A network communication control method, readable storage medium, device and product

Abstract

The present specification provides a network communication management and control method, a readable storage medium, a device and a product, which are applied to a gateway system, wherein the gateway system has established a basic channel with a target environment in advance, and the target environment is deployed in an internal network; the method comprises: receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information; when it is determined according to the authentication information that the access terminal has passed the authentication, allocating target gateway access information corresponding to the target environment to the access terminal, and granting access rights to the target gateway access information to the source IP address of the access request; and forwarding the data request to the target environment via the basic channel corresponding to the target environment.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of communication technology, and in particular, to a method, readable storage medium, device, and product for managing and controlling network communications. Background Art

[0002] In existing network communication systems, when a device needs to access a certain environment across the network to access its network resources, it is necessary to control the identity and permissions of the access point to ensure that only authorized users can access the corresponding environment, thereby improving the data security of network resources.

[0003] In the related art, access control between the access terminal and the environment is usually achieved based on the method of superimposing additional network protocols. However, this method requires that the corresponding client be installed in the access terminal to realize the superimposition of the network protocol. In other words, once the access terminal refuses any form of superimposition or intrusion into the network protocol, or even does not allow the installation of the client, the ability to control the access terminal when it accesses the environment will be lost. Summary of the invention

[0004] In view of this, one or more embodiments of this specification provide the following technical solutions:

[0005] According to a first aspect of one or more embodiments of this specification, a network communication management and control method is proposed, which is applied to a gateway system, wherein the gateway system has established a basic channel with a target environment in advance, and the target environment is deployed in an internal network; the method includes:

[0006] Receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information;

[0007] In the case where it is determined according to the authentication information that the access terminal has passed the authentication, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information;

[0008] In response to receiving a data request, upon confirming that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, the data request is forwarded to the target environment via a basic channel corresponding to the target environment.

[0009] According to a second aspect of one or more embodiments of the present specification, a network communication control method is proposed, which is applied to a management service deployed by a gateway system, wherein the gateway system is also deployed with an agent service, wherein the gateway system has established a basic channel with a target environment in advance, and the target environment is deployed in an internal network; the method comprises:

[0010] Receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information;

[0011] When it is determined that the access terminal has passed the authentication based on the authentication information, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information, so that the proxy service, in response to receiving the data request, forwards the data request to the target environment through the basic channel corresponding to the target environment when it is confirmed that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information.

[0012] According to a third aspect of one or more embodiments of the present specification, a network communication management and control method is proposed, which is applied to a proxy service deployed by a gateway system, and the gateway system is also deployed with a management service, the management service is used to receive an access request initiated by an access terminal from an external network to a target environment, and when it is determined that the access terminal has passed the authentication according to the authentication information contained in the access request, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information; the gateway system has established a basic channel with the target environment in advance, and the target environment is deployed in an internal network; the method includes:

[0013] A data request is received;

[0014] When it is confirmed that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, the data request is forwarded to the target environment via a basic channel corresponding to the target environment.

[0015] According to a fourth aspect of one or more embodiments of this specification, a network communication control method for a private cloud environment is proposed, which is applied to a gateway system, wherein the gateway system has established a basic channel with the target private cloud environment in advance; the method includes:

[0016] Receiving an access request initiated by an access terminal for the target private cloud environment, wherein the access request includes authentication information;

[0017] In the case where it is determined according to the authentication information that the access terminal has passed the authentication, target gateway access information corresponding to the target private cloud environment is allocated to the access terminal, and access rights to the target gateway access information are granted to the source IP address of the access request;

[0018] In response to receiving a data request, upon confirming that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, the data request is forwarded to the target private cloud environment via a basic channel corresponding to the target private cloud environment.

[0019] According to the fifth aspect of one or more embodiments of the present specification, an electronic device is proposed, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any method described in the first to fourth aspects are implemented.

[0020] According to a sixth aspect of one or more embodiments of the present specification, a computer program product is proposed, comprising a computer program / instruction, which, when executed by a processor, implements the steps of any method described in the first to fourth aspects.

[0021] As can be seen from the above embodiments, the present specification can first receive the access request initiated by the access terminal for the target environment through the gateway system, and authenticate the access terminal according to the authentication information in the request. When the access terminal passes the authentication, the identity of the access terminal will be credible, and the gateway system can then allocate the target gateway access information corresponding to the above target environment to the access terminal, and grant the access right to the target gateway access information to the source IP address of the access request; and, the gateway system can respond to the receipt of the data request, and when it is confirmed that the above data request contains the above target gateway access information and the source IP address of the above data request is granted the access right to the above target gateway access information, the gateway system can securely forward the above data request to the target environment through the basic channel corresponding to the above target environment. Among them, since the authentication process is implemented based on the authentication information carried by the access request itself, and the access right is granted by the gateway system for the source IP of the access request, the authentication and access right control processes do not need to involve any network protocol intrusion or superposition, and the access terminal can cooperate to implement the above authentication and access processes even if the client is not installed. In other words, without superimposing or intruding on the network protocol, the gateway system can take into account the effective authentication and access control of the access terminal without the client installed, ensuring that the access terminal can safely and smoothly achieve network communication with the target environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the architecture of a network communication management and control system shown in an exemplary embodiment;

[0023] Figure 2 is a flow chart of a method for controlling network communications provided by an exemplary embodiment;

[0024] Figure 3 It is a schematic diagram of a network communication between an access terminal and a target environment provided by an exemplary embodiment;

[0025] Figure 4 It is a schematic diagram of an environment channel adding process and an access terminal communication process provided by an exemplary embodiment;

[0026] Figure 5 is a flow chart of another network communication management and control method provided by an exemplary embodiment;

[0027] Figure 6 is a flow chart of another method for controlling network communications provided by an exemplary embodiment;

[0028] Figure 7 It is a flow chart of a network communication control method for a private cloud environment provided by an exemplary embodiment;

[0029] Figure 8 is a schematic structural diagram of an electronic device provided by an exemplary embodiment;

[0030] Fig. 9 is a schematic diagram of a network communication control device provided by an exemplary embodiment;

[0031] Fig.10 is a schematic diagram of another network communication control device provided by an exemplary embodiment;

[0032] Fig.11 is a schematic diagram of another network communication control device provided by an exemplary embodiment;

[0033] Fig.12 It is a schematic diagram of a network communication control device for a private cloud environment provided by an exemplary embodiment. DETAILED DESCRIPTION

[0034] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] In related technologies, a computing cluster consisting of a series of physical servers or virtual servers in the same network can be called an environment, where the environment can include hardware infrastructure, software configuration, network settings, and all resources required to run a specific application or service. In other words, the above environment can provide the required computing power, storage space, and network connection for the deployment, testing, and operation of applications. Then, the program technology team can carry out targeted design, development, testing, and maintenance operations for the same or different applications in multiple environments according to actual needs, without worrying about affecting other environments.

[0036] Of course, even in the same network, each environment can provide different access addresses to meet environmental requirements such as load balancing, high availability, and service separation, and can also provide multiple access capabilities such as Secure Shell (SSH, or secure remote login protocol) and Web Proxy. Among them, the access addresses of different environments can be implemented using corresponding basic channels. For example, in an offline physical environment composed of physical servers, a logical basic channel can be established based on the Virtual IP Address (VIP) technology to achieve data exchange between different networks; for example, in a cloud computing scenario based on a cloud environment composed of virtual servers, static IP addresses can be dynamically allocated to cloud resources based on the Elastic IP Address (EIP) technology, thereby providing a stable basic channel. Even if the physical location of the cloud resources changes, the corresponding EIP can remain unchanged. Among them, the above-mentioned basic channel can be understood as the basic channel for transmitting data in network communication. In other words, the process of the access end accessing the corresponding environment through the access address provided by the environment is essentially to transmit data with the above-mentioned environment through the basic channel corresponding to the access address.

[0037] On the one hand, for each environment, it is necessary to control the identity of the access terminal that is allowed to access and the basic channel that the identity can use, so as to ensure that only authorized users can safely access the network resources in the environment through the corresponding basic channel. On the other hand, for users who need to access the environment, the network environment in which the access terminal they use is often complex and changeable and difficult to predict. For example, the above-mentioned access terminal may be an office personal computer (Personal Computer, PC) based on a dynamic IP address, or it may be a fixed server based on a static IP address within a company or enterprise, resulting in different access terminals also needing to have the ability to access the same environment.

[0038] In order to meet the above requirements, in network communication structures such as Open System Interconnect (OSI) or Transmission Control Protocol / Internet Protocol (TCP / IP), a protocol layer can be added to the basic network communication protocol to achieve unified access control between the access end and the environment. Taking Virtual Private Network (VPN) technology as an example, Secure Sockets Layer or Transport Layer Security (SSL / TLS) can be added to the OSI transport layer to achieve authentication of the access end, that is, authentication and authorization. At the same time, Internet Protocol Security (IPSec) can be added to the OSI network layer to encapsulate IP data packets, thereby ensuring that an encrypted tunnel can be created between any access end and the environment, and facilitating secure data transmission on public networks such as the Internet. In addition, additional control signaling can also be added to network protocols at different levels to achieve authentication of the above identities.

[0039] However, the defect of the above method is that the superposition or intrusion operation of the network protocol needs to rely on a specific client in the access end to be implemented. If the access end cannot install the corresponding client due to equipment limitations or human regulations, then the access end will not be able to achieve the superposition of the above network protocol, resulting in the gateway system being unable to effectively control the access and access of the access end to the environment.

[0040] To solve the above problems, this manual introduces a network communication control method, and the technical solution is as follows:

[0041] Figure 1 FIG. 1 is a schematic diagram of the architecture of a network communication management and control system provided by an exemplary embodiment. Figure 1 As shown, the system may include an access terminal 11, a gateway system 12, and a target environment 13.

[0042] The access terminal 11 may be a PC 11a or a mobile phone 11b. Of course, PC 11a and mobile phone 11b are only some types of electronic devices that users can use. Users can obviously also use electronic devices such as tablet devices, laptops, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smart watches, etc.), etc. One or more embodiments of this specification do not limit this. The access terminal 11 may also be a server 11c. For example, the server 11c may be a physical server including an independent host, or a virtual server carried by a host cluster. During operation, the access terminal 11 may not install or run client-side programs related to the network communication control application, or may install and run client-side programs related to the network communication control application, and both may cooperate to implement the technical solution of this specification.

[0043] The gateway system 12 is used to connect different networks between the access terminal 11 and the target environment 13, and forward data between these networks. During operation, the gateway system 12 can establish a basic channel with the target environment on the one hand, and can authenticate the access terminal 11 and grant access rights to its source IP address on the other hand, and forward the subsequent data requests initiated by the access terminal 11 to the target environment through the corresponding basic channel.

[0044] The target environment 13 may be a computing cluster composed of physical servers or virtual servers, and each target environment may simultaneously establish one or more basic channels with the gateway system 12. Taking the target environment 13a as an example, its corresponding physical server may establish two basic channels based on the same virtual IP address and different ports with the gateway system 12. During operation, the target environments 13a to 13c are used to provide pre-configured services, such as query services, storage services, etc., which are not limited in this specification.

[0045] It should be noted that the different networks in this specification specifically refer to different network domains, that is, independent network areas with different network configurations and / or management permissions in a computer network, where each network domain has its own network policy, security settings, IP address allocation, and resource access permissions. Among them, it can be considered that the access terminal 11 is in the external network, and the target environment 13 is deployed in the internal network. Of course, the so-called external and internal are only used to illustrate that the networks to which the two belong are different, and are not used to limit the corresponding network types or network structures.

[0046] Figure 2This is a flow chart of a network communication control method shown in an exemplary embodiment of this specification. The method is applied to a gateway system. The gateway system has a basic channel established with a target environment in advance. The target environment is deployed in an internal network. Specifically, the following steps are included:

[0047] Step S202: receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information.

[0048] When a user needs to access the network resources of the target environment, an access request for the target environment can be created through an access terminal in the external network and sent to the gateway system, so that the gateway system can determine that the access terminal needs to access the target environment. Among them, the access request can carry information such as the unique identifier of the target environment, so that the gateway system can determine that the environment that the access terminal needs to access is the above-mentioned target environment, and then provide the target gateway access information below in a targeted manner. In addition, the access request also includes the above-mentioned authentication information, thereby proving to the gateway system that the user or the access terminal used by it has the authority to access the target environment. As for the specific content of the authentication information, it will be discussed separately below and will not be repeated here.

[0049] Step S204, when it is determined that the access terminal has passed the authentication according to the authentication information, target gateway access information corresponding to the target environment is allocated to the access terminal, and access rights to the target gateway access information are granted to the source IP address of the access request.

[0050] The gateway system can implement access control on the access terminal based on whether the access terminal has passed authentication. When the gateway system determines that the access terminal has passed authentication based on the authentication information, the target gateway access information corresponding to the above-mentioned target environment can be allocated to the access terminal, and the access right for the target gateway access information can be granted to the source IP address of the access request, so that the access terminal can access the gateway system based on the target gateway access information. Combined with the basic channel between the gateway system and the target environment, an environmental channel with a data transmission path of "access terminal-gateway system-target environment" can be actually formed. When the gateway system determines that the access terminal has not passed authentication based on the authentication information, it means that the access terminal has no right to access the target environment. For example, the gateway system can ignore the access request, and can also return a corresponding abnormal prompt to the access terminal.

[0051] In the above authentication process, the authentication method may vary according to the different authentication information, and the specific content of the authentication information is associated with the type of the source IP address in the access request.

[0052] In one embodiment, when the source IP address of the access request adopts a static IP address, the source IP address of the above request can be determined as the above authentication information, and whether the authentication is passed is determined by whether the authentication information matches the pre-registered IP address; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed, and correspondingly, if the authentication information does not match the pre-registered IP address, the authentication is not passed; wherein, the pre-registered IP address can be maintained by a gateway system or a trusted third-party device, and the access end can initiate a registration request containing its own static IP address to the maintainer before sending the access request, so that the maintainer records the corresponding static IP address to the pre-registered IP address. Of course, the maintainer can make corresponding adjustments to the content, format and other information of the registration request, as well as the recording format, effective duration and other information of the above static IP address in the pre-registered IP address according to actual needs, and this is not limited in this specification.

[0053] In another embodiment, when the source IP address of the access request adopts a dynamic IP address, the gateway system can no longer determine the corresponding user identity based on the fixed static IP address, and therefore the account password and / or authorization certificate carried in the above access request can be determined as the authentication information; wherein, if the account password verification is correct and / or the above authorization certificate is confirmed to be valid, the authentication is passed; correspondingly, if the account password verification is incorrect and / or the above authorization certificate is confirmed to be invalid, the authentication is not passed; wherein the above authorization certificate can be, for example, a digital token Token containing identity authentication information, etc., which is used to identify and verify the user's identity; in addition, the verification process of the above account password can be to compare the account password provided by the user with the pre-registered account password, and the confirmation process of the above authorization certificate can be to compare the Token provided by the user with the pre-registered account password. Figure 3 The user TOKEN database is pre-compared and parsed with the legal Token for the user. The above Token can be a simple string or a complex data structure, which may contain a variety of information such as user ID, role, authority, validity period, etc.

[0054] It is understandable that the source IP address of the above access request can refer to the device IP address of the access end itself, and whether the device IP address of the access end uses a static IP address or a dynamic IP address is usually determined by the device type of the access end or the specific network configuration. For example, core network devices such as servers, routers, and firewalls usually use static IP addresses because they require stable network connections and fixed network locations; while ordinary terminal devices such as personal computers and smart phones tend to use dynamic IP addresses because their locations may change frequently. For another example, in large networks, in order to simplify IP address management, a dynamic IP address allocation solution such as the Dynamic Host Configuration Protocol (DHCP) can be used, while in small networks or networks that require precise control of IP address allocation, a more appropriate static IP address can be used.

[0055] The above-mentioned target gateway access information is a set of key parameters required for network connection, which allow the access end to identify and connect to a specific proxy service below, and the proxy service can correctly forward the data from the access end to the target environment. The above-mentioned parameters can be information such as the IP address, port number, and network protocol type of the proxy service. For example, the access end can generate the following data request based on the target IP address, target port number, and network protocol type in the above-mentioned target gateway access information, and make the data request sent to the corresponding proxy service and then successfully forwarded to the target environment.

[0056] In this specification, the target gateway access information allocated by the gateway system to the access terminal can be dynamically determined according to different identities of the access terminal.

[0057] In one embodiment, the access request may carry the identity information of the access terminal, and the gateway system itself may also record the correspondence between the identity information of each access terminal and the basic channel. The specific process of allocating the target gateway access information is as follows: first, the basic channel set corresponding to the access terminal is determined according to the correspondence and the identity information in the access request, and then a basic channel is selected from the basic channel set, and the gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information. In this embodiment, the correspondence can be used to characterize all basic channels that each identity information has the right to access. Therefore, according to the correspondence and the identity information in the access request, the basic channel that the current access terminal has the right to access can be determined, and the basic channel set includes all the determined basic channels.

[0058] For the access terminal, although different basic channels correspond to different gateway access information, the type of information contained in the gateway access information remains unchanged. Therefore, no matter what the target gateway access information is finally selected, the access terminal does not make any difference in the use of the target gateway access information. Therefore, the access terminal does not actually need to consider which basic channel to access. Of course, for some reasons, the access terminal can also carry indication information for the basic channel in the access request, so that the gateway system can give priority to selecting the basic channel that meets the indication information.

[0059] Generally speaking, the gateway system can autonomously select a basic channel from the basic channel set, and then use the gateway access information corresponding to the basic channel as the target gateway access information. The selection rule can be any predefined rule as long as it can ensure that a basic channel corresponding to the target environment is selected.

[0060] It should be noted that: regarding the above-mentioned correspondence, that is, the correspondence between the identity information of the access terminal recorded by the gateway system and the basic channel, there may be different situations. For example, the correspondence can be a pairwise correspondence between the identity information of the access terminal and the basic channel. Then, based on the identity information of the access terminal carried by the access request, the determined basic channel set will include all basic channels that the access terminal has the right to access, including both basic channels corresponding to the target environment and basic channels corresponding to other environments. Accordingly, the selection rule at least includes the selection condition that the corresponding basic channel corresponds to the target environment. On this basis, assuming that the basic channel set contains only one basic channel corresponding to the target environment, the gateway system can directly select the basic channel. However, if it is assumed that the basic channel set contains multiple basic channels corresponding to the target environment, the selection rule needs to further include other selection conditions, such as: randomly selecting one of the basic channels, or selecting the most idle basic channel according to the idleness, or based on selection conditions of other dimensions, which will not be listed one by one in this manual.

[0061] For another example, the correspondence may be the correspondence between the identity information of the access terminal, the basic channel and the environment. Then, based on the identity information of the access terminal and the information of the target environment carried by the access request, the determined basic channel set will only include the basic channels corresponding to the target environment. Accordingly, the selection rule includes the following selection conditions: if the basic channel set includes only one basic channel, the basic channel is directly selected; if the basic channel set includes multiple basic channels corresponding to the target environment, the selection rule needs to further include other selection conditions, such as: randomly selecting one of the basic channels, or selecting the most idle basic channel according to the idleness, or based on selection conditions of other dimensions, which will not be listed one by one in this specification.

[0062] The above correspondence can be based on, for example, Figure 3 The role-based access control (RBAC) system is implemented in the system. For example, multiple different roles are pre-defined, and corresponding basic channels are assigned to each role to indicate all basic channels that the corresponding role has the right to access. Then the identity information of the access terminal is assigned to one or more roles, so that the current access terminal obtains all the corresponding basic channels that it has the right to access through its role. This system makes the permission management and control of basic channels more centralized and simplified, because it only needs to manage the basic channels accessible to the roles, rather than managing the basic channels accessible to the access terminals separately. At the same time, it provides certain flexibility and scalability for scenarios where the identity information or basic channels of the access terminals change frequently. In addition, the above basic channels and the corresponding target gateway access information can be queried by the gateway access system. Figure 3 The basic channel information database is obtained, and the basic channel information database can maintain the corresponding relationship between the basic channel and the target gateway access information, the target environment and other information.

[0063] Combine the following Figure 3 The gateway system is further divided into Figure 3As shown, there are n environments, n is greater than or equal to 1. For example, the current gateway system has established three basic channels with two environments 1 and 2, namely, basic channels 1-A, 1-B and 2-A. Assume that a user uses a laptop as an access terminal and uses a dynamic IP address to initiate an access request for environment 1. The request contains a valid TOKEN as authentication information and the user's identity information. The RBAC database associated with the gateway system records that the basic channels that the user is allowed to access are 1-A, 1-B and 2-A. Then, when the access terminal is determined to have passed the authentication based on the above TOKEN, Through the above-mentioned identity information and the correspondence between the user and the basic channel recorded in the above-mentioned RBAC database, the above-mentioned 1-A, 1-B and 2-A can be used as the above-mentioned basic channel set. By querying the basic channel information database, it can be known that compared with basic channels 1-A and 1-B, basic channel 2-A corresponds to environment 2 instead of environment 1. Therefore, the gateway access information corresponding to basic channel 1-A or 1-B can be returned to the access terminal as the above-mentioned target gateway access information, so that the access terminal can access basic channel 1-A or 1-B based on the received gateway access information, thereby establishing an environment channel with environment 1. In particular, when the gateway access information corresponding to basic channels 1-A and 1-B is the same, this specification does not limit which basic channel is determined as the final basic channel; when the gateway access information corresponding to basic channels 1-A and 1-B is different, for example, the above two channels correspond to different proxy services below, respectively, then according to the load conditions of different proxy services or other predefined proxy service selection rules, the gateway access information of the proxy service with the smallest load can be selected as the above-mentioned target gateway access information and returned to the access terminal.

[0064] The above-mentioned identity information may correspond to different contents in different situations. For example, when the source IP address of the access request adopts a static IP address, the above-mentioned identity information is the source IP address of the access request; for another example, when the source IP address of the access request adopts a dynamic IP address, the above-mentioned identity information is the access end account carried in the access request.

[0065] It should be noted that the above-mentioned identity information can be used as independent information completely unrelated to the above-mentioned authentication information, or it can establish an association relationship with it. For example, when the source IP address of the above-mentioned access request adopts a static IP address, the source IP address of the above-mentioned access request can be used as both the above-mentioned identity information and the above-mentioned authentication information, that is, the content of the identity information and the authentication information is the same; for another example, when the source IP address of the access request adopts a dynamic IP address, if the above-mentioned authentication information is the user's identity TOKEN, then the above-mentioned identity information can be the user's unique identifier that is allowed to be obtained through parsing in the TOKEN, or it can be an access terminal account independent of the above-mentioned authentication information. In short, in terms of effect, when the authentication information is the same as the identity information or has an association relationship such as inclusion, the data utilization rate of the access request can be effectively improved, and it will not affect the authentication process or the distribution process of the target gateway access information; when the authentication information and the identity information are independent of each other, the gateway system can obtain the corresponding data more efficiently, avoiding performance losses caused by additional parsing operations.

[0066] Combine the following Figure 3 The gateway system is further divided according to its functions, such as Figure 3 As shown, the gateway system can be deployed with management services and proxy services. Specifically, the management service can be used to process access requests, allocate the target gateway access information to the access terminal, and inform the proxy service of the source IP address of the access request that is granted access rights; the proxy service can be used to process the following data requests, and forward the data requests through the basic channel established between itself and the target environment. The operation of the access terminal sending access requests and data requests to the gateway system can be achieved by calling the application programming interface (Application Programming Interface, API) disclosed by the management service and the proxy service. This specification does not limit the sending method of the above requests.

[0067] Furthermore, multiple proxy services may be deployed independently in the above gateway system; wherein each proxy service may establish a basic channel with one or more environments, such as Figure 3 There are m proxy services shown in , each of which can establish a basic channel with one or more environments, where m is greater than 1.

[0068] This specification further describes the above-mentioned operations of allocating target gateway access information and granting access rights to the target gateway access information to the source IP address of the access request at the management service and proxy service level:

[0069] The first type of process: the gateway system allocates target gateway access information corresponding to the target environment to the access end. In this process, the above-mentioned management service can determine the proxy service that has established a basic channel with the target environment from multiple proxy services, and allocate the determined IP address of the proxy service, the network protocol type supported by the proxy service and the port number corresponding to the above-mentioned target environment as the above-mentioned target gateway access information to the above-mentioned access end.

[0070] The second type of process: the gateway system grants access rights to the target gateway access information to the source IP address of the access request. In this process, the management service can send the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights. The determined proxy service can quickly determine the data request below from the requests from different access terminals based on the recorded IP address.

[0071] In the above second type of process, the management service can also send additional information to the corresponding proxy service, such as a basic channel list used to characterize that the access terminal has the right to access one or more basic channels corresponding to the target environment. This information comes from the correspondence between the identity information of each access terminal and the basic channel in the above text, which can enable the proxy service to select a basic channel in the basic channel list based on a predefined basic channel selection rule to forward data between the access terminal and the target environment when there are multiple basic channels between the proxy service and the target environment. The above basic channel selection rule may include: the last access time of the selected basic channel is earlier than that of other basic channels corresponding to the same environment. In addition, the management service can also send different aspects of configuration information to the proxy service, such as type modification information for the basic channel, modification information for the data forwarding rules below, etc., which are not limited in this specification.

[0072] Step S206, in response to receiving a data request, upon confirming that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, forwarding the data request to the target environment through a basic channel corresponding to the target environment.

[0073] When the access terminal obtains the assigned target gateway access information, it can initiate a data request to the gateway system based on the target gateway access information, thereby establishing an environment channel with the target environment. After receiving the data request, the gateway system can determine whether the data request contains the target gateway access information and whether the source IP address of the data request is granted access rights to the target gateway access information. When confirming whether the data request contains the target gateway access information, it can be determined by whether the destination IP address of the data request is the same as the IP address of the proxy service, the target port of the data request is the same as the port number of the target environment, and the network protocol type used by the data request is the same as the network protocol type supported by the proxy service. When confirming whether the source IP address of the data request is granted access rights to the target gateway access information, it can be determined by whether the source IP address of the data request is the same as the source IP address of the access request sent in advance by the management service.

[0074] If it is determined that the data request contains the target gateway access information, and the source IP address of the data request is granted access rights to the target gateway access information, then the data request can be forwarded to the target environment through the basic channel corresponding to the target environment. On the contrary, if the data request does not contain the target gateway access information, or the source IP address of the data request is not granted access rights to the target gateway access information, it can be determined that the initiator of the data request has not passed the authentication, or has not correctly applied the received target gateway access information to the data request; at this time, the proxy service can return corresponding information to the access end to prompt it to reconfirm the content in the gateway access information.

[0075] The following is a detailed introduction to the forwarding process based on the newly added scenario of the environmental channel and the scenario of the access end access proxy service.

[0076] In one embodiment, in the case where the proxy service has pre-established forwarding rules for the target environment, the proxy service can establish an import rule for the source IP address according to the source IP address of the access request informed by the management service, and the import rule can be used to import the data request from the source IP address into the forwarding rule, so as to forward the data request to the target environment through the forwarding rule. The pre-established forwarding rule for the target environment is used to instruct the proxy service to forward the received data request to the target environment through the modification operation below, but the proxy service at this time is actually not sure to which request the forwarding rule is applied. The management service can inform the proxy service of the source IP address of the access request so that the proxy service establishes an import rule for the source IP address, and then applies the forwarding rule to the request that meets the source IP address, that is, the forwarding rule is specifically applied to the data request initiated by the access terminal. Specifically, the import rule can be configured with at least one target import IP address and import logic, each target import IP address is a source IP address informed by the management service, and the import logic can be used to instruct the proxy service to forward the data request corresponding to the target import IP address based on the forwarding rule for the target environment.

[0077] When the proxy service receives a request, the proxy service may attempt to query the import rule for a target import IP address that matches the source IP address of the received request. If the match is successful, the request may be determined as a data request initiated by the access end, and a unique tag and / or annotation that can be recognized by the forwarding rule may be added to the data request, so that the forwarding rule may recognize the data request according to the unique tag and / or annotation, and forward it to the target environment. If the match fails, the request may be rejected for forwarding processing to avoid illegal access to the target environment. In combination with the iptables below, the rules inserted into each table in steps S402 to 412 may be regarded as forwarding rules, and the rules inserted into each table in steps S414 to 416 may be regarded as import rules, wherein the import rules may mark the data stream corresponding to the data request with a local unique tag and annotation locally assigned to the corresponding environment channel, so that the data stream may be recognized by the forwarding rule and forwarded to the specified target environment.

[0078] The management service can receive a request for adding a channel for a target environment, and determine a proxy service to be configured from multiple proxy services, so that the proxy service to be configured can establish a new environment channel between the target environment and the access terminal. The management service can issue a port number for the newly created environment channel to the proxy service to be configured, as well as a local unique identifier of the newly created environment channel in the proxy service to be configured, to ensure that the access terminal accesses according to the correct forwarding rules.

[0079] For the above-mentioned proxy service to be configured, in order to ensure that the above-mentioned data request is forwarded to the correct target environment, the received data request can be managed based on a unified data forwarding rule. Among them, the data forwarding rule of the above-mentioned proxy service to be configured can be modified as follows: modify the source IP address and source port of the data request to the IP address in the above-mentioned proxy service to be configured and the port number corresponding to the target environment, modify the target IP address and port number of the above-mentioned data request to the IP address and port number of the above-mentioned target environment, and allow the forwarding of the above-mentioned data request. Among them, the above-mentioned modification operations can be in no particular order; the above-mentioned data forwarding rules can be implemented based on different network traffic control tools, such as iptables in the Linux kernel, firewalld, a firewall daemon in Fedora and CentOS, etc., and this manual does not limit this.

[0080] Take iptables as an example. As a user space program and tool set provided in the Linux kernel, it can be used to configure the rule set of the kernel firewall. It allows users to define conditions for allowing or denying data packets based on characteristics such as source and destination IP addresses, port numbers, network protocols, and the content of data packets. Iptables specifically includes tables, chains, and rules. A table is a set of predefined rule sets that can be organized according to the processing type of data packets. It mainly includes the following types of tables: Filter, NAT (Network Address Translation), Mangle, Raw, and Security. Each of the above tables has its specific purpose and can be selected for use according to the processing stage and processing requirements of the data packet. For example

[0081] The filter table can be used to decide whether a packet is accepted, rejected or discarded, and can implement basic firewall rules, such as allowing or blocking specific IP addresses, port numbers, etc. The NAT table is used for network address translation, which can change the source or destination IP address of a packet to achieve connection between the internal network and the external network; the mangle table allows the modification of the content of the passing packet, including IP address, TCP flag, TTL (Time to Live), etc., which is used to implement more complex network operations, such as modifying packets for Quality of Service (QoS) management. A chain is a collection of rules executed in sequence, which defines the checkpoints when a packet enters, traverses or leaves the network stack. It mainly includes the following types of chains: PREROUTING, INPUT, FORWARD, POSTROUTING, OUTPUT, corresponding to different flow directions of packets. In addition, users can create custom chains to organize and manage rules. A rule is an instruction that tells iptables how to handle specific packets that match the rule. Each rule is associated with a chain and contains a set of matching conditions and an action. The above matching conditions can be based on various data packet attributes, such as IP address, port number, data packet type, etc., and the above actions can be allow (ACCEPT), deny (DROP), redirect (REDIRECT) or some other ways of processing data packets.

[0082] like Figure 4 As shown in the process of adding an environment channel, in the iptables scenario used, the modification process of the above data forwarding rules can include the following steps.

[0083] Step S402, creating a custom link Uni-Conn-Dnat in the NAT table, which is used to modify the <target ip> and <target port> of the incoming data flow of the access end accessing the corresponding environment channel to <target end ip> and <target end port>.

[0084] Step S404, insert a rule into the protogenesis link PREROUTING in the table, and the rule transfers the data stream marked with the corresponding mark value to the custom link Uni-Conn-Dnat for processing.

[0085] In one embodiment, iptables may execute the following commands:

[0086] iptables -t nat -N Uni-Conn-Dnat

[0087] iptables -t nat -I PREROUTING -m mark --mark 2001 -j Uni-Conn-Dnat

[0088] iptables -t nat -A PREROUTING -m mark --mark 2001 -p tcp -d $(gateway access IP address of proxy service) --dport $(gateway access port of proxy service) -m comment –comment "to_env: $(target environment name)" -j DNAT --to $(actual IP address of target environment): $(actual port of target environment)

[0089] Among them, for different instructions, -t nat indicates that the table for the specified operation is the NAT table; -N Uni-Conn-Dnat indicates that a new chain in the NAT table is created, named Uni-Conn-Dnat, and can be referenced by other rules; -I is the abbreviation of --insert, indicating that a new rule is inserted at the head of the specified chain, and -A is the abbreviation of --append, indicating that a new rule is added to the specified chain. PREROUTING is a chain in the NAT table, which is used to process data packets arriving at the local machine before the routing decision. -m mark indicates that a mark (mark), that is, the above-mentioned local unique identifier is used to match data packets, and --mark2001 indicates that the matching data packet mark is set to 2001. The above-mentioned mark can be regarded as a mechanism used by iptables to identify and classify data packets; - is the abbreviation of -jump, indicating that when the data packet matches this rule, it will jump to the specified chain. In this embodiment, the matched data packet will be jumped to the Uni-Conn-Dnat chain created previously. -p tcp indicates that only data packets with the transport layer protocol of TCP are matched. -d is the abbreviation of --destination, which means that the destination IP address is matched to the specified IP. Here, $(the gateway access IP address of the proxy service) is a variable that can be replaced with the actual IP address. -dport specifies the destination port number to match. $(the gateway access port of the proxy service) is a variable that can be replaced with the actual port number. -m comment --comment "to_env: $(target environment name)" is a comment match used to add a human-readable comment explaining the purpose of this rule. $(target environment name) can be replaced with the actual environment name. -j is the abbreviation of -jump, which specifies that when a data packet matches this rule, the action performed can be the target network address translation operation (DNAT). --to is followed by the variables of the converted target IP address $(the actual IP address of the target environment) and port $(the actual port of the target environment).

[0090] In summary, the above commands are used to set a rule so that all incoming packets marked with 2001 are first processed by the PREROUTING chain and then jump to the custom Uni-Conn-Dnat chain for further processing. In the Uni-Conn-Dnat chain, all packets marked with 2001, with the protocol TCP, the destination IP address of the gateway access IP address of the proxy service, and the destination port of the gateway access port of the proxy service are redirected to another IP address and port.

[0091] Step S406, creating a custom chain Uni-Conn-Allow, which is used to set the local IP forwarding rule of the inbound data flow of the access end accessing the corresponding environment channel to allow.

[0092] Step S408: insert a rule into the protogenesis link FORWARD in the table, and the rule transfers the data flow marked with the corresponding mark value into the custom link Uni-Conn-Allow for processing.

[0093] In one embodiment, iptables may execute the following commands:

[0094] iptables -N Uni-Conn-Allow

[0095] iptables -I FORWARD -m mark --mark 2001 -j Uni-Conn-Allow

[0096] iptables -I Uni-Conn-Allow -m mark --mark 2001 -j ACCEPT

[0097] In summary, the above commands are used to direct all packets that pass through the proxy service and are marked as 2001 to the Uni-Conn-Allow chain, and then accept these packets in the chain to allow them to be forwarded. This setting can be used to define specific traffic processing logic, such as data requests sent by access points.

[0098] Step S410, create a custom link Uni-Conn-Snat in the table, which is used to modify the <source ip> and <source port> of the incoming data flow of the access end accessing the corresponding environment channel to <source ip of the environment channel from the proxy server to the target end> ​​and <source port of the environment channel from the proxy server to the target end>.

[0099] Step S412, insert a rule into the protogenesis link POSTROUTING in the table, which transfers the data flow marked with the corresponding mark value to the custom link Uni-Conn-Ssnat for processing.

[0100] In one embodiment, iptables may execute the following commands:

[0101] iptables -t nat -N Uni-Conn-Snat

[0102] iptables -t nat -I POSTROUTING -m mark --mark 2001 -j Uni-Conn-Snat

[0103] iptables -t nat -IUni-Conn-Snat -m mark --mark 2001 -j SNAT --to-source $(IP address of the proxy service to the target environment):$(port of the proxy service to the target environment)

[0104] POSTROUTING is a chain in the NAT table that processes packets that are about to leave the local machine. -jSNAT specifies that when a packet matches this rule, a source address translation (SNAT) operation will be performed.

[0105] In summary, the above commands are used to direct all packets leaving the local machine and marked as 2001 to the Uni-Conn-Snat chain, and then perform SNAT operations in the chain to convert the source IP address and source port of the packet to the specified IP address and specified port, that is, the IP address and port in the proxy service that go to the target environment. Considering that even the same proxy service may have multiple IP addresses and ports due to the configuration of multiple network cards, this setting can be used to unify the network exit address of the proxy service.

[0106] It should be noted that the above steps S402-412 can be executed before the access terminal sends a data request. The essence of the steps is to complete the connection of the relevant path "gateway system-target environment" in the environment channel. As for the connection process between the access terminal and the gateway system, it can be performed in the following manner: Figure 4 As shown in steps S414~416.

[0107] Step S414: Create a custom chain CLIENT, which is used to mark the incoming data flow of the access end accessing the corresponding environment channel with a local unique mark value and annotation locally assigned to the environment channel.

[0108] Step S416: insert a rule into the protogenesis link PREROUTING in the table, the rule is used to transfer the data stream marked with the corresponding mark value into the custom link CLIENT for processing.

[0109] In one embodiment, assuming that the management service informs the proxy service that the IP address of the user's access terminal is 30.123.1.1, and the gateway access interfaces in the gateway access information are 50001, 50003, and 51005, then iptables can execute the following command:

[0110] iptables -t mangle -N client_30_123_1_1

[0111] iptables -t mangle -I PREROUTING -s 30.123.1.1 -j client_30_123_1_1

[0112] iptables -t mangle -I client_30_123_1_1 -p tcp -d $(gateway access IP address of proxy service) --destination-ports 50001, 50003, 51005 -m comment --comment "to_env: $(environment name)" -j MARK --set-mark 2001

[0113] In summary, the functions of these commands are: to establish rules for the source IP address of the above access end, and for all packets from IP address 30.123.1.1, using TCP protocol, with destination port 50001, 50003 or 51005, and with the destination IP being the gateway access IP address of the proxy service, set the tags of these packets to the local unique identifier 2001 of the proxy service, as well as the annotation representing the environment name, before they reach the local machine, so that subsequent rules or policies can process the packets differently according to these tags and annotations. The so-called subsequent rules or policies can refer to the rules inserted in S402~412.

[0114] It is worth mentioning that, during the execution of S416, the proxy service can also perform logging operations on the data packets that meet the above conditions, and add a prefix such as "new_conn_" and the access end identity before the log entry to accurately record the data packet reception status of the current proxy service, so as to facilitate subsequent data analysis and mining locally or by the management service.

[0115] Of course, the process of steps S406 to S416 is actually the configuration of the forwarding rules in the proxy service. When the whole process is completed, the access end needs to initiate a data request to the corresponding proxy service so that the proxy service forwards the data request to the target environment according to the forwarding rules.

[0116] Corresponds to Figure 4In the embodiment, an access end with an IP address of 30.123.1.1 wants to access a target environment with an IP address of 10.0.0.2:80 (for ease of explanation, this specification describes the port number together with the IP address in the form of "IP address: port number", and the same applies below). It can send a TCP request to the proxy service gateway with an IP address of 30.123.1.254:50001. It is assumed that the proxy service runs on a server with an IP address of 30.123.1.254 and listens on port 50001. When it receives a data request from the access end, the proxy service can mark the data packet of the data request as 2001 to facilitate subsequent forwarding rule identification and processing. At the same time, it can convert the target IP address and port number of the data request from 30.123.1.254:50001 to 10.0.0.2:80 according to the above iptables rules, thereby directing the traffic to the target environment. When the target environment processes the request and sends a response back to the proxy service, the source IP and port of the response packet can be converted from 10.0.0.2:80 back to 192.168.1.1:50001 through the SNAT rule of iptables, ensuring that the response can be correctly sent back to the access end. Finally, the access end receives the response from the proxy service, completing the entire communication process.

[0117] As mentioned above, the number of proxy services used to establish the same basic channel with the target environment can be multiple, and the multiple proxy services can include a main proxy service and at least one backup proxy service. In other words, for each basic channel, it can be established through the above main proxy service or any backup proxy service, wherein the management service can determine the above main proxy service and the above backup proxy service based on the load information provided by each proxy service, and the load situation represented by the load information of the main proxy service is by default better than the backup proxy service. Among them, the load information can be formulated based on dimensions such as memory occupancy size and processor (Central Processing Unit, CPU) occupancy rate. The better the load situation represented by the load information, the more suitable the proxy service is for processing data forwarding between the access terminal and the target environment. It can be understood by those skilled in the art that when the load situation of the main proxy service is worse than that of the backup proxy service, the management service that receives the access request can allocate the IP address of the backup proxy service, the supported network protocol type and the port number corresponding to the target environment as the above target gateway access information to the access terminal, thereby avoiding single point overload of the device corresponding to the main proxy service. Once the main proxy service or backup proxy service has an abnormality at a certain moment, it can report the current abnormal state to the management service under the condition that the reporting function is normal, or the management service can determine that one of the proxy services has an abnormality based on the load information reported periodically by multiple proxy services, so that the management service can smoothly switch the basic channel based on the abnormal proxy service to the basic channel based on the normal proxy service. From the perspective of the access end, the environmental channel based on the abnormal proxy service is smoothly switched to a new environmental channel based on the normal proxy service. In short, the gateway system realizes the overall horizontal expansion of the proxy service through the partition load and channel smooth migration capabilities of the proxy service.

[0118] Figure 5 It is a flowchart of another network communication control method provided by an exemplary embodiment of this specification, which is applied to a management service deployed by a gateway system, the gateway system is also deployed with an agent service, the gateway system has a basic channel established with a target environment in advance, and the target environment is deployed in an internal network; the method includes:

[0119] Step S502, receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information;

[0120] Step S504, when it is determined that the access terminal has passed the authentication based on the authentication information, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information, so that the proxy service, in response to receiving the data request, forwards the data request to the target environment through the basic channel corresponding to the target environment when it is confirmed that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information.

[0121] As mentioned above, determining that the access terminal passes the authentication according to the authentication information includes:

[0122] In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed;

[0123] In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

[0124] As mentioned above, allocating the target gateway access information corresponding to the target environment to the access terminal includes:

[0125] Determine, according to the correspondence between identity information of each access terminal and basic channels recorded by the gateway system, and the identity information of the access terminal carried in the access request, a basic channel set corresponding to the access terminal, wherein the basic channel set includes at least one basic channel corresponding to the target environment;

[0126] A basic channel is selected from the basic channel set, and the gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information.

[0127] As mentioned above, in the case where the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0128] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0129] As mentioned above, multiple proxy services are deployed independently in the gateway system;

[0130] A basic channel is established between each proxy service and one or more environments.

[0131] As described above, the allocating the target gateway access information corresponding to the target environment to the access terminal includes: determining a proxy service having a basic channel established with the target environment from the multiple proxy services, and allocating the determined IP address of the proxy service, the type of network protocol supported by the proxy service, and the port number corresponding to the target environment as the target gateway access information to the access terminal;

[0132] Granting access rights to the target gateway access information to the source IP address of the access request includes: the management service sending the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights.

[0133] As mentioned above, the number of proxy services establishing the basic channel with the target environment is multiple;

[0134] The management service is also used to:

[0135] Based on the load information provided by multiple proxy services, the IP address corresponding to the proxy service with better load conditions, the network protocol type supported by the proxy service, and the port number corresponding to the target environment are allocated to the access end as the target gateway access information; and, when it is determined that any proxy service has an abnormality, the basic channel based on the any proxy service is smoothly switched to a basic channel based on other proxy services, and the other proxy services are proxy services among the multiple proxy services except the any proxy service.

[0136] Figure 6 It is a flowchart of another network communication control method provided by an exemplary embodiment of the present specification, which is applied to a proxy service deployed by a gateway system. The gateway system is also deployed with a management service, and the management service is used to receive an access request initiated by an access terminal from an external network to a target environment, and when it is determined that the access terminal has passed the authentication according to the authentication information contained in the access request, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information; the gateway system has established a basic channel with the target environment in advance, and the target environment is deployed in an internal network; the method includes:

[0137] Step S602, receiving a data request;

[0138] Step S604, when confirming that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, forwarding the data request to the target environment through the basic channel corresponding to the target environment.

[0139] As mentioned above, in the case where the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0140] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0141] As mentioned above, multiple proxy services are deployed independently in the gateway system;

[0142] A basic channel is established between each proxy service and one or more environments.

[0143] As mentioned above, in the case where forwarding rules for the target environment are pre-established at the proxy service, the proxy service establishes an import rule for the source IP address based on the source IP address of the access request informed by the management service, and the import rule is used to import the data request from the source IP address into the forwarding rule, so as to forward the data request to the target environment through the forwarding rule.

[0144] Figure 7 This is a flowchart of a network communication control method for a private cloud environment shown in an exemplary embodiment of this specification, which is applied to a gateway system. The gateway system has established a basic channel with the target private cloud environment in advance; the method includes:

[0145] Step S702, receiving an access request initiated by the access terminal for the target private cloud environment, wherein the access request includes authentication information;

[0146] Step S704, when it is determined that the access terminal has passed the authentication according to the authentication information, the target gateway access information corresponding to the target private cloud environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information;

[0147] Step S706, in response to receiving the data request, upon confirming that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, forwarding the data request to the target private cloud environment through the basic channel corresponding to the target private cloud environment.

[0148] As mentioned above, determining that the access terminal passes the authentication according to the authentication information includes:

[0149] In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed;

[0150] In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

[0151] As mentioned above, the allocating target gateway access information corresponding to the target private cloud environment to the access terminal includes:

[0152] Determine, according to the correspondence between the identity information of each access terminal and the basic channel recorded by the gateway system, and the identity information of the access terminal carried in the access request, a basic channel set corresponding to the access terminal, wherein the basic channel set includes at least one basic channel corresponding to the target private cloud environment;

[0153] A basic channel is selected from the basic channel set, and the gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information.

[0154] As mentioned above, in the case where the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0155] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0156] As mentioned above, the gateway system is deployed with management services and proxy services;

[0157] The management service is used to: process the access request, allocate the target gateway access information to the access terminal, and inform the proxy service of the source IP address of the access request that is granted access rights;

[0158] The proxy service is used to: process the data request and forward the data request through a basic channel established between the proxy service and the target private cloud environment.

[0159] As mentioned above, multiple proxy services are deployed independently in the gateway system;

[0160] A basic channel is established between each proxy service and one or more proprietary cloud environments.

[0161] As described above, the allocating target gateway access information corresponding to the target private cloud environment to the access terminal includes: the management service determines a proxy service with a basic channel established with the target private cloud environment from the multiple proxy services, and allocates the determined IP address of the proxy service, the network protocol type supported by the proxy service, and the port number corresponding to the target private cloud environment as the target gateway access information to the access terminal;

[0162] Granting access rights to the target gateway access information to the source IP address of the access request includes: the management service sending the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights.

[0163] As previously mentioned, in a case where forwarding rules for the target private cloud environment have been pre-established at the proxy service, the proxy service establishes an import rule for the source IP address based on the source IP address of the access request informed by the management service, and the import rule is used to import data requests from the source IP address into the forwarding rule so as to forward the data request to the target private cloud environment through the forwarding rule.

[0164] As mentioned above, the number of proxy services establishing the basic channel with the target environment is multiple;

[0165] The management service is also used to:

[0166] Based on the load information provided by multiple proxy services, the IP address corresponding to the proxy service with better load conditions, the network protocol type supported by the proxy service, and the port number corresponding to the target environment are allocated to the access end as the target gateway access information; and, when it is determined that any proxy service has an abnormality, the basic channel based on the any proxy service is smoothly switched to a basic channel based on other proxy services, and the other proxy services are proxy services among the multiple proxy services except the any proxy service.

[0167] Figure 8 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 8At the hardware level, the device includes a processor 802, an internal bus 804, a network interface 806, a memory 808, and a non-volatile memory 810, and may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 802 reading the corresponding computer program from the non-volatile memory 810 into the memory 808 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0168] Please refer to Fig. 9 The network communication control device can be applied to Fig. 9 The device shown in the figure is used to implement the technical solution of this specification. Among them, the network communication control device is applied to the gateway system, the gateway system has a basic channel established with the target environment in advance, and the target environment is deployed in the internal network. The device may include:

[0169] The access request unit 92 is used to receive an access request initiated by the access terminal from the external network for the target environment, wherein the access request includes authentication information;

[0170] A gateway access information allocation unit 94 is used to allocate target gateway access information corresponding to the target environment to the access terminal when it is determined that the access terminal has passed the authentication according to the authentication information, and grant access rights to the target gateway access information to the source IP address of the access request;

[0171] The request forwarding unit 96 is used to respond to receiving a data request and forward the data request to the target environment through a basic channel corresponding to the target environment when it is confirmed that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information.

[0172] Optionally, the gateway access information allocation unit 94 is specifically used to:

[0173] In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed;

[0174] In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

[0175] Optionally, the gateway access information allocation unit 94 is specifically used to:

[0176] Determine, according to the correspondence between identity information of each access terminal and basic channels recorded by the gateway system, and the identity information of the access terminal carried in the access request, a basic channel set corresponding to the access terminal, wherein the basic channel set includes at least one basic channel corresponding to the target environment;

[0177] A basic channel is selected from the basic channel set, and the gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information.

[0178] Optionally, when the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0179] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0180] Optionally, the gateway system is deployed with management services and proxy services, wherein:

[0181] The management service is used to: process the access request, allocate the target gateway access information to the access terminal, and inform the proxy service of the source IP address of the access request that is granted access rights;

[0182] The proxy service is used to: process the data request, and forward the data request through a basic channel established between the proxy service and the target environment.

[0183] Optionally, a plurality of proxy services are deployed independently of each other in the gateway system;

[0184] A basic channel is established between each proxy service and one or more environments.

[0185] Optionally, the gateway access information allocation unit 94 is specifically used to:

[0186] The allocating the target gateway access information corresponding to the target environment to the access terminal comprises: the management service determines, from the multiple proxy services, a proxy service with which a basic channel is established with the target environment, and allocates the determined IP address of the proxy service, the network protocol type supported by the proxy service, and the port number corresponding to the target environment as the target gateway access information to the access terminal;

[0187] Granting access rights to the target gateway access information to the source IP address of the access request includes: the management service sending the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights.

[0188] Optionally, the device further comprises:

[0189] The rule establishing device 98, when a forwarding rule for the target environment has been pre-established at the proxy service, the proxy service establishes an import rule for the source IP address based on the source IP address of the access request informed by the management service, and the import rule is used to import the data request from the source IP address into the forwarding rule so as to forward the data request to the target environment through the forwarding rule.

[0190] Optionally, the number of proxy services establishing the basic channel with the target environment is multiple;

[0191] The management service is also used to:

[0192] Based on the load information provided by multiple proxy services, the IP address corresponding to the proxy service with better load conditions, the network protocol type supported by the proxy service, and the port number corresponding to the target environment are allocated to the access end as the target gateway access information; and, when it is determined that any proxy service has an abnormality, the basic channel based on the any proxy service is smoothly switched to a basic channel based on other proxy services, and the other proxy services are proxy services among the multiple proxy services except the any proxy service.

[0193] Please refer to Fig.10 The network communication control device can be applied to Fig.10 The device shown in the figure is used to implement the technical solution of this specification. Among them, the network communication control device is applied to the management service deployed by the gateway system, and the gateway system is also deployed with an agent service. The gateway system has established a basic channel with the target environment in advance, and the target environment is deployed in the internal network. The device may include:

[0194] The access request unit 102 is used to receive an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information;

[0195] The gateway access information allocation unit 104 is used to allocate target gateway access information corresponding to the target environment to the access terminal when it is determined that the access terminal has passed the authentication according to the authentication information, and grant access rights to the target gateway access information to the source IP address of the access request.

[0196] As mentioned above, the gateway access information allocation unit 104 is specifically used for:

[0197] In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed;

[0198] In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

[0199] As mentioned above, the gateway access information allocation unit 104 is specifically used for:

[0200] Determine, according to the correspondence between the identity information of each access terminal and the basic channel recorded by the gateway system, and the identity information of the access terminal carried in the access request, a basic channel set corresponding to the access terminal, wherein the basic channel set includes at least one basic channel corresponding to the target environment;

[0201] A basic channel is selected from the basic channel set, and gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information.

[0202] As mentioned above, in the case where the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0203] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0204] As mentioned above, multiple proxy services are deployed independently in the gateway system;

[0205] A basic channel is established between each proxy service and one or more environments.

[0206] As mentioned above, the gateway access information allocation unit 104 is specifically used to:

[0207] Determine a proxy service having a basic channel established with the target environment from the multiple proxy services, and assign the determined IP address of the proxy service, the type of network protocol supported by the proxy service, and the port number corresponding to the target environment as the target gateway access information to the access terminal;

[0208] The management service sends the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights.

[0209] As mentioned above, the number of proxy services establishing the basic channel with the target environment is multiple;

[0210] The management service is also used to:

[0211] Based on the load information provided by multiple proxy services, the IP address corresponding to the proxy service with better load conditions, the network protocol type supported by the proxy service, and the port number corresponding to the target environment are allocated to the access end as the target gateway access information; and, when it is determined that any proxy service has an abnormality, the basic channel based on the any proxy service is smoothly switched to a basic channel based on other proxy services, and the other proxy services are proxy services among the multiple proxy services except the any proxy service.

[0212] Please refer to Fig.11 The network communication control device can be applied to Fig.11 In the device shown, the technical solution of this specification is implemented. Among them, the network communication control device is applied to the proxy service deployed by the gateway system, and the gateway system is also deployed with a management service, which is used to receive an access request initiated by the access terminal from the external network to the target environment, and when it is determined that the access terminal has passed the authentication according to the authentication information contained in the access request, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information; the gateway system has established a basic channel with the target environment in advance, and the target environment is deployed in the internal network; the device may include:

[0213] The request receiving unit 112 receives a data request;

[0214] The request forwarding unit 114 forwards the data request to the target environment through a basic channel corresponding to the target environment when confirming that the data request includes the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information.

[0215] As mentioned above, in the case where the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0216] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0217] As mentioned above, multiple proxy services are deployed independently in the gateway system;

[0218] A basic channel is established between each proxy service and one or more environments.

[0219] As mentioned above, in the case where forwarding rules for the target environment are pre-established at the proxy service, an import rule for the source IP address is established based on the source IP address of the access request informed by the management service, and the import rule is used to import data requests from the source IP address into the forwarding rule so as to forward the data request to the target environment through the forwarding rule.

[0220] Please refer to Fig.12 The network communication control device for a dedicated cloud environment can be applied to Fig.12 The device shown in the figure is used to implement the technical solution of this specification. The network communication control device for the private cloud environment is applied to the gateway system, and the gateway system has established a basic channel with the target private cloud environment in advance. The device may include:

[0221] The access request unit 122 is used to receive an access request initiated by an access terminal from an external network to the target private cloud environment, wherein the access request includes authentication information;

[0222] A gateway access information allocation unit 124 is used to allocate target gateway access information corresponding to the target private cloud environment to the access terminal when it is determined that the access terminal has passed the authentication according to the authentication information, and grant access rights to the target gateway access information to the source IP address of the access request;

[0223] The request forwarding unit 126 is used to respond to receiving a data request and forward the data request to the target private cloud environment through a basic channel corresponding to the target private cloud environment upon confirming that the data request contains the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information.

[0224] Optionally, the gateway access information allocation unit 124 is specifically configured to:

[0225] In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed;

[0226] In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

[0227] Optionally, the gateway access information allocation unit 124 is specifically configured to:

[0228] Determine, according to the correspondence between the identity information of each access terminal and the basic channel recorded by the gateway system, and the identity information of the access terminal carried in the access request, a basic channel set corresponding to the access terminal, wherein the basic channel set includes at least one basic channel corresponding to the target private cloud environment;

[0229] A basic channel is selected from the basic channel set, and gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information.

[0230] Optionally, when the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request;

[0231] In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

[0232] Optionally, the gateway system is deployed with management services and proxy services, wherein:

[0233] The management service is used to: process the access request, allocate the target gateway access information to the access terminal, and inform the proxy service of the source IP address of the access request that is granted access rights;

[0234] The proxy service is used to: process the data request and forward the data request through a basic channel established between the proxy service and the target private cloud environment.

[0235] Optionally, a plurality of proxy services are deployed independently of each other in the gateway system;

[0236] A basic channel is established between each proxy service and one or more proprietary cloud environments.

[0237] Optionally, the gateway access information allocation unit 124 is specifically configured to:

[0238] The allocating target gateway access information corresponding to the target private cloud environment to the access terminal includes: the management service determines a proxy service having a basic channel established with the target private cloud environment from the multiple proxy services, and allocates the determined IP address of the proxy service, the network protocol type supported by the proxy service, and the port number corresponding to the target private cloud environment as the target gateway access information to the access terminal;

[0239] Granting access rights to the target gateway access information to the source IP address of the access request includes: the management service sending the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights.

[0240] Optionally, the device comprises:

[0241] The rule establishing device 128, when a forwarding rule for the target private cloud environment has been pre-established at the proxy service, the proxy service establishes an import rule for the source IP address according to the source IP address of the access request informed by the management service, and the import rule is used to import the data request from the source IP address into the forwarding rule so as to forward the data request to the target private cloud environment through the forwarding rule.

[0242] Optionally, the number of proxy services establishing the basic channel with the target environment is multiple;

[0243] The management service is also used to:

[0244] Based on the load information provided by multiple proxy services, the IP address corresponding to the proxy service with better load conditions, the network protocol type supported by the proxy service, and the port number corresponding to the target environment are allocated to the access end as the target gateway access information; and, when it is determined that any proxy service has an abnormality, the basic channel based on the any proxy service is smoothly switched to a basic channel based on other proxy services, and the other proxy services are proxy services among the multiple proxy services except the any proxy service.

[0245] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.

[0246] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0247] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

Claims

1. A method for controlling network communication, characterized in that: Applied to a gateway system, the gateway system has a basic channel established in advance with a target environment, and the target environment is deployed in an internal network; the method includes: Receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information; In the case where it is determined according to the authentication information that the access terminal has passed the authentication, the target gateway access information corresponding to the target environment is allocated to the access terminal, and the source IP address of the access request is granted access rights to the target gateway access information; In response to receiving the data request, forwarding the data request to the target environment through a basic channel corresponding to the target environment if it is confirmed that the data request includes the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information; The determining, according to the authentication information, that the access terminal passes the authentication includes: In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed; In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

2. The method according to claim 1, characterized in that The allocating target gateway access information corresponding to the target environment to the access terminal includes: Determine, according to the correspondence between the identity information of each access terminal and the basic channel recorded by the gateway system, and the identity information of the access terminal carried in the access request, a basic channel set corresponding to the access terminal, wherein the basic channel set includes at least one basic channel corresponding to the target environment; A basic channel is selected from the basic channel set, and the gateway access information corresponding to the basic channel is returned to the access terminal as the target gateway access information.

3. The method according to claim 2, characterized in that In the case where the source IP address of the access request adopts a static IP address, the identity information is the source IP address of the access request; In the case where the source IP address of the access request is a dynamic IP address, the identity information is the access end account carried in the access request.

4. The method according to claim 1, characterized in that: The gateway system is deployed with management services and proxy services; wherein, The management service is used to: process the access request, allocate the target gateway access information to the access terminal, and inform the proxy service of the source IP address of the access request that is granted access rights; The proxy service is used to: process the data request, and forward the data request through a basic channel established between the proxy service and the target environment.

5. The method according to claim 4, characterized in that Multiple proxy services are deployed independently in the gateway system; A basic channel is established between each proxy service and one or more environments.

6. The method according to claim 5, characterized in that The allocating the target gateway access information corresponding to the target environment to the access terminal comprises: the management service determines, from the multiple proxy services, a proxy service with which a basic channel is established with the target environment, and allocates the determined IP address of the proxy service, the network protocol type supported by the proxy service, and the port number corresponding to the target environment as the target gateway access information to the access terminal; Granting access rights to the target gateway access information to the source IP address of the access request includes: the management service sending the source IP address of the access request to the determined proxy service, so that the proxy service records it as an IP address with access rights.

7. The method according to claim 4, characterized in that The method further comprises: In the case where forwarding rules for the target environment have been pre-established at the proxy service, the proxy service establishes an import rule for the source IP address based on the source IP address of the access request informed by the management service, and the import rule is used to import the data request from the source IP address into the forwarding rule, so as to forward the data request to the target environment through the forwarding rule.

8. The method according to claim 4, characterized in that The number of the proxy services establishing the basic channel with the target environment is multiple; The management service is also used to: Based on the load information provided by multiple proxy services, the IP address corresponding to the proxy service with better load conditions, the network protocol type supported by the proxy service, and the port number corresponding to the target environment are allocated to the access end as the target gateway access information; and, when it is determined that any proxy service has an abnormality, the basic channel based on the any proxy service is smoothly switched to a basic channel based on other proxy services, and the other proxy services are proxy services among the multiple proxy services except the any proxy service.

9. A method for controlling network communication, characterized in that: A management service applied to a gateway system deployment, wherein the gateway system is also deployed with an agent service, wherein the gateway system has previously established a basic channel with a target environment, and the target environment is deployed in an internal network; the method comprises: Receiving an access request initiated by an access terminal from an external network for the target environment, wherein the access request includes authentication information; In the case where it is determined according to the authentication information that the access terminal has passed the authentication, target gateway access information corresponding to the target environment is allocated to the access terminal, and access rights for the target gateway access information are granted to the source IP address of the access request, so that the proxy service, in response to receiving the data request, forwards the data request to the target environment through the basic channel corresponding to the target environment in the case where it is confirmed that the data request includes the target gateway access information and the source IP address of the data request is granted access rights for the target gateway access information; The determining, according to the authentication information, that the access terminal passes the authentication includes: In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed; In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

10. A method for controlling network communication, characterized in that: A proxy service applied to a gateway system deployment, wherein the gateway system is also deployed with a management service, wherein the management service is used to receive an access request initiated by an access terminal from an external network for a target environment, and when it is determined that the access terminal has passed the authentication according to the authentication information contained in the access request, allocate the target gateway access information corresponding to the target environment to the access terminal, and grant the source IP address of the access request access rights for the target gateway access information; The gateway system has established a basic channel with the target environment in advance, and the target environment is deployed in an internal network; the method includes: A data request is received; When confirming that the data request includes the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information, forwarding the data request to the target environment through a basic channel corresponding to the target environment; The determining, according to the authentication information included in the access request, that the access terminal passes the authentication includes: In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed; In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

11. A network communication control method for a private cloud environment, characterized in that: Applied to a gateway system, the gateway system has previously established a basic channel with a target private cloud environment; the method comprises: Receiving an access request initiated by an access terminal for the target private cloud environment, wherein the access request includes authentication information; In the case where it is determined according to the authentication information that the access terminal has passed the authentication, target gateway access information corresponding to the target private cloud environment is allocated to the access terminal, and access rights to the target gateway access information are granted to the source IP address of the access request; In response to receiving the data request, forwarding the data request to the target private cloud environment through a basic channel corresponding to the target private cloud environment, if confirming that the data request includes the target gateway access information and the source IP address of the data request is granted access rights to the target gateway access information; The determining, according to the authentication information, that the access terminal passes the authentication includes: In the case where the source IP address of the access request adopts a static IP address, the source IP address of the access request is determined as the authentication information; wherein, if the authentication information matches the pre-registered IP address, the authentication is passed; In the case where the source IP address of the access request is a dynamic IP address, the account password and / or authorization certificate carried in the access request is determined as the authentication information; wherein, if the account password is verified correctly and / or the authorization certificate is confirmed to be valid, the authentication is passed.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 11 are implemented.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 11 are implemented.

Images