and a second sub-acquisition module.

[0136] The first sub-module can acquire network connection information in real time by deploying a monitoring agent on each cloud host and periodically using the `netstat` command. The second sub-module can acquire information about cloud hosts, cloud databases, load balancers, and file storage devices in all VPCs created by the target tenant by configuring cloud interfaces. It can also collect routing policy information from the routing tables of the routers corresponding to the VPC network segments. This routing policy information can include next-hop type (peer connection, NAT gateway, leased line gateway, VPN gateway) information.

[0137] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a cloud network topology generation method according to an embodiment of the present disclosure.

[0138] like Figure 7As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0139] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0140] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0141] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0142] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0143] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0144] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0145] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0146] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0147] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0149] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0150] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for generating cloud network topology, comprising: Obtain server resource information and network connection information of the network created by the target tenant, wherein the network is composed of network segments, each network segment corresponds to at least one router, the router is used to collect routing policy information, and the network connection information is used to characterize the association relationship between server resources in the network; The server resource information and the routing policy information are respectively configured onto a preset network topology area, wherein the preset network topology area is composed of cloud network areas and non-cloud network areas, and the network includes N, where N is an integer greater than or equal to 2. The method for constructing the preset network topology area includes: constructing N cloud network areas according to the network segments corresponding to the N networks; and constructing different types of non-cloud network areas according to the type to which the routing policy information belongs. Based on the network connection information, directed connections are made to the server resource information and the routing policy information in the preset network topology area to generate a network topology map. The step of configuring the server resource information and routing policy information to preset network topology areas includes: configuring the server resource information to the corresponding cloud network area when it is determined that the address of the server resource related to the server resource information matches the network segment; and configuring the routing policy information to the corresponding non-cloud network area when it is determined that the type of the routing policy information matches the type of the non-cloud network area.

2. The method according to claim 1, wherein, The network includes a virtual private cloud, and the server resource information includes information about cloud hosts. The step of obtaining server resource information and network connection information of the network created by the target tenant includes: Information about the cloud host in the virtual private cloud created by the target tenant is obtained through the cloud interface; By deploying an agent monitoring system on the cloud host, the network connection information can be obtained in real time.

3. The method according to claim 2, wherein, The network connection information includes: source address information and destination address information; the routing policy information includes leased network segment information. The step of generating a network topology map by performing directed connections on the server resource information and the routing policy information in the preset network topology area based on the network connection information includes: The direction of the connection is determined based on the source address information and the destination address information; Based on the direction of the connection, the information of the cloud host and the information of the dedicated network segment are connected in a directed manner using directed line segments to generate the network topology diagram.

4. The method according to claim 3, wherein, The network connection information also includes: destination port information and protocol information; The step of generating a network topology map by performing directed connections on the server resource information and the routing policy information in the preset network topology area based on the network connection information further includes: The directed line segment is marked using the destination port information and the protocol information.

5. The method according to claim 1, wherein, The non-cloud network area includes: the Internet area, the leased line area, and the Virtual Private Network area; the routing policy information includes Internet network segment information, leased line network segment information, and Virtual Private Network network segment information. Wherein, configuring the routing policy information to the corresponding non-cloud network area when it is determined that the type of the routing policy information matches the type of the non-cloud network area includes: Configure the Internet network segment information to the Internet region; Configure the leased line network segment information to the leased line area; Configure the VPN segment information to the VPN area.

6. A cloud network topology generation device, comprising: The acquisition module is used to acquire server resource information and network connection information of the network created by the target tenant. The network is composed of network segments, each network segment corresponds to at least one router, the router is used to collect routing policy information, and the network connection information is used to characterize the association relationship between server resources in the network. A configuration module is used to configure the server resource information and the routing policy information onto a preset network topology area, wherein the preset network topology area is composed of cloud network areas and non-cloud network areas, and the network includes N, where N is an integer greater than or equal to 2. The method for constructing the preset network topology area executes a first construction module and a second construction module. The first construction module is used to construct N cloud network areas according to the network segments corresponding to the N networks; the second construction module is used to construct different types of non-cloud network areas according to the type of the routing policy information. The generation module is used to perform directed connections on the server resource information and the routing policy information in the preset network topology area based on the network connection information, and generate a network topology map. The configuration module includes a first sub-configuration unit and a second sub-configuration unit. The first sub-configuration unit is used to configure the server resource information to the corresponding cloud network area when it is determined that the address of the server resource related to the server resource information matches the network segment. The second sub-configuration unit is used to configure the routing policy information to the corresponding non-cloud network area when it is determined that the type of the routing policy information matches the type of the non-cloud network area.

7. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images