A tenant isolation management method, device, equipment and storage medium

Abstract

The present invention discloses a tenant isolation management method, device, equipment and storage medium. The method includes: in response to an isolation request for a target tenant, determining the virtual private cloud number corresponding to the target tenant according to the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy; determining the target subnet address corresponding to the target tenant according to the virtual private cloud number, the number configuration range, the address pool information and the tenant subnet mask; allocating the virtual private cloud and the subnet address to the target tenant according to the virtual private cloud number and the target subnet address to perform tenant isolation management. The technical solution of the present invention, by establishing an association between the virtual private cloud number and the subnet address, can quickly and effectively determine a more accurate virtual private cloud number and subnet address, and automatically allocate them to each tenant to better achieve isolation management of each tenant.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a tenant isolation management method, device, equipment and storage medium. Background Art

[0002] With the continuous development of cloud computing technology, cloud platforms usually use virtual private clouds (VPCs) to isolate tenant networks. Each tenant uses an independent VPC ID, so that the cloud platform can allocate resources to each tenant safely and effectively.

[0003] Therefore, how to quickly and effectively determine a more accurate virtual private cloud number and subnet address, and automatically allocate them to each tenant to better isolate and manage each tenant is an urgent problem to be solved. Summary of the invention

[0004] The present invention provides a tenant isolation management method, apparatus, device and storage medium, which can quickly and effectively determine a more accurate virtual private cloud number and subnet address, and automatically allocate them to each tenant to better isolate and manage each tenant.

[0005] According to one aspect of the present invention, a tenant isolation management method is provided, the method comprising:

[0006] In response to an isolation request for a target tenant, determining a virtual private cloud number corresponding to the target tenant according to a number configuration range, an allocation mode of the virtual private cloud, and a number allocation policy;

[0007] Determine the target subnet address corresponding to the target tenant based on the virtual private cloud number, number configuration range, address pool information, and tenant subnet mask;

[0008] According to the virtual private cloud number and the target subnet address, the virtual private cloud and subnet address are allocated to the target tenant to perform isolation management of the tenant.

[0009] Optionally, according to the virtual private cloud number, number configuration range, address pool information, and tenant subnet mask, a target subnet address corresponding to the target tenant is determined, including:

[0010] Determine the starting point of numbering according to the numbering configuration range, and determine the deviation between the starting point of numbering and the virtual private cloud numbering;

[0011] According to the deviation, address pool information and tenant subnet mask, a target subnet address corresponding to the target tenant is determined.

[0012] The advantage of this setting is that by determining the deviation between the starting point of the numbering configuration range and the virtual private cloud number, a connection between the virtual private cloud number and the subnet address is established, and an implementable method for determining the subnet address corresponding to the target tenant is provided, which helps to subsequently allocate subnets to the target tenants and achieve isolation of tenants in the tenant network.

[0013] Optionally, determining a target subnet address corresponding to a target tenant according to the deviation, the address pool information, and the tenant subnet mask includes:

[0014] Perform binary expansion on the address pool start address in the address pool information to determine the start binary address corresponding to the address pool start address;

[0015] According to the address pool subnet mask length and the tenant subnet mask in the address pool information, a candidate binary address is selected from the starting binary value address;

[0016] The target binary address is determined according to the candidate binary address, the deviation, and the starting binary address, and the target subnet address corresponding to the target tenant is determined according to the target binary address and the tenant subnet mask.

[0017] The advantage of this setting is that by screening the binary addresses corresponding to the starting address of the address pool, the candidate binary addresses can be accurately determined, and the target subnet address can be further determined based on the candidate binary address, deviation, tenant subnet mask and starting binary address. An implementable method for determining the subnet address is given, which can determine the accurate target subnet address, which is helpful for subsequent subnet allocation to the target tenant and realizes the isolation of tenants in the tenant network.

[0018] Optionally, according to the numbering configuration range, the allocation mode of the virtual private cloud, and the numbering allocation policy, a virtual private cloud number corresponding to the target tenant is determined, including:

[0019] If the allocation mode of the virtual private cloud is automatic allocation, the virtual private cloud number corresponding to the target tenant is determined according to the number configuration range and the number allocation policy.

[0020] The advantage of this setting is that by further determining that the virtual private cloud number corresponding to the target tenant is determined based on the numbering configuration range and the numbering allocation policy only when the allocation mode is automatic allocation, an implementable method for determining the virtual private cloud number under the automatic allocation mode is given, which also helps support the relevant personnel to manually allocate and determine the virtual private cloud number, thereby improving the flexibility of determining the virtual private cloud numbering method.

[0021] Optionally, determine the virtual private cloud number corresponding to the target tenant according to the number configuration range and the number allocation policy, including:

[0022] According to the number allocation strategy, search from the starting point to the end point of the number configuration range, or search from the end point to the starting point of the number configuration range, and determine the unallocated number found as the virtual private cloud number corresponding to the target tenant; or

[0023] According to the number allocation strategy, a random selection is performed within the number configuration range to determine the virtual private cloud number corresponding to the target tenant.

[0024] The advantage of this setting is that by providing search methods from the starting point to the end point, from the end point to the starting point, and random search according to different numbering allocation strategies, the flexibility of determining the virtual private cloud number is improved.

[0025] Optionally, the target subnet address is an IPv4 subnet and / or an IPv6 subnet;

[0026] Accordingly, the subnet address is allocated to the target tenant, including:

[0027] According to a preset allocation strategy, subnet addresses are allocated to target tenants; the allocation strategy is to allocate only IPv4 subnets, allocate only IPv6 subnets, allocate IPv4 subnets first and then IPv6 subnets, allocate IPv6 subnets first and then IPv4 subnets, or allocate both IPv4 subnets and IPv6 subnets at the same time.

[0028] The advantage of this setting is that by further refining the target subnet to include IPv4 subnet and / or IPv6 subnet, different allocation methods can be used when allocating subnets to target tenants based on the subnet content contained in the target subnet, thereby improving the flexibility of subnet allocation and helping to allocate a more preferred subnet type to the target tenant, thereby improving the interaction efficiency of the tenant network.

[0029] Optionally, before determining the VPC ID corresponding to the target tenant, the following steps are also included:

[0030] Determine the number of configurable numbers according to the number configuration range;

[0031] Determine the number of configurable subnets based on the address pool subnet mask length and the tenant subnet mask length, and determine the number of available subnets based on the number of configurable numbers and the number of configurable subnets;

[0032] When the number of available subnets is greater than or equal to the number of target tenants, the virtual private cloud number corresponding to the target tenant is determined according to the number configuration range, the allocation mode of the virtual private cloud, and the number allocation policy.

[0033] The advantage of this setting is that by determining the number of configurable numbers based on the coding setting range and further comparing the number of configurable numbers with the determined number of available subnets, the subnet allocation situation can be evaluated in advance, thereby improving the efficiency of subsequent allocation of virtual private clouds and subnet addresses.

[0034] According to another aspect of the present invention, a tenant isolation management device is provided, comprising:

[0035] A number determination module, configured to respond to an isolation request for a target tenant and determine a virtual private cloud number corresponding to the target tenant according to a number configuration range, a virtual private cloud allocation mode, and a number allocation strategy;

[0036] An address determination module is used to determine a target subnet address corresponding to a target tenant according to a virtual private cloud number, a number configuration range, address pool information, and a tenant subnet mask;

[0037] The allocation module is used to allocate virtual private clouds and subnet addresses to target tenants according to the virtual private cloud numbers and target subnet addresses, so as to perform isolation management of tenants.

[0038] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0039] at least one processor; and

[0040] a memory communicatively connected to the at least one processor; wherein,

[0041] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the tenant isolation management method described in any embodiment of the present invention.

[0042] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the tenant isolation management method described in any embodiment of the present invention when executed.

[0043] The technical solution of the embodiment of the present invention, in response to the isolation request for the target tenant, determines the virtual private cloud number corresponding to the target tenant according to the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy; determines the target subnet address corresponding to the target tenant according to the virtual private cloud number, the number configuration range, the address pool information and the tenant subnet mask; allocates the virtual private cloud and the subnet address to the target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant. The virtual private cloud number that needs to be allocated to the target tenant can be quickly and accurately determined through the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy, and further by establishing an association relationship between the virtual private cloud number and the subnet address, the subnet address corresponding to the virtual private cloud number can be determined, so that the virtual private cloud number and the subnet address can be automatically allocated to each tenant, so as to better realize the isolation management of each tenant.

[0044] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A flowchart of a tenant isolation management method provided in Example 1 of the present invention;

[0047] Figure 2 A flowchart of a tenant isolation management method provided in Embodiment 2 of the present invention;

[0048] Figure 3 A flowchart of a tenant isolation management method provided in Embodiment 3 of the present invention;

[0049] Figure 4 A schematic diagram of the structure of a tenant isolation management device provided in Embodiment 4 of the present invention;

[0050] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0052] It should be noted that the terms "first", "second", "target", "candidate", "alternative", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0053] Embodiment 1

[0054] Figure 1 A flowchart of a tenant isolation management method provided in the first embodiment of the present invention; this embodiment can be applied to responding to an isolation request for a target tenant, determining the target subnet address of a virtual private cloud number and allocating it to the target tenant, and implementing tenant isolation management under the tenant network. The method can be executed by a tenant isolation management device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device, such as a cloud platform. Figure 1 As shown, the tenant isolation management method includes:

[0055] S101. In response to an isolation request for a target tenant, determine a virtual private cloud number corresponding to the target tenant according to a number configuration range, a virtual private cloud allocation mode, and a number allocation policy.

[0056] Among them, the target tenant refers to the tenant who needs to be isolated by a virtual private cloud (VPC) under the tenant network. The number of target tenants can be one or at least two, and the present invention does not limit this. The isolation request refers to a request to allocate different virtual private cloud numbers and subnet addresses to each target tenant for resource allocation to achieve isolation between tenants. The number configuration range refers to the range of virtual private cloud numbers that can be configured. The allocation mode refers to the mode that characterizes the allocation method of the virtual private cloud number, and the allocation mode can be automatic allocation or manual allocation. The number allocation strategy refers to the strategy that characterizes the final virtual private cloud number determined in the number configuration range. The number allocation strategy can be, for example, forward sequential allocation, reverse sequential allocation, and random allocation. The virtual private cloud number (Virtual Private Cloud Identity document, VPC ID) refers to a unique number that can distinguish different tenants' virtual private clouds. The virtual private cloud number can be, for example, a VLAN ID, a VXLAN VNI, or other ID used for network isolation. The virtual private cloud numbers of different target tenants are different.

[0057] Optionally, the cloud platform may receive an isolation instruction for a target tenant issued by relevant personnel, and consider that an isolation request for the target tenant is detected. It may also automatically generate an isolation request for a newly created tenant when it is detected that a new tenant is created in the tenant network.

[0058] Optionally, the corresponding number configuration range can be determined according to the preset isolation mode of the target tenant, where the isolation mode can be VLAN (Virtual Local Area Network), VxLAN (Virtual Extensible Local Area Network), and Geneve (Generic Network Virtualization Encapsulation). For the VLAN isolation mode, the number configuration range can be set to 1-4094, and for the VxLAN and Geneve isolation modes, the number configuration range can be set to 1-16777214.

[0059] Optionally, in response to an isolation request for a target tenant, the cloud platform can obtain pre-configured global configuration information, namely, the numbering configuration range, the allocation mode of the virtual private cloud, and the numbering allocation policy, and further analyze the global configuration information and, based on the allocation mode and numbering allocation policy of the virtual private cloud, allocate a unique virtual private cloud number to each target tenant within the numbering configuration range.

[0060] Optionally, the virtual private cloud number corresponding to the target tenant is determined based on the number configuration range, the allocation mode of the virtual private cloud and the number allocation policy, including: if the allocation mode of the virtual private cloud is automatic allocation, the virtual private cloud number corresponding to the target tenant is determined based on the number configuration range and the number allocation policy.

[0061] Optionally, if the allocation mode of the virtual private cloud is manual allocation, the virtual private cloud number manually input by the relevant personnel after customization can be directly obtained, that is, the virtual private cloud number corresponding to the target tenant can be determined.

[0062] Optionally, after obtaining the virtual private cloud number manually entered by the relevant personnel after customization, it is also possible to determine whether the manually entered virtual private cloud number is within the number configuration range. If so, the number is determined to be the virtual private cloud number corresponding to the target tenant. If not, the relevant personnel is prompted to re-enter the number.

[0063] The advantage of this setting is that by further determining that the virtual private cloud number corresponding to the target tenant is determined based on the numbering configuration range and the numbering allocation policy only when the allocation mode is automatic allocation, an implementable method for determining the virtual private cloud number under the automatic allocation mode is given, which also helps support the relevant personnel to manually allocate and determine the virtual private cloud number, thereby improving the flexibility of determining the virtual private cloud numbering method.

[0064] Optionally, the virtual private cloud number corresponding to the target tenant is determined based on the numbering configuration range and the numbering allocation policy, including: searching from the starting point corresponding to the numbering configuration range to the end point according to the numbering allocation policy, or searching from the end point corresponding to the numbering configuration range to the starting point, and determining the unassigned number obtained by the search as the virtual private cloud number corresponding to the target tenant; or randomly selecting within the numbering configuration range according to the numbering allocation policy to determine the virtual private cloud number corresponding to the target tenant.

[0065] For example, if the numbering configuration range is 1001-4000 and the numbering allocation strategy is forward sequential allocation, then starting from the starting point 1001, the VPC ID determined for the first target tenant is 1001, the VPC ID determined for the second target tenant is 1002, the VPC ID determined for the third target tenant is 1003, and so on; similarly, if the numbering configuration range is 1001-4000 and the numbering allocation strategy is reverse sequential allocation, the VPC ID determined for the first target tenant is 4000, the VPC ID determined for the second target tenant is 3999, the VPC ID determined for the third target tenant is 3998, and so on; if the numbering configuration range is 1001-4000 and the numbering allocation strategy is random allocation, the VPC ID determined for the first target tenant may be 2001, and the VPC ID determined for the second target tenant may be 3098.

[0066] The advantage of this setting is that by providing search methods from the starting point to the end point, from the end point to the starting point, and random search according to different numbering allocation strategies, the flexibility of determining the virtual private cloud number is improved.

[0067] S102: Determine a target subnet address corresponding to a target tenant according to the virtual private cloud number, the number configuration range, the address pool information, and the tenant subnet mask.

[0068] The address pool may contain at least two candidate subnet addresses, and the address pool information refers to the relevant information of the subnet addresses in the address pool, for example, the address pool information may include the starting address of the address pool and the subnet mask of the address pool. The target subnet address refers to the subnet address allocated to the target tenant, and the target subnet address may be an IPv4 subnet and / or an IPv6 subnet.

[0069] Optionally, the association between the virtual private cloud number and the number configuration range can be determined, and further based on preset rules, according to the association and the tenant subnet mask, a screening operation and a combination operation based on the tenant subnet mask are performed from the candidate subnet addresses in the address pool to obtain the target subnet address corresponding to the target tenant.

[0070] Optionally, after determining the target subnet address corresponding to the target tenant, the target gateway address corresponding to the target subnet address can be determined based on the relationship between the subnet address and the gateway address. When performing the subsequent 103 operation, the target gateway address and the target subnet address are configured together to the physical network device corresponding to the target tenant, so that the virtual machine of the target tenant can be allocated an IP (Internet Protocol) based on the target gateway address.

[0071] S103. Allocate a virtual private cloud and a subnet address to the target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant.

[0072] The allocation of a virtual private cloud refers to configuring the virtual private cloud number corresponding to the target tenant on the physical network device corresponding to the target tenant. The allocation of a subnet address refers to configuring the target subnet address corresponding to the target tenant on the physical network device corresponding to the target tenant.

[0073] Optionally, for the target tenant, the corresponding virtual private cloud number and target subnet address can be configured on the corresponding physical network device at the same time. When the cloud platform subsequently interacts with each target tenant, such as allocating resources to the target tenant, resources can be allocated based on the target tenant's independent virtual private cloud number and target subnet address, thereby realizing the cloud platform's isolated management of each tenant.

[0074] Optionally, the target subnet address is an IPv4 subnet and / or an IPv6 subnet; accordingly, the subnet address is allocated to the target tenant, including: allocating the subnet address to the target tenant according to a preset allocation strategy; the allocation strategy is allocating only IPv4 subnets, allocating only IPv6 subnets, allocating IPv4 subnets first and then IPv6 subnets, allocating IPv6 subnets first and then IPv4 subnets, or allocating IPv4 subnets and IPv6 subnets at the same time.

[0075] Among them, IPv4 (Internet Protocol version 4) subnets use Classless Inter-Domain Routing (CIDR) to allocate prefixes (subnets) of arbitrary length based on variable length subnet masks (VLSM). IPv4 subnet addresses are equivalent to IPv4 subnet prefixes. IPv6 subnet prefixes are declared using CIDR notation similar to IPv4 subnet addresses. IPv6 subnet prefixes are equivalent to: IPv6 prefix, IPv6 subnet address.

[0076] Optionally, after determining the target subnet, an allocation strategy for subnet address allocation to the target tenant may be determined according to the subnet type supported by the target tenant and a preset subnet allocation order to perform subnet address allocation.

[0077] The advantage of this setting is that by further refining the target subnet to include IPv4 subnet and / or IPv6 subnet, different allocation methods can be used when allocating subnets to target tenants based on the subnet content contained in the target subnet, thereby improving the flexibility of subnet allocation and helping to allocate a more preferred subnet type to the target tenant, thereby improving the interaction efficiency of the tenant network.

[0078] It should be noted that in the tenant network, the cloud platform manages multiple tenants, and it is necessary to allocate corresponding virtual private clouds, subnet addresses and gateway addresses to each tenant to achieve isolated management of tenants. However, in the related technology, it is often necessary to manually configure the corresponding VPC ID and the corresponding IPv4 gateway address and IPv6 routing address on the physical network device to open up the entire VPC network. The allocation efficiency and accuracy are low, and it causes waste of manpower. The technical solution of the present invention can avoid the manual configuration process, improve configuration efficiency, and reduce the probability of errors.

[0079] The technical solution of the embodiment of the present invention, in response to the isolation request for the target tenant, determines the virtual private cloud number corresponding to the target tenant according to the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy; determines the target subnet address corresponding to the target tenant according to the virtual private cloud number, the number configuration range, the address pool information and the tenant subnet mask; allocates the virtual private cloud and the subnet address to the target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant. The virtual private cloud number that needs to be allocated to the target tenant can be quickly and accurately determined through the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy, and further by establishing an association relationship between the virtual private cloud number and the subnet address, the subnet address corresponding to the virtual private cloud number can be determined, so that the virtual private cloud number and the subnet address can be automatically allocated to each tenant, so as to better realize the isolation management of each tenant.

[0080] Optionally, before determining the virtual private cloud number and target subnet address respectively, the currently allocatable virtual private cloud number and target subnet address can be analyzed according to the number of target tenants to determine whether the allocation conditions are met, thereby executing the subsequent process of determining the virtual private cloud number and target subnet address and allocating them while ensuring that they can be allocated.

[0081] Specifically, before determining the virtual private cloud number corresponding to the target tenant, it also includes: determining the number of configurable numbers based on the number configuration range; determining the number of configurable subnets based on the address pool subnet mask length and the tenant subnet mask length, and determining the number of available subnets based on the number of configurable numbers and the number of configurable subnets; when the number of available subnets is greater than or equal to the number of target tenants, determining the virtual private cloud number corresponding to the target tenant based on the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy.

[0082] The number of configurable numbers refers to the number of candidate virtual private cloud numbers that can be allocated, that is, the number of VPC IDs. The number of configurable subnets can include the number of allocable subnets of the IPv4 category and the number of allocable subnets of the IPv6 category.

[0083] Optionally, the starting point and the ending point of the number configuration range may be determined, and the difference between the starting point and the ending point may be further determined. Finally, the value obtained by adding one to the difference may be determined as the number of configurable numbers.

[0084] Optionally, the smaller value between the number of configurable numbers and the number of configurable subnets may be determined as the final number of available subnets, that is, the number of available subnets is determined according to the number of configurable numbers and the number of configurable subnets.

[0085] It should be noted that if the number of available subnets is greater than or equal to the number of target tenants, it can be preliminarily considered that there are currently sufficient alternative virtual private cloud numbers and target subnet addresses that can be used to allocate to the target tenants. At this time, further determining the virtual private cloud numbers and target subnet addresses and allocating them can effectively improve efficiency.

[0086] The advantage of this setting is that by determining the number of configurable numbers based on the coding setting range and further comparing the number of configurable numbers with the determined number of available subnets, the subnet allocation situation can be evaluated in advance, thereby improving the efficiency of subsequent allocation of virtual private clouds and subnet addresses.

[0087] Embodiment 2

[0088] Figure 2 A flowchart of a tenant isolation management method provided in Example 2 of the present invention; this embodiment is optimized and improved on the basis of the above-mentioned technical solutions.

[0089] Further, "determine the target subnet address corresponding to the target tenant based on the virtual private cloud number, number configuration range, address pool information and tenant subnet mask" is refined into "determine the numbering starting point based on the numbering configuration range, and determine the deviation between the numbering starting point and the virtual private cloud number; determine the target subnet address corresponding to the target tenant based on the deviation, address pool information and tenant subnet mask" to improve the method of determining the target subnet address.

[0090] Further, "determine the target subnet address corresponding to the target tenant based on the deviation, address pool information and tenant subnet mask" is refined into "binary expansion of the address pool starting address in the address pool information to determine the starting binary address corresponding to the address pool starting address; filter out candidate binary addresses from the starting binary value address based on the address pool subnet mask length and the tenant subnet mask in the address pool information; determine the target binary address based on the candidate binary address, deviation and starting binary address, and determine the target subnet address corresponding to the target tenant based on the target binary address and the tenant subnet mask" to improve the method of determining the target subnet address based on the deviation, address pool information and tenant subnet mask.

[0091] like Figure 2 As shown, the method comprises the following specific steps:

[0092] S201. In response to an isolation request for a target tenant, determine a virtual private cloud number corresponding to the target tenant according to a number configuration range, a virtual private cloud allocation mode, and a number allocation policy.

[0093] S202: Determine a numbering starting point according to a numbering configuration range, and determine a deviation between the numbering starting point and the virtual private cloud number.

[0094] The deviation refers to the difference between the starting point of the number configuration range and the virtual private cloud number.

[0095] Exemplarily, if the numbering configuration range is 1000-2000, the numbering starting point can be determined to be 1000. Further, if the virtual private cloud is numbered 1001, the deviation can be determined to be 1.

[0096] S203: Determine the target subnet address corresponding to the target tenant according to the deviation, the address pool information and the tenant subnet mask.

[0097] Optionally, the target subnet address corresponding to the target tenant is determined based on the deviation, address pool information and tenant subnet mask, including: binary expansion of the address pool starting address in the address pool information to determine the starting binary address corresponding to the address pool starting address; screening out candidate binary addresses from the starting binary value address based on the address pool subnet mask length and the tenant subnet mask in the address pool information; determining the target binary address based on the candidate binary addresses, deviation and starting binary address, and determining the target subnet address corresponding to the target tenant based on the target binary address and the tenant subnet mask.

[0098] Among them, the candidate binary address refers to the corresponding binary address in the target location area in the starting binary value address. The target location area can use the address pool subnet mask length plus one corresponding binary bit as the start bit and the binary bit corresponding to the tenant subnet mask as the end bit.

[0099] Exemplarily, for the case where the target subnet address is an IPv4 subnet, when the number configuration range is 1000-2000, the virtual private cloud number is 1001, and the deviation is 1, if the address pool starting address is 172.16.0.0 / 12, it is binary expanded, and the corresponding starting binary address can be obtained as 10101100 00010000 00000000 00000000. Further, according to the address pool subnet mask length 12 and the tenant subnet mask 24, it can be determined that the candidate binary address is 10101100 0001 0000 0000000000000000, further, adding the deviation 1 and the candidate binary address of the crossed-out area, we can get 0000 00000001 , combine the binary address obtained by addition with the binary code of other positions in the starting binary address except the target position area, and you can get the target binary address 101011000001 0000 00000001 00000000, further, the target binary address is converted into decimal representation, that is, 172.16.1.0, and recently the decimal representation of the target binary address and the tenant subnet mask 24 are combined to obtain the final target subnet address 172.16.1.0 / 24.

[0100] For example, for the case where the target subnet address is an IPv6 subnet, if the number configuration range is 1000-2000, the virtual private cloud number is 1031, the deviation D is 31 (hexadecimal 0x1f), and the address pool starting address is 2001:db8:abcd:: / 52, the starting address is expanded (bits 65-128 are not fully expanded) to: 2001:db8:abcd:0 00 0:0:0:0:0. Further, according to the address pool subnet mask length 52 and the tenant subnet mask 60, we can take the underlined part of the expanded address (that is, binary 52+1~60 bits), add it to the deviation D, which is 31, in hexadecimal, and get 2001:db8:abcd:01f0:0:0:0:0. Then combine it with the tenant prefix length, that is, the tenant subnet mask 60, to get the final target subnet address: 2001:db8:abcd:01f0:0:0:0:0 / 60, which can also be recorded as 2001:db8:abcd:1f0:: / 60.

[0101] The advantage of this setting is that by screening the binary addresses corresponding to the starting address of the address pool, the candidate binary addresses can be accurately determined, and the target subnet address can be further determined based on the candidate binary address, deviation, tenant subnet mask and starting binary address. An implementable method for determining the subnet address is given, which can determine the accurate target subnet address, which is helpful for subsequent subnet allocation to the target tenant and realizes the isolation of tenants in the tenant network.

[0102] S204: Allocate a virtual private cloud and a subnet address to the target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant.

[0103] The technical solution of the present invention establishes a connection between the virtual private cloud number and the subnet address by determining the deviation between the starting point of the number configuration range and the virtual private cloud number, and provides an implementable method for determining the subnet address corresponding to the target tenant, which is helpful for subsequent subnet allocation to the target tenant and realizes the isolation of tenants in the tenant network.

[0104] Embodiment 3

[0105] Figure 3 This is a flowchart of a tenant isolation management method provided in Embodiment 3 of the present invention; this embodiment provides a preferred example based on the above embodiments.

[0106] like Figure 3 As shown, the method comprises the following specific steps:

[0107] S301: In response to an isolation request for a target tenant, determine the number of configurable numbers according to a number configuration range.

[0108] S302: Determine the number of configurable subnets according to the address pool subnet mask length and the tenant subnet mask length, and determine the number of available subnets according to the number of configurable numbers and the number of configurable subnets.

[0109] S303: When the number of available subnets is greater than or equal to the number of target tenants, if the allocation mode of the virtual private cloud is automatic allocation, determine the virtual private cloud number corresponding to the target tenant according to the number configuration range and the number allocation policy.

[0110] S304: Determine a numbering starting point according to the numbering configuration range, and determine a deviation between the numbering starting point and the virtual private cloud number.

[0111] S305: Perform binary expansion on the address pool start address in the address pool information to determine a start binary address corresponding to the address pool start address.

[0112] S306: Filter out candidate binary addresses from the starting binary value address according to the address pool subnet mask length and the tenant subnet mask in the address pool information.

[0113] S307. Determine the target binary address according to the candidate binary address, the deviation, and the starting binary address, and determine the target subnet address corresponding to the target tenant according to the target binary address and the tenant subnet mask.

[0114] S308. Allocate a virtual private cloud and a subnet address to the target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant.

[0115] Embodiment 4

[0116] Figure 4 A schematic diagram of the structure of a tenant isolation management device provided in the fourth embodiment of the present invention; the tenant isolation management device provided in the embodiment of the present invention can be used to respond to the isolation request of the target tenant, determine the target subnet address of the virtual private cloud number and allocate it to the target tenant, and implement the tenant isolation management under the tenant network. The tenant isolation management device can be implemented in the form of hardware and / or software, and the tenant isolation management device can be configured in an electronic device, such as a cloud platform. Figure 4 As shown, the device specifically includes: a number determination module 401, an address determination module 402 and an allocation module 403.

[0117] The number determination module 401 is used to determine the virtual private cloud number corresponding to the target tenant according to the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy in response to the isolation request for the target tenant;

[0118] An address determination module 402 is used to determine a target subnet address corresponding to a target tenant according to the virtual private cloud number, the number configuration range, the address pool information and the tenant subnet mask;

[0119] The allocation module 403 is used to allocate a virtual private cloud and a subnet address to a target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant.

[0120] The technical solution of the embodiment of the present invention, in response to the isolation request for the target tenant, determines the virtual private cloud number corresponding to the target tenant according to the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy; determines the target subnet address corresponding to the target tenant according to the virtual private cloud number, the number configuration range, the address pool information and the tenant subnet mask; allocates the virtual private cloud and the subnet address to the target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant. The virtual private cloud number that needs to be allocated to the target tenant can be quickly and accurately determined through the number configuration range, the allocation mode of the virtual private cloud and the number allocation strategy, and further by establishing an association relationship between the virtual private cloud number and the subnet address, the subnet address corresponding to the virtual private cloud number can be determined, so that the virtual private cloud number and the subnet address can be automatically allocated to each tenant, so as to better manage the isolation of each tenant.

[0121] Further, the address determination module 402 may include:

[0122] A deviation determination unit, used to determine a numbering starting point according to a numbering configuration range, and to determine a deviation between the numbering starting point and the virtual private cloud number;

[0123] The address determination unit is used to determine the target subnet address corresponding to the target tenant according to the deviation, the address pool information and the tenant subnet mask.

[0124] Furthermore, the address determination unit is specifically used for:

[0125] Perform binary expansion on the address pool start address in the address pool information to determine the start binary address corresponding to the address pool start address;

[0126] According to the address pool subnet mask length and the tenant subnet mask in the address pool information, a candidate binary address is selected from the starting binary value address;

[0127] The target binary address is determined according to the candidate binary address, the deviation, and the starting binary address, and the target subnet address corresponding to the target tenant is determined according to the target binary address and the tenant subnet mask.

[0128] Furthermore, the serial number determination module 401 may include:

[0129] Number determination unit: used to determine the virtual private cloud number corresponding to the target tenant according to the number configuration range and number allocation policy if the allocation mode of the virtual private cloud is automatic allocation.

[0130] Furthermore, the number determination unit is specifically used for:

[0131] According to the number allocation strategy, search from the starting point to the end point of the number configuration range, or search from the end point to the starting point of the number configuration range, and determine the unallocated number found as the virtual private cloud number corresponding to the target tenant; or

[0132] According to the number allocation strategy, a random selection is performed within the number configuration range to determine the virtual private cloud number corresponding to the target tenant.

[0133] Further, the target subnet address is an IPv4 subnet and / or an IPv6 subnet; accordingly, the allocation module 403 is specifically used to:

[0134] According to a preset allocation strategy, subnet addresses are allocated to target tenants; the allocation strategy is to allocate only IPv4 subnets, allocate only IPv6 subnets, allocate IPv4 subnets first and then IPv6 subnets, allocate IPv6 subnets first and then IPv4 subnets, or allocate both IPv4 subnets and IPv6 subnets at the same time.

[0135] Furthermore, the above device is also used for:

[0136] Determine the number of configurable numbers according to the number configuration range;

[0137] Determine the number of configurable subnets based on the address pool subnet mask length and the tenant subnet mask length, and determine the number of available subnets based on the number of configurable numbers and the number of configurable subnets;

[0138] When the number of available subnets is greater than or equal to the number of target tenants, the virtual private cloud number corresponding to the target tenant is determined according to the number configuration range, the allocation mode of the virtual private cloud, and the number allocation policy.

[0139] Embodiment 5

[0140] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 5 of the present invention. Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0141] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0142] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0143] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the tenant isolation management method.

[0144] In some embodiments, the tenant isolation management method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the tenant isolation management method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the tenant isolation management method in any other appropriate manner (e.g., by means of firmware).

[0145] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0147] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0150] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0151] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0152] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A tenant isolation management method, characterized in that: The method comprises: In response to an isolation request for a target tenant, determine a virtual private cloud number corresponding to the target tenant according to a number configuration range, a virtual private cloud allocation mode, and a number allocation policy; wherein the virtual private cloud number is a unique number for distinguishing virtual private clouds of different tenants; Determine the target subnet address corresponding to the target tenant according to the virtual private cloud number, number configuration range, address pool information and tenant subnet mask; wherein there is an association relationship between the target subnet address and the virtual private cloud number; According to the virtual private cloud number and target subnet address, the virtual private cloud and subnet address are allocated to the target tenant to perform isolation management of the tenant; The step of determining the target subnet address corresponding to the target tenant according to the virtual private cloud number, the number configuration range, the address pool information, and the tenant subnet mask includes: Determine the starting point of numbering according to the numbering configuration range, and determine the deviation between the starting point of numbering and the virtual private cloud numbering; Determine the target subnet address corresponding to the target tenant according to the deviation, address pool information and tenant subnet mask; Before determining the VPC ID corresponding to the target tenant, the following steps are also required: Determine the number of configurable numbers according to the number configuration range; wherein the number of configurable numbers is the number of candidate virtual private cloud numbers that can be allocated; Determine the number of configurable subnets based on the address pool subnet mask length and the tenant subnet mask length, and determine the number of available subnets based on the number of configurable numbers and the number of configurable subnets; When the number of available subnets is greater than or equal to the number of target tenants, the virtual private cloud number corresponding to the target tenant is determined according to the number configuration range, the allocation mode of the virtual private cloud, and the number allocation policy.

2. The method according to claim 1, characterized in that Determine the target subnet address corresponding to the target tenant according to the deviation, the address pool information and the tenant subnet mask, including: Perform binary expansion on the address pool start address in the address pool information to determine the start binary address corresponding to the address pool start address; According to the address pool subnet mask length and the tenant subnet mask in the address pool information, a candidate binary address is selected from the starting binary value address; The target binary address is determined according to the candidate binary address, the deviation, and the starting binary address, and the target subnet address corresponding to the target tenant is determined according to the target binary address and the tenant subnet mask.

3. The method according to claim 1, characterized in that: Determine the VPC number corresponding to the target tenant based on the number configuration range, VPC allocation mode, and number allocation policy, including: If the allocation mode of the virtual private cloud is automatic allocation, the virtual private cloud number corresponding to the target tenant is determined according to the number configuration range and the number allocation policy.

4. The method according to claim 3, characterized in that Determine the VPC number corresponding to the target tenant based on the number configuration range and number allocation policy, including: According to the number allocation strategy, search from the starting point to the end point of the number configuration range, or search from the end point to the starting point of the number configuration range, and determine the unallocated number found as the virtual private cloud number corresponding to the target tenant; or According to the number allocation strategy, a random selection is performed within the number configuration range to determine the virtual private cloud number corresponding to the target tenant.

5. The method according to claim 1, characterized in that in, The target subnet address is an IPv4 subnet and / or an IPv6 subnet; Accordingly, the subnet address is allocated to the target tenant, including: Allocate subnet addresses to target tenants according to the preset allocation strategy; The allocation strategy is to allocate only IPv4 subnets, allocate only IPv6 subnets, allocate IPv4 subnets first and then IPv6 subnets, allocate IPv6 subnets first and then IPv4 subnets, or allocate IPv4 subnets and IPv6 subnets at the same time.

6. A tenant isolation management device, characterized in that: include: A number determination module, configured to respond to an isolation request for a target tenant and determine a virtual private cloud number corresponding to the target tenant according to a number configuration range, a virtual private cloud allocation mode, and a number allocation strategy; wherein the virtual private cloud number is a unique number for distinguishing virtual private clouds of different tenants; An address determination module is used to determine a target subnet address corresponding to a target tenant according to a virtual private cloud number, a number configuration range, address pool information, and a tenant subnet mask; wherein there is an association relationship between the target subnet address and the virtual private cloud number; An allocation module, used to allocate a virtual private cloud and a subnet address to a target tenant according to the virtual private cloud number and the target subnet address, so as to perform isolation management of the tenant; The address determination module comprises: A deviation determination unit, used to determine a numbering starting point according to a numbering configuration range, and to determine a deviation between the numbering starting point and the virtual private cloud number; An address determination unit, configured to determine a target subnet address corresponding to a target tenant according to the deviation, the address pool information and the tenant subnet mask; The device is also used for: Determine the number of configurable numbers according to the number configuration range; wherein the number of configurable numbers is the number of candidate virtual private cloud numbers that can be allocated; Determine the number of configurable subnets based on the address pool subnet mask length and the tenant subnet mask length, and determine the number of available subnets based on the number of configurable numbers and the number of configurable subnets; When the number of available subnets is greater than or equal to the number of target tenants, the virtual private cloud number corresponding to the target tenant is determined according to the number configuration range, the allocation mode of the virtual private cloud, and the number allocation policy.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the tenant isolation management method described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the tenant isolation management method described in any one of claims 1-5 when executed.

Images