Access method, configuration method, device and electronic equipment of NAS server

Abstract

The present disclosure provides an access method, a configuration method, an apparatus and an electronic device of a NAS server. The present disclosure relates to the technical field of cloud computing. The specific scheme is: the method is applied to a first physical machine, and a virtual network card associated with each user in N users is pre-configured in the first physical machine; the method comprises: receiving a first request sent by a client of a first user; wherein the target address in the first request is a first address of a first virtual network card associated with the first user in the first physical machine; determining a second address of a NAS server associated with the first user based on a flow table rule pre-configured in association with the first virtual network card; and forwarding the first request to the NAS server based on the second address. According to the present disclosure, by using the transit physical machine to forward the data request, the network isolation between different users can be realized, the cost of the NAS file sharing service can be reduced, the transit efficiency can be improved, and high-speed forwarding can be realized.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to cloud computing technology. In particular, it relates to a NAS (Network Attached Storage) server access method, a configuration method, an apparatus and an electronic device. BACKGROUND

[0002] In a cloud computing environment, a NAS file sharing service is provided for users while network isolation between different users is ensured. To achieve the above functions, a transit virtual machine is generally used to forward data requests. However, the transit virtual machine cannot be shared between different users. Therefore, a transit virtual machine needs to be created in the cloud environment for each NAS shared disk created. The more NAS shared disks used by the user, the more computing resources occupied, increasing the cost of the NAS file sharing service. Therefore, a more efficient resource management design is needed to optimize the computing cost and storage cost. SUMMARY

[0003] The present disclosure provides a NAS server access method, apparatus, electronic device and storage medium.

[0004] According to a first aspect of the present disclosure, a NAS server access method is provided, applied to a first physical machine, wherein a virtual network card associated with each user in N users is pre-configured in the first physical machine, wherein different users are associated with different virtual network cards, and N is an integer greater than or equal to 1; the method comprises:

[0005] receiving a first request sent by a client of a first user; wherein the target address in the first request is a first address of a first virtual network card associated with the first user in the first physical machine;

[0006] determining a second address of a NAS server associated with the first user based on a pre-configured flow table rule associated with the first virtual network card;

[0007] forwarding the first request to the NAS server based on the second address.

[0008] According to a second aspect of the present disclosure, a configuration method is provided, comprising:

[0009] in response to receiving a NAS shared disk creation command, creating a NAS shared disk associated with a second user in a NAS server in a cloud environment;

[0010] The transit creation command is used to instruct the first physical machine to create a network isolation module associated with the second user, to configure a second virtual network card associated with the second user in the network isolation module, and to create a flow table rule in a virtual machine switching component of the first physical machine based on the second virtual network card and address information of the NAS server.

[0011] According to a third aspect of the present disclosure, an access apparatus of a NAS server is provided, and is applied to a first physical machine, wherein the first physical machine is preconfigured with a virtual network card associated with each of N users, wherein different users are associated with different virtual network cards, and N is an integer greater than or equal to 1; the apparatus comprises:

[0012] A first receiving module is configured to receive a first request sent by a client of a first user; wherein a target address in the first request is a first address of a first virtual network card associated with the first user in the first physical machine;

[0013] A determining module is configured to determine a second address of a NAS server associated with the first user based on a preconfigured flow table rule associated with the first virtual network card;

[0014] A forwarding module is configured to forward the first request to the NAS server based on the second address.

[0015] According to a fourth aspect of the present disclosure, a configuration apparatus is provided, and comprises:

[0016] A third creating module is configured to create a NAS shared disk associated with a second user in a NAS server in a cloud environment in response to receiving a NAS shared disk creation command;

[0017] A third sending module is configured to send a transit creation command to the first physical machine; wherein the transit creation command carries address information of the NAS server associated with the second user; the transit creation command is used to instruct the first physical machine to create a network isolation module associated with the second user, to configure a second virtual network card associated with the second user in the network isolation module, and to create a flow table rule in a virtual machine switching component of the first physical machine based on the second virtual network card and address information of the NAS server.

[0018] According to a fifth aspect of the present disclosure, an electronic device is provided, and comprises:

[0019] at least one processor;

[0020] a memory in communication with the at least one processor;

[0021] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the access method of the NAS server provided in the first aspect and / or the configuration method provided in the second aspect.

[0022] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, where the computer instructions are used to enable a computer to perform the access method of the NAS server provided in the first aspect and / or the configuration method provided in the second aspect.

[0023] According to a seventh aspect of the present disclosure, a computer program product is provided, including a computer program stored on a storage medium, and the computer program, when executed by a processor, implements the access method of the NAS server provided in the first aspect and / or the configuration method provided in the second aspect.

[0024] The solution of the present disclosure can realize traffic transfer for different users on the same physical machine and isolation between different users by forwarding requests from clients of users to the physical machine in which virtual network cards respectively associated with different users are configured, so that the requests of different users are transferred through different virtual network cards. On the one hand, the computing and storage resources in the physical machine do not need to be specially allocated to a specific user, but can be shared by multiple users in the case of mutual isolation; and by using the scheduling of the physical machine itself, the computing resource and storage resource can be occupied only when there is forwarding business, so that the computing cost and storage cost of the NAS file sharing service can be reduced while the security of the NAS file system is ensured. On the other hand, the deployment of the physical machine does not need to configure a virtualization layer and is not subject to the network IO (Input / Output) limitation of the virtual machine, so that the transfer efficiency can be improved and high-speed forwarding can be realized.

[0025] The above summary is intended to illustrate only and is not intended to limit in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features will be readily apparent to those skilled in the art by reference to the drawings and the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0026] In the drawings, like numerals refer to like elements throughout the various drawings. The drawings are not necessarily to scale, the emphasis instead being placed on the principles of the application. It should be understood that the drawings are merely depictions of some embodiments of the application and should not be construed as limiting the scope of the application.

[0027] Figure 1 is a flowchart of an access method of a NAS server according to an embodiment of the present disclosure;

[0028] Figure 2 is a scenario schematic diagram of an access method of a NAS server according to an embodiment of the present disclosure;

[0029] Figure 3 is a flow schematic diagram of a configuration method according to an embodiment of the present disclosure;

[0030] Figure 4 is a flow schematic diagram of traffic forwarding of a NAS according to an embodiment of the present disclosure;

[0031] Figure 5 is a structural schematic diagram of an access device of a NAS server according to an embodiment of the present disclosure;

[0032] Figure 6 is a structural schematic diagram of a configuration device according to an embodiment of the present disclosure;

[0033] Figure 7 is a structural schematic diagram of an electronic device for implementing an access method and / or a configuration method of a NAS server according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] The present disclosure will be further described below with reference to the drawings. The same reference numbers in the drawings represent the same or similar elements. Although various aspects of the embodiments are shown in the drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

[0035] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following detailed description. It should be understood by those skilled in the art that the present disclosure can also be implemented without some specific details. In some examples, methods, means, elements and circuits that are well known to those skilled in the art are not described in detail in order to highlight the main ideas of the present disclosure.

[0036] The term "and / or" herein indicates that there can be three relationships, for example, A and / or B can indicate that A exists alone, A and B exist together, and B exists alone. The term "at least one" herein indicates any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B and C can indicate including any one or more elements selected from the set consisting of A, B and C. The terms "first", "second" herein indicate that a plurality of similar technical terms are referred to and distinguished, and do not mean to limit the order or mean to limit to only two, for example, the first feature and the second feature refer to two categories / two features, the first feature can be one or more, and the second feature can also be one or more.

[0037] In the related art, in a cloud computing environment, a NAS file sharing service is provided for users while network isolation between different users is ensured. In order to achieve the above functions, a transit virtual machine is generally used to forward data requests. Specifically, a transit virtual machine has two network interfaces, one of which is used to configure the Internet Protocol (IP) address of the customer network, and the other is used to configure the IP address of the network where the storage server is located. Through the Network Address Translation (NAT) function of the information packet filtering system (iptables), the traffic accessing the IP address in the customer network is forwarded to the network where the NAS storage server is located. The user only needs to access the address in his own network to realize the mounting of the NAS.

[0038] The scheme of using a transit virtual machine to forward data requests has the following problems:

[0039] 1. The transit virtual machine cannot be shared between different users. Therefore, a transit virtual machine needs to be created in the cloud environment for each NAS shared disk. The more NAS shared disks the user creates, the more computing resources are occupied, increasing the cost of the NAS file sharing service.

[0040] 2. In actual use scenarios, the frequency of user access to the NAS shared disk is not high, and there is no data flow on the transit machine in most periods of a day, but a large amount of computing resources are occupied.

[0041] 3. The deployment of the virtual machine needs to be based on the virtualization layer to realize the network IO (Input / Output), which is limited by the virtualization layer, and the bandwidth is relatively small, thereby affecting the transit efficiency.

[0042] The present disclosure proposes a NAS server access method to at least partially solve one or more of the above problems and other potential problems. By using a transit physical machine to forward data requests, network isolation between different users can be achieved, which helps to improve the security of the NAS file system. At the same time, the computing power cost and storage cost of the NAS file sharing service are reduced.

[0043] Embodiments of the present application provide a NAS server access method, which can be applied to a first physical machine. The first physical machine is pre-configured with a virtual network card associated with each of N users, wherein different users are associated with different virtual network cards. The first physical machine includes but is not limited to fixed devices and / or mobile devices. For example, fixed devices include but are not limited to servers, desktop computers, etc., and servers can be cloud servers or ordinary servers. For example, mobile devices include but are not limited to mobile phones, tablet computers, etc. As shown in Figure 1 The NAS server access method includes:

[0044] S101: receiving a first request sent by a client of a first user; wherein the target address in the first request is a first address of a first virtual network card associated with the first user in the first physical machine;

[0045] S102: determining a second address of a NAS server associated with the first user based on a pre-configured flow table rule associated with the first virtual network card;

[0046] S103: forwarding the first request to the NAS server based on the second address.

[0047] Embodiments of the present application are applied to access a NAS server. The NAS server is a dedicated storage server, which is connected to a client computer through a network and provides file storage, backup, sharing and other services. The NAS device is usually composed of storage hardware, operating system and file system, and can be regarded as a simplified dedicated server, which is specially used for storing and sharing files. The main functions of the NAS server include file sharing, data backup, data recovery, data encryption and remote access, etc. Multiple users can access and share folders or files on the NAS server through the network at the same time, thereby improving work efficiency. In addition, the NAS server can also automatically backup the data of the user regularly to prevent data loss, and quickly recover the backup data in case of data loss or damage to ensure business continuity. In practical applications, the NAS server is usually configured with a NAS shared disk for users to provide cloud storage services in the form of a NAS shared disk.

[0048] In the embodiments of the present application, a first physical machine is deployed as a relay between the NAS server and the client of the user. The first physical machine refers to a physical machine. The first physical machine is used to forward the traffic of the client reading and writing the NAS to the NAS storage server to realize network isolation between different users. The physical machine (Physical Machine) refers to a real computer hardware device with physical form. In general, the physical machine can include a central processing unit (Central Processing Unit, CPU), a random access memory (Random Access Memory, RAM), a hard disk, a graphics card, a motherboard, a power supply, and the like. Exemplarily, the first physical machine can be a physical machine using an x86 system. In addition, as an optional manner, the first physical machine can be deployed in a cloud environment, for example, in the same cloud environment as the NAS server.

[0049] In the embodiments of the present application, the first physical machine is preconfigured with a virtual network card associated with each of the N users. The virtual network card refers to a network interface card (Network Interface Card, NIC) simulated by software on a physical computer. In the first physical machine, different users are associated with different virtual network cards, and N is an integer greater than or equal to 1. That is, for communication with different users, the first physical machine communicates with the client through different network interfaces. For example, the first physical machine a is preconfigured with three virtual network cards (denoted as virtual network card 1, virtual network card 2, and virtual network card 3) associated with three users (denoted as user A, user B, and user C) respectively. Among them, user A is associated with virtual network card 1, user B is associated with virtual network card 2, and user C is associated with virtual network card 3.

[0050] Optionally, in some embodiments, the first virtual network card associated with the first user can include two virtual network cards, one of which is configured to communicate with the network of the first user, and the other is configured to communicate with the network where the NAS server is located (for example, the above-mentioned cloud environment). The first virtual network card can be created based on a network isolation technology to prevent requests from other users from flowing to the first virtual network card associated with the first user. Exemplarily, the creation of the first virtual network card can include creating a namespace (Namespace) on the first physical machine; creating two virtual network cards on the Namespace, and configuring the IP addresses of the network of the first user and the NAS server network respectively. Here, the Namespace is a linux network isolation technology, which is used to realize network isolation between different Namespaces, and the networks within the same Namespace can communicate.

[0051] In the embodiments of the present application, the client of the first user includes but is not limited to a fixed device and / or a mobile device. For example, the fixed device includes but is not limited to a desktop computer, a notebook computer, etc. For example, the mobile device includes but is not limited to a mobile phone, a tablet computer, etc. Optionally, multiple clients can be deployed in the network of the first user, and the multiple clients can respectively initiate the first request to access the NAS server.

[0052] In the embodiments of the present application, the first request can be a request of any service type, including but not limited to a connection creation request, a data read / write request, etc. In some embodiments, the first request can include an identity number (ID) of the first user and an IP address of the first virtual network card associated with the first user in the first physical machine. The above is only an exemplary description and is not intended to limit all possible contents included in the first request. Here, an exhaustive enumeration is not made.

[0053] According to the above method, the first request initiated by the client of the first user carries a target address, which is the first address of the first virtual network card associated with the first user in the first physical machine. In this way, the first physical machine receives the first request through the first virtual network card. Then, the first physical machine determines the second address of the NAS server associated with the first user based on the pre-configured flow table rule, so as to forward the first request to the NAS server based on the second address.

[0054] In some embodiments, the flow table rule is used to perform NAT on the traffic of the client virtual machine. Exemplarily, the flow table rule can include mapping relationship information between the first address of the first virtual network card and the second address, so that the first physical machine can forward the request with the target address being the first address of the first virtual network card to the NAS server pointed to by the second address according to the mapping relationship information. Optionally, the flow table rule is set on an open source virtual switch component (OpenvSwitch, OVS) in the first physical machine.

[0055] The solution of the present disclosure can realize traffic transfer for different users on the same physical machine and isolation between different users by forwarding the request from the client of a user to a physical machine in which a virtual network card associated with different users is configured, so that the request of different users is transferred through different virtual network cards. In one aspect, the computing and storage resources in the physical machine do not need to be allocated to a specific user, but multiple users can share the resources while being isolated from each other; and by using the scheduling of the physical machine itself, the computing resource and storage resource can be occupied only when there is forwarding business, so that the computing cost and storage cost of the NAS file sharing service can be reduced while ensuring the security of the NAS file system. On the other hand, the deployment of the physical machine does not need to configure a virtualization layer and will not be subject to network IO limitations similar to virtual machines, which can improve the transfer efficiency and realize high-speed forwarding.

[0056] Figure 2 A scene diagram of an access method of a NAS server is shown, as shown in Figure 2 The scene of the access of the NAS server can include a client virtual machine, a first physical machine, and a NAS storage server. The client virtual machine is a user of a NAS file storage service and mounts a NAS file system to read and write the system content. The first physical machine (also referred to as a NAS transfer machine) is used to forward the traffic of the client virtual machine reading and writing the NAS to the NAS storage service to realize network isolation between different users. The NAS storage server provides a NAS file system service for the client. The first physical machine can include an Openvswitch and a Namespace. The OpenvSwitch is an open-source virtual machine switch component, and a flow table rule is set on the OpenvSwitch to realize NAT forwarding of the traffic of the client virtual machine. The Namespace is used to realize that the networks between different Namespaces are not interconnected, and the networks within the same Namespace can communicate.

[0057] Here, the NAS traffic generally refers to the traffic connected to the NAS device through the network for data transmission (including the first request described above). These NAS devices are usually designed for storing a large amount of data and can be accessed by multiple client devices (such as computers, servers, etc.) through a network (such as Ethernet) at the same time.

[0058] In the above scenario, the NAT capability of Openvswitch is utilized to realize the relay of the NAS access traffic. Compared with the forwarding scheme of using relay virtual machines, less computing resources and memory resources are occupied. One relay physical machine can support the mounting forwarding requests of hundreds of NAS shares. Openvswitch can also be combined with the DataPlane Development Kit (DPDK) technology to realize low-latency, high-bandwidth, low-resource-occupied traffic forwarding, which greatly reduces the cost of data center construction.

[0059] In some embodiments, forwarding the first request to the NAS server based on the second address comprises: converting the source address in the first request into the first address of the first virtual network card and converting the target address in the first request into the second address of the NAS server after the conversion, and then sending the first request.

[0060] Exemplarily, in the case where the first virtual network card comprises a virtual network card facing the user network and a virtual network card facing the NAS server network, the address of the first virtual network card comprises the address of the virtual network card facing the user network and the address of the virtual network card facing the NAS server network. The source address in the first request received by the first physical machine is the client address in the user network (i.e. the address of the client of the first user), and the target address is the address of the virtual network card facing the user network. The first physical machine can convert the source address in the first request into the address of the virtual network card facing the user network, and convert the target address in the first request into the address of the NAS server (i.e. the second address), and then send the first request. In this way, the first request will be received by the NAS server, and the NAS server can send a response message for the first request to the first virtual network card (the virtual network card facing the NAS server network) according to the source address in the received first request.

[0061] In some embodiments, the above steps are implemented based on a NAT technology. Specifically, the conversion of the source address in the first request to the first address of the first virtual network card is based on source network address translation (SNAT). The conversion of the target address in the first request to the second address of the NAS server is based on destination network address translation (DNAT). NAT is a technology of rewriting the source IP address or / and port of an IP packet when the IP packet passes through a network device such as a router or a firewall. NAT is usually used to solve the problem of IP address shortage, allowing one or more hosts in an internal network to access an external network (such as the Internet) through one or more legal IP addresses. NAT can also provide network security and isolation functions, as it hides the real IP address of the internal network.

[0062] The technical solution of the embodiments of the present disclosure is to convert the source address in the first request to the first address of the first virtual network card and convert the target address in the first request to the second address of the NAS server, and then send the first request. In this way, by converting the source address to the first address of the virtual network card, the real IP address of the internal network or the client can be hidden, thereby enhancing security.

[0063] In some embodiments, the access method of the NAS server further includes: receiving a first response message from the NAS server for the first request; wherein the target address of the first response message is the first address of the first virtual network card; and sending the first response message to the client based on the address of the client of the first user.

[0064] In the above embodiments, the first response information is issued by the NAS server, and the first response information is sent to the client via the first physical machine. The first response information can include: a processing result for the first request, response data or content. For example, the response data or content can include: a connection confirmation message, data read-write information, etc. The data read-write information includes but is not limited to various types of data such as HyperText Markup Language (HTML) documents, JavaScript Object Notation (JSON) data, pictures, videos, etc.

[0065] Exemplarily, the first physical machine sending the first response message to the client based on the address of the client of the first user can include: the first physical machine sending the first response message after converting a source address in the first response message into the first address of the first virtual network card and converting a target address in the first response message into the address of the client of the first user. The implementation process can be implemented correspondingly according to the address conversion of the first request in the foregoing embodiments, and details are not described herein.

[0066] The technical solution of the embodiments of the present disclosure receives a first response message for a first request from a NAS server; wherein the target address of the first response message is a first address of a first virtual network card; and sends the first response message to a client based on the address of the client of the first user. In this way, by using a virtual network card as an intermediate address, the real address of the NAS server can be protected to some extent from being directly exposed to the client. This helps to reduce direct attacks and probes on the NAS server and improves the security of the system.

[0067] In some embodiments, the first request is a Transmission Control Protocol (TCP) request; and before receiving the first request sent by the client of the first user, the access method of the NAS server further includes: receiving an Address Resolution Protocol (ARP) request in a network; wherein the target IP address in the ARP request matches the first virtual network card; and sending a second response message for the ARP request based on the first virtual network card; wherein the second response message carries a Media Access Control (MAC) address corresponding to the target IP address; and the MAC address is used by the client to send a TCP request to the first physical machine.

[0068] The above TCP request is used to establish a connection based on TCP in network communication. TCP is a connection-oriented, reliable, byte stream-based transmission protocol, and is an important part of the Internet communication protocol TCP / IP. In actual application, addressing needs to be performed before a connection is established based on the TCP request. In the above embodiments, the addressing is performed by sending an ARP request.

[0069] Specifically, in the above embodiment, the client of the first user knows the IP address of the first virtual network card in advance, takes the IP address as a target IP address, and first sends an ARP request containing the target IP address, for example, broadcasts the ARP request. Since the target IP address is the IP address of the first virtual network card, the first virtual network card will respond to the ARP request, take the MAC address of the first virtual network card as the MAC address corresponding to the target IP address, and feed back the MAC address through a second response message, so that the client can obtain the MAC address of the first virtual network card, and send the first request based on the MAC address and the IP address of the first virtual network card.

[0070] Optionally, the first request (i.e., the TCP request) can be used for a connection establishment process. The transmission process of the above first request and the first response message can be repeated between the client, the first physical machine, and the NAS server to complete the connection establishment process. After the connection establishment process, the client can read and write the shared disk created on the NAS server through the first physical machine.

[0071] The above embodiment provides a NAS server access process based on the TCP protocol. Based on the above embodiment, the TCP protocol can be used to realize low-latency, high-bandwidth, and low-resource-occupancy traffic forwarding.

[0072] In some embodiments, the address conversion in the above method can be implemented by using a virtual machine switch component. Specifically, based on the preconfigured flow table rule associated with the first virtual network card, the second address of the NAS server associated with the first user is determined, including: the virtual machine switch component in the first physical machine determines the second address of the NAS server associated with the first user based on the preconfigured flow table rule associated with the first virtual network card.

[0073] Exemplarily, the virtual machine switch component can include an OVS.

[0074] In some embodiments, the above method can further include a configuration process of the virtual switch component and the virtual network card. Specifically, before receiving the first request sent by the client of the first user, the access method of the NAS server further includes: in response to receiving a relay creation command, creating a network isolation module associated with the first user based on the address information of the NAS server associated with the first user carried in the relay creation command; configuring the first virtual network card associated with the first user in the network isolation module, and creating a flow table rule in the virtual machine switch component based on the first address of the first virtual network card and the address information of the NAS server.

[0075] The above embodiments can be implemented by a control device of a cloud environment. The control device can connect each NAS server and the first physical machine. The control device can deploy a NAS shared disk and a corresponding relay mechanism for a user in response to a NAS shared disk creation command initiated by the user. Specifically, the control device sends a relay creation command to the first physical machine, and the relay creation command includes address information of the NAS server associated with the user. Based on this, the first physical machine can create a network isolation module associated with the first user according to the address information of the NAS server, and create a flow table rule in the virtual machine switch component.

[0076] In some embodiments, the network isolation module can be a Namespace, which is used to create a first virtual network card associated with the first user, such as a virtual network card configured to face the user network and a virtual network card configured to face the NAS server network, respectively.

[0077] Optionally, the relay creation command can also include an access address configured by the control device for the first user, and the access address configured for the first user can be used as the address of the first virtual network card. The first physical machine can create the first virtual network card and the flow table rule according to the access address configured by the control device for the first user and the address of the associated NAS server. In addition, the control device also synchronizes the access address to the first user, so that the first user can initiate the first request according to the access address.

[0078] The technical solutions of the embodiments of the present disclosure, in response to receiving the relay creation command, creating a network isolation module associated with the first user based on the address information of the NAS server associated with the first user carried in the relay creation command; configuring a first virtual network card associated with the first user in the network isolation module, and creating a flow table rule in the virtual machine switch component based on the first address of the first virtual network card and the address information of the NAS server. In this way, by creating a dedicated network isolation module for the first user, it can be ensured that the data transmission and storage operations of the user are logically isolated, and the risk of data leakage or unauthorized access with other users or system components is reduced.

[0079] Correspondingly, the embodiments of the present disclosure provide a configuration method, Figure 3 is a flow diagram of the configuration method according to the embodiments of the present disclosure. The configuration method can be applied to an electronic device, including but not limited to fixed devices and / or mobile devices. For example, the fixed device includes but is not limited to a server, which can be a cloud server or a general server. For example, the mobile device includes but is not limited to a mobile phone, a tablet computer, and a scanning device. In some possible implementation manners, the configuration method can also be implemented by a processor invoking computer readable instructions stored in a memory. Optionally, the electronic device can be a control device of a cloud environment. As shown in FIG.Figure 3 As shown, the configuration method comprises:

[0080] S301: In response to receiving the NAS shared disk creation command, creating a NAS shared disk associated with the second user in the NAS server in the cloud environment;

[0081] S302: Sending a transit creation command to the first physical machine; wherein the transit creation command carries address information of the NAS server associated with the second user; the transit creation command is used to instruct the first physical machine to create a network isolation module associated with the second user, to configure a second virtual network card associated with the second user in the network isolation module, and to create a flow table rule in the virtual machine switching component of the first physical machine based on the second virtual network card and the address information of the NAS server.

[0082] Optionally, the NAS shared disk creation command can be sent by a client of the second user. That is, the NAS shared disk creation command is initiated by the second user, and the NAS shared disk and the corresponding transit mechanism are deployed for the second user by the control device of the cloud environment. Specifically, after the control device creates the NAS shared disk associated with the second user in the NAS server, the control device sends the transit creation command to the first physical machine, so that the first physical machine creates the corresponding virtual network card and flow table rule for the second user.

[0083] It can be understood that the above configuration method for the NAS shared disk creation command initiated by the second user can also be applied to the processing of the NAS shared disk creation command initiated by other users, such as the processing of the NAS shared disk creation command initiated by the first user. Therefore, the technical details in the above configuration method can be implemented by referring to the processing mode of the first physical machine for the transit creation command in the foregoing embodiments, which will not be described here.

[0084] Exemplarily, after the control device deploys the system, the user can call the interface to initiate the command to create the NAS shared disk, and the control device calls the interface to create the Namespace, the virtual network card and the flow table rule on the first physical machine (the transit machine) to implement the traffic forwarding. The client (the virtual machine) of the user accesses the IP address on the Namespace in the network segment, and can access the shared disk on the NAS server.

[0085] In order to facilitate understanding of the above technical solutions. Figure 4 A flowchart of the traffic forwarding of the NAS is shown, as shown in Figure 4 As shown, the flowchart can comprise:

[0086] S401: Start;

[0087] S402: Calling an interface to create a NAS shared disk on a NAS server;

[0088] S403: creating a network isolation module on the first physical machine;

[0089] S404: creating two virtual network cards on the network isolation module, respectively configuring IP addresses of the user network and the NAS server network, and accessing the OVS;

[0090] S405: creating a NAT flow table rule on the OVS to realize the traffic forwarding of the NAS;

[0091] S406: ending.

[0092] Correspondingly, the access method of the NAS server can include:

[0093] 1. The client virtual machine initiates an ARP request to access the mount point address. The virtual network card in the network isolation module responds to the ARP request;

[0094] 2. The client virtual machine initiates a TCP connection request to access the mount point address. The OVS performs SNAT and DNAT conversion on the request and forwards the connection to the NAS server;

[0095] 3. The NAS server responds to the TCP request of the client and establishes a connection with the first physical machine;

[0096] 4. The first physical machine performs NAT conversion on the server response and forwards it to the client virtual machine;

[0097] 5. The client virtual machine receives the response of the first physical machine and performs subsequent connection establishment steps;

[0098] 6. The first physical machine repeats the above SNAT and DNAT conversion and finally completes the connection establishment process. The client can read and write data to the NAS shared disk created on the NAS server through the first physical machine.

[0099] The technical solution of the embodiment of the disclosure responds to the received NAS shared disk creation command to create a NAS shared disk associated with the second user in the NAS server in the cloud environment; sends a relay creation command to the first physical machine; the relay creation command is used to instruct the first physical machine to create a network isolation module associated with the second user to configure a second virtual network card associated with the second user and a flow table rule in the network isolation module. In this way, an independent NAS shared disk and network isolation module are created for each user, which can effectively isolate data between different users and reduce the risk of data leakage and illegal access. By configuring the virtual network card and the flow table rule, the access permission of the user to the NAS shared disk can be further controlled to ensure the security of the data.

[0100] It should be understood that the schematic diagrams shown in the above respective figures are merely exemplary and not restrictive, and are extensible, and those skilled in the art can make various obvious changes and / or replacements based on the examples Figures 1-4 , and the resulting technical solutions still belong to the disclosure range of the embodiments of the present disclosure.

[0101] The embodiments of the present disclosure provide a NAS server access device, applied to a first physical machine, wherein a virtual network card associated with each user in N users is pre-configured in the first physical machine, wherein different users are associated with different virtual network cards, and N is an integer greater than or equal to 1, such as Figure 5 The NAS server access device includes: a first receiving module 501 configured to receive a first request sent by a client of a first user; wherein a target address in the first request is a first address of a first virtual network card associated with the first user in the first physical machine; a determining module 502 configured to determine a second address of a NAS server associated with the first user based on a flow table rule pre-configured and associated with the first virtual network card; and a forwarding module 503 configured to forward the first request to the NAS server based on the second address.

[0102] In some embodiments, the forwarding module 503 includes a conversion sub-module configured to convert a source address in the first request to the first address of the first virtual network card and convert the target address in the first request to the second address of the NAS server, and then send the first request.

[0103] In some embodiments, the NAS server access device further includes: a second receiving module (not shown in Figure 5 ) configured to receive a first response message from the NAS server for the first request; wherein a target address of the first response message is the first address of the first virtual network card; and a first sending module (not shown in Figure 5 ) configured to send the first response message to the client based on an address of the client of the first user.

[0104] In some embodiments, the first request is a transmission control protocol (TCP) request; and before receiving the first request sent by the client of the first user, the NAS server access device further includes: a third receiving module (not shown in Figure 5 ) configured to receive an address resolution protocol (ARP) request in a network; wherein a target internet protocol (IP) address in the ARP request matches the first virtual network card; and a second sending module (not shown in Figure 5 ) configured to send a second response message for the ARP request based on the first virtual network card; wherein the second response message carries a MAC address corresponding to the target IP address; and the MAC address is used to send the TCP request to the first physical machine.

[0105] In some embodiments, the determining module 502 comprises a determining sub-module configured to determine, by a virtual machine switch component in the first physical machine, a second address of a NAS server associated with the first user based on a pre-configured flow table rule associated with the first virtual network card; wherein, before receiving the first request sent by the client of the first user, the access device of the NAS server further comprises a first creating module (not shown in the figure) configured to create, in response to receiving a relay creating command, a network isolation module associated with the first user based on address information of the NAS server associated with the first user carried in the relay creating command; and a second creating module (not shown in the figure) configured to configure the first virtual network card associated with the first user in the network isolation module and create a flow table rule in the virtual machine switch component based on the first address of the first virtual network card and the address information of the NAS server. Figure 5 In some embodiments, the determining module 502 comprises a determining sub-module configured to determine, by a virtual machine switch component in the first physical machine, a second address of a NAS server associated with the first user based on a pre-configured flow table rule associated with the first virtual network card; wherein, before receiving the first request sent by the client of the first user, the access device of the NAS server further comprises a first creating module (not shown in the figure) configured to create, in response to receiving a relay creating command, a network isolation module associated with the first user based on address information of the NAS server associated with the first user carried in the relay creating command; and a second creating module (not shown in the figure) configured to configure the first virtual network card associated with the first user in the network isolation module and create a flow table rule in the virtual machine switch component based on the first address of the first virtual network card and the address information of the NAS server. Figure 5 In some embodiments, the determining module 502 comprises a determining sub-module configured to determine, by a virtual machine switch component in the first physical machine, a second address of a NAS server associated with the first user based on a pre-configured flow table rule associated with the first virtual network card; wherein, before receiving the first request sent by the client of the first user, the access device of the NAS server further comprises a first creating module (not shown in the figure) configured to create, in response to receiving a relay creating command, a network isolation module associated with the first user based on address information of the NAS server associated with the first user carried in the relay creating command; and a second creating module (not shown in the figure) configured to configure the first virtual network card associated with the first user in the network isolation module and create a flow table rule in the virtual machine switch component based on the first address of the first virtual network card and the address information of the NAS server.

[0106] Those skilled in the art should understand that the functions of the various processing modules in the access device of the NAS server of the embodiments of the present disclosure can be understood with reference to the foregoing description of the access method of the NAS server, and the various processing modules in the access device of the NAS server of the embodiments of the present disclosure can be implemented by generating circuits that implement the functions of the embodiments of the present disclosure or by running software that implements the functions of the embodiments of the present disclosure on an electronic device.

[0107] The access device of the NAS server of the embodiments of the present disclosure can achieve network isolation between different users by adopting the scheme of forwarding data requests by a relay physical machine, which helps to improve the security of the NAS file system. At the same time, the computing power cost and storage cost of the NAS file sharing service are reduced.

[0108] The embodiments of the present disclosure provide a configuration device, as shown in Figure 6 The configuration device comprises a third creating module 601 configured to create, in response to receiving a NAS shared disk creating command, a NAS shared disk associated with a second user in a NAS server in a cloud environment; and a third sending module 602 configured to send a relay creating command to a first physical machine; wherein, the relay creating command carries address information of the NAS server associated with the second user; and the relay creating command is used to instruct the first physical machine to create a network isolation module associated with the second user, to configure a second virtual network card associated with the second user in the network isolation module, and to create a flow table rule in a virtual machine switch component of the first physical machine based on the second virtual network card and the address information of the NAS server.

[0109] In the technical solutions of the present disclosure, the acquisition, storage and application of user personal information comply with relevant laws and regulations and do not violate public order and good customs.

[0110] Figure 7 FIG. 1 is a structural block diagram of an electronic device according to an embodiment of the present disclosure. Figure 7 As shown, the electronic device includes: a memory 710 and a processor 720. The memory 710 stores a computer program that can be executed on the processor 720. The number of memory 710 and processor 720 can be one or more. The memory 710 can store one or more computer programs. When the one or more computer programs are executed by the electronic device, the electronic device performs the method provided by the above method embodiment. The electronic device may also include: a communication interface 730 for communicating with external devices and performing data exchange.

[0111] If the memory 710, processor 720, and communication interface 730 are implemented independently, the memory 710, processor 720, and communication interface 730 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0112] Optionally, in a specific implementation, if the memory 710, the processor 720 and the communication interface 730 are integrated on a chip, the memory 710, the processor 720 and the communication interface 730 can communicate with each other through an internal interface.

[0113] It is to be understood that the above-described processor can be a Central Processing Unit (CPU), but can also be other general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic components, discrete hardware components, or the like. The general purpose processor can be a microprocessor or any conventional processor, or the like. It is to be appreciated that the processor can be an Advanced RISC Machines (ARM) architecture processor.

[0114] Further, the memory can include a read-only memory and a random access memory, and can further include a non-volatile random access memory. The memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory. The non-volatile memory can include a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can include a Random Access Memory (RAM) used as an external cache. By way of example, but not limitation, many forms of RAM can be used. For example, a Static Random Access Memory (SRAM), a Dynamic Random Access Memory (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synchlink DRAM (SLDRAM), and a Direct RAMBUS RAM (DR RAM) can be used.

[0115] In the above embodiments, all or part of the steps can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the steps can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present disclosure are generated. The computer can be a general purpose computer, a special purpose computer, a computer network or other programmable apparatus. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (for example: coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example: infrared, Bluetooth, microwave, etc.) mode. The computer readable storage medium can be any available medium accessible by a computer, or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example: floppy disk, hard disk, magnetic tape), an optical medium (for example: digital versatile disc (DVD)) or a semiconductor medium (for example: solid state disk (SSD)) and the like. It is worth noting that the computer readable storage medium mentioned in the present disclosure can be a non-volatile storage medium, in other words, it can be a non-transitory storage medium.

[0116] A person of ordinary skill in the art can understand that all or part of the steps of the above embodiments can be completed by hardware, or the program can instruct the related hardware to complete, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0117] In the description of the embodiments of the present disclosure, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples without contradiction.

[0118] In the description of the embodiments of the present disclosure, unless otherwise specified, " / " means or, for example, A / B can mean A or B. "And / or" in this document only describes the relationship between associated objects, which means that there can be three relationships, for example, A and / or B, which can mean: A exists alone, A and B exist together, and B exists alone.

[0119] In the description of the embodiments of the present disclosure, the terms "first", "second" are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "multiple" is two or more.

[0120] The above is only an exemplary embodiment of the present disclosure, and is not intended to limit the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for accessing a network attached storage (NAS) server, applied to a first physical machine, wherein: The first physical machine is pre-configured with a virtual network card associated with each of N users, wherein different users are associated with different virtual network cards, and N is an integer greater than or equal to 1; the method includes: In response to receiving the transfer creation command, based on the address information of the NAS server associated with the first user carried in the transfer creation command, create a network isolation module associated with the first user; wherein the network isolation module is a Namespace, and the Namespace is used to create a first virtual network card associated with the first user, the first virtual network card including a virtual network card configured as a user network-oriented virtual network card and a virtual network card configured as a NAS server network-oriented virtual network card; In the network isolation module, according to the access address configured by the control device for the first user and the address of the associated NAS server, a first virtual network card associated with the first user is created, and based on the first address of the first virtual network card and the address information of the NAS server, a flow table rule is created in the virtual machine switch component; Receiving an Address Resolution Protocol (ARP) request in a network; wherein a target Internet Protocol (IP) address in the ARP request matches a first virtual network card associated with a first user in the first physical machine; Sending, based on the first virtual network card, a second response message to the ARP request; wherein the second response message carries a MAC address corresponding to the target IP address; the MAC address is used by the first user's client to send a first request to the first physical machine, where the first request is a Transmission Control Protocol (TCP) request; Receive a first request sent by a client of the first user; wherein the target address in the first request is the first address of the first virtual network card, and the first virtual network card includes two virtual network cards, one of which is configured to communicate with the user network of the first user, and the other is configured to communicate with the network where the NAS server is located; The virtual machine switch component in the first physical machine determines the second address of the NAS server associated with the first user based on a pre-configured flow table rule associated with the first virtual network card; wherein the flow table rule includes mapping relationship information between the first address of the first virtual network card and the second address; Based on the second address, forward the first request to the NAS server.

2. The method according to claim 1, wherein The forwarding the first request to the NAS server based on the second address includes: After converting the source address in the first request into the first address of the first virtual network card and converting the target address in the first request into the second address of the NAS server, the first request is sent.

3. The method according to claim 1 or 2, wherein: The method further comprises: receiving a first response message from the NAS server for the first request; wherein the target address of the first response message is the first address of the first virtual network card; Based on the address of the client of the first user, the first response message is sent to the client.

4. A configuration method, comprising: In response to receiving the NAS shared disk creation command, creating a NAS shared disk associated with the second user in a NAS server in the cloud environment; Send a transit creation command to the first physical machine; wherein the transit creation command carries the address information of the NAS server associated with the second user; the transit creation command is used to instruct the first physical machine to create a network isolation module associated with the second user, so as to configure the second virtual network card associated with the second user in the network isolation module, and based on the second virtual network card and the address information of the NAS server, create a flow table rule in the virtual machine switching component of the first physical machine; the flow table rule is used by the first physical machine to execute the method as described in any one of claims 1 to 3.

5. A NAS server access device, applied to a first physical machine, wherein: The first physical machine is pre-configured with a virtual network card associated with each of N users, wherein different users are associated with different virtual network cards, and N is an integer greater than or equal to 1; the apparatus comprises: A first creation module, configured to, in response to receiving a transfer creation command, create a network isolation module associated with the first user based on address information of the NAS server associated with the first user carried in the transfer creation command; wherein the network isolation module is a Namespace, and the Namespace is configured to create a first virtual network card associated with the first user, the first virtual network card including a virtual network card configured as a user network-oriented virtual network card and a virtual network card configured as a NAS server network-oriented virtual network card; a second creation module, configured to create, in the network isolation module, a first virtual network card associated with the first user according to the access address configured by the control device for the first user and the address of the associated NAS server, and create a flow table rule in the virtual machine switch component based on the first address of the first virtual network card and the address information of the NAS server; a third receiving module, configured to receive an Address Resolution Protocol (ARP) request in a network; wherein a target Internet Protocol (IP) address in the ARP request matches a first virtual network card associated with the first user in the first physical machine; a second sending module, configured to send, based on the first virtual network card, a second response message to the ARP request; wherein the second response message carries a MAC address corresponding to the target IP address; the MAC address is used by the first user's client to send a first request to the first physical machine, the first request being a Transmission Control Protocol (TCP) request; a first receiving module, configured to receive a first request sent by a client of the first user; wherein the target address in the first request is the first address of the first virtual network card, the first virtual network card includes two virtual network cards, one of which is configured to communicate with the user network of the first user, and the other is configured to communicate with the network where the NAS server is located; a determination module, configured for the virtual machine switch component in the first physical machine to determine, based on a preconfigured flow table rule associated with the first virtual network card, a second address of the NAS server associated with the first user; wherein the flow table rule includes mapping relationship information between the first address of the first virtual network card and the second address; A forwarding module is configured to forward the first request to the NAS server based on the second address.

6. The device according to claim 5, wherein The forwarding module includes: The conversion submodule is configured to send the first request after converting the source address in the first request into the first address of the first virtual network card and converting the target address in the first request into the second address of the NAS server.

7. The device according to claim 5 or 6, wherein: The device further comprises: A second receiving module is configured to receive a first response message from the NAS server for the first request; wherein the target address of the first response message is the first address of the first virtual network card; The first sending module is configured to send the first response message to the client based on the address of the client of the first user.

8. A configuration device comprising: a third creating module, configured to create a NAS shared disk associated with the second user in the NAS server in the cloud environment in response to receiving the NAS shared disk creation command; A third sending module is used to send a transit creation command to the first physical machine; wherein the transit creation command carries the address information of the NAS server associated with the second user; the transit creation command is used to instruct the first physical machine to create a network isolation module associated with the second user, so as to configure the second virtual network card associated with the second user in the network isolation module, and create a flow table rule in the virtual machine switching component of the first physical machine based on the second virtual network card and the address information of the NAS server; the flow table rule is used by the first physical machine to execute the method as described in any one of claims 1 to 3.

9. An electronic device comprising: at least one processor; as well as a memory communicatively connected to at least one processor; wherein, The memory stores instructions that can be executed by at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 4.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: Computer instructions for causing a computer to perform a method according to any one of claims 1 to 4.

Images