Business access system

Abstract

The embodiment of the application discloses a service access system, and relates to the technical field of computers. The service access system comprises an arrangement server and at least two gateway servers, the arrangement server is in communication connection with each gateway server, the at least two gateway servers comprise a first gateway server and a second gateway server, and the first gateway server and the second gateway server are arranged in different resource pools. The arrangement server generates a first address mapping table and a second address mapping table according to a received access request and sends the first address mapping table and the second address mapping table to the first gateway server and the second gateway server respectively, the first gateway server and the second gateway server match received messages with respective address mapping tables respectively, further forwarding of the messages is realized, and finally, cross-resource-pool service access is realized. That is, the embodiment establishes bridging between gateway servers in different resource pools through the arrangement server, additional new strategies in the firewall gateway are not needed, and the cross-resource-pool service access process is simplified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a service access system. BACKGROUND

[0002] When performing cross-resource pool service access, currently, the cross-resource pool access is mainly realized based on Virtual Extensible Local Area Network (VxLAN) or Internet Protocol Security (IPsec) technology. This method usually needs to additionally open the cross-resource pool access policy on the firewall gateway, and the process is complex. SUMMARY

[0003] Embodiments of the present application provide a service access system, which can solve the problem that the related art needs to additionally open the cross-resource pool access policy on the firewall gateway when performing cross-resource pool service access, resulting in a complex service access process.

[0004] In a first aspect, the embodiments of the present application provide a service access system, comprising an orchestration server and at least two gateway servers, the orchestration server being in communication connection with the at least two gateway servers, the at least two gateway servers comprising a first gateway server and a second gateway server, the first gateway server being arranged in a first resource pool, and the second gateway server being arranged in a second resource pool;

[0005] The orchestration server is configured to generate a first address mapping table and a second address mapping table according to a received access request, and send the first address mapping table to the first gateway server and the second address mapping table to the second gateway server, wherein the first address mapping table comprises a first address mapping relationship between the first gateway server and the second gateway server, and the second address mapping table comprises a second address mapping relationship between the second gateway server and a message response server;

[0006] The first gateway server is configured to receive a first service request message sent by a message request server, update a first message header of the first service request message according to the first address mapping table to obtain a second service request message, and forward the second service request message to the second gateway server, wherein the message request server is arranged in the first resource pool;

[0007] The second gateway server is configured to update a second message header of the second service request message according to the second address mapping table to obtain a third service request message, and forward the third service request message to the message response server, wherein the message response server is arranged in the second resource pool.

[0008] The service access system of the embodiment of the present application comprises an orchestration server and at least two gateway servers, the orchestration server is in communication connection with the at least two gateway servers, the at least two gateway servers comprise a first gateway server and a second gateway server, and the first gateway server and the second gateway server are arranged in different resource pools. The orchestration server generates a first address mapping table and a second address mapping table according to a received access request and respectively issues the first address mapping table and the second address mapping table to the first gateway server and the second gateway server. The first gateway server and the second gateway server respectively match the received message with the respective address mapping table, realize further forwarding of the message, and finally realize service access across resource pools. That is, the embodiment of the present application establishes bridging between the gateway servers in different resource pools through the orchestration server, does not need to additionally add a policy in a firewall gateway, and simplifies the service access process across resource pools. BRIEF DESCRIPTION OF DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced. Those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0010] Figure 1 A structural diagram of a service access system provided by the embodiment of the present application is provided.

[0011] Figure 2 A structural diagram of another service access system provided by the embodiment of the present application is provided.

[0012] Figure 3 A forwarding flowchart of a message in a service access process provided by the embodiment of the present application is provided.

[0013] Figure 4 A structural diagram of another service access system provided by the embodiment of the present application is provided. DETAILED DESCRIPTION

[0014] The features and exemplary embodiments of various aspects of the present application will be described in detail below, in order to make the purposes, technical solutions and advantages of the present application more clear and apparent, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are configured only to explain the present application and are not configured to limit the present application. The present application can be implemented without some of these specific details by those skilled in the art. The following description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application.

[0015] It is to be noted that, in the present document, the terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between such entities or operations. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises... " does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the stated elements.

[0016] The embodiment of the present application provides a service access system, which can realize cross-resource-pool service access without opening a policy for realizing cross-resource-pool access on a firewall gateway.

[0017] Figure 1 A structure diagram of the service access system provided by the embodiment of the present application is shown in FIG. 1, which can include an orchestration server 101 and at least two gateway servers 102 and 103. Figure 1 Figure 1 Taking two gateway servers as an example, the two gateway servers are respectively a first gateway server 102 and a second gateway server 103.

[0018] The orchestration server 101 can be a cloud server or a physical device, and is mainly used for issuing an address mapping table to gateway servers in different resource pools according to a demand of a user, to realize cross-resource-pool service access.

[0019] The first gateway server 102 and the second gateway server 103 are located in different resource pools, that is, in different subnets. Figure 1 Taking an example in which the first gateway server 102 is located in a first resource pool 104 and the second gateway server 103 is located in a second resource pool 105, the first resource pool 104 and the second resource pool 105 can belong to a same tenant or belong to different tenants. That is, the embodiment of the present application can support cross-resource-pool service access of a same tenant, or can support cross-resource-pool service access of different tenants.

[0020] The cross-resource-pool service access of the same tenant can mean that a tenant server 1 in the first resource pool 104 accesses a service of a tenant server 2 in the second resource pool 105 by a tenant A. The tenant server 1 and the tenant server 2 both belong to the tenant A.

[0021] ​Supporting the service access of different tenants across resource pools can mean that tenant A accesses the service of tenant server 3 in the second resource pool 105 through tenant server 1 in the first resource pool 104. Tenant server 1 belongs to tenant A, and tenant server 3 belongs to tenant B. In this way, flexibility of service access is achieved.

[0022] The first resource pool 104 further includes a message request server 106, and the second resource pool 105 further includes a message response server 107. The message request server 106 and the message response server 107 can be multiple, and the message request server 106 and the message response server 107 can be referred to as tenant servers in different resource pools. Figure 1 For example, the first resource pool 104 includes two message request servers 106, and the second resource pool 105 includes two message response servers 107.

[0023] It should be noted that the message request server 106 and the message response server 107 are relative. In actual application, the message request server 106 can also serve as the message response server 107, and the message response server 107 can also serve as the message request server 106. The message request server 106 and the message response server 107 can be included in the same resource pool at the same time.

[0024] The specific functions of the orchestration server 101, the first gateway server 102, and the second gateway server 103 will be described below.

[0025] In the embodiment of the application, the orchestration server 101 is configured to generate a first address mapping table and a second address mapping table according to a received access request, and send the first address mapping table to the first gateway server 102 and the second address mapping table to the second gateway server 103.

[0026] The access request can be input by a user in the orchestration server 101, or sent to the orchestration server 101 by other electronic devices such as mobile phones, tablets, laptops, etc. The embodiment of the application does not limit this.

[0027] The access request can include an access resource pool, an accessed resource pool, and a port of a message response server in the accessed resource pool. The orchestration server 101 can create a first address mapping table and a second address mapping table according to the access resource pool, the accessed resource pool, and the port of the message response server in the accessed resource pool in the access request, thereby achieving a user-level network autonomous function. That is, the embodiment of the application enables users to customize cross-resource pool intercommunication of self-owned services by opening the orchestration server 101 to the users for control.

[0028] The first address mapping table includes a first address mapping relationship between the first gateway server 102 and the second gateway server 103, and the second address mapping table includes a second address mapping relationship between the second gateway server 103 and the message response server.

[0029] Taking the server A in the first resource pool 104 as an accessed resource pool and the server B in the second resource pool 105 as an accessed resource pool, and taking the port 8080 of the server B in the second resource pool 105 accessed by the server A in the first resource pool 104 as an example, it is assumed that the intranet network segment of the first resource pool 104 is 192.168.1.0 / 24, the intranet address of the first gateway server 102 is 192.168.1.2, and the extranet address of the first gateway server 102 is 10.10.1.2. The intranet network segment of the second resource pool 105 is 192.168.2.0 / 24, the intranet address of the second gateway server 103 is 192.168.2.2, and the extranet address of the second gateway server 103 is 10.10.1.3. The intranet address of the server A is 192.168.1.3, and the intranet address of the server B is 192.168.2.3. The server A can be any message request server 106 in the first resource pool 104, and the server B can be a message response server 107 in the second resource pool 105 capable of responding to the message request server 106.

[0030] Based on the above address information, the orchestration server 101 can generate a first address mapping table: 192.168.1.2:8080→10.10.1.3:8080, and a forwarding IP is 10.10.1.2, and a second address mapping table: 10.10.1.3:8080→192.168.2.3:8080, and a forwarding IP is 192.168.2.2.

[0031] The first gateway server 102 is configured to receive a first service request message sent by a message request server, update a first message header of the first service request message according to the first address mapping table to obtain a second service request message, and forward the second service request message to the second gateway server 103.

[0032] The message request server can be the server A in the above embodiment. The first message header of the first service request message can include first source address information and first destination address information. The first source address information can include a first source IP address and a first source port, and the first destination address information can include a first destination address and a first destination port.

[0033] The first source IP address is an internal network address of the message request server. For example, when the message request server is server A, the first source IP address is 192.168.1.3. The first source port is a port on the message request server. For example, a port can be randomly allocated as the first source port for the first service request message. For example, the port 40123 can be used as the first source port.

[0034] The first destination address is an internal network address of the first gateway server 102, and the first destination port is a port of the accessed server. For example, when the accessed server is server B, the first destination port is 8080.

[0035] After receiving the first service request message, the first gateway server 102 can update the first message header of the first service request message by using the first address mapping table, convert the network address from the internal network to the external network, and forward the new second service request message to the second gateway server 103 through the external network. It should be noted that the second service request message is different from the first service request message only in the message header.

[0036] The second gateway server 103 is configured to update the second message header of the second service request message according to the second address mapping table, obtain a third service request message, and forward the third service request message to a message response server for processing by the message response server.

[0037] Specifically, after receiving the second service request message, the second gateway server 103 can convert the second service request message from the IP and port of the external network to the IP and port of the internal network, convert the second service request message to the third service request message, that is, convert from the external network of the second resource pool 105 to the internal network of the second resource pool 105. At this time, the second gateway server 103 can forward the third service request message to the message response server through the internal network for response processing by the message response server.

[0038] The embodiments of the present application establish a bridge between the gateway servers in different resource pools by arranging the server, and can realize service access across the resource pools through multiple network address conversions, without the need to additionally add a policy in the firewall gateway, thereby simplifying the service access process across the resource pools.

[0039] In some embodiments, the first gateway server 102 can include a first internal network card and a first external network card, and the second gateway server 103 can include a second internal network card and a second external network card. That is, the first gateway server 102 and the second gateway server 103 of the embodiments of the present application can both communicate with the internal network and the external network.

[0040] The address of the first internal network card is referred to as the internal network address of the first gateway server 102, and the address of the first external network card can be referred to as the external network address of the first gateway server 102. Similarly, the address of the second internal network card can be referred to as the internal network address of the second gateway server 103, and the address of the second external network card can be referred to as the external network address of the second gateway server 103. In order to distinguish the internal network addresses and the external network addresses of the first gateway server 102 and the second gateway server 103, the internal network address and the external network address of the first gateway server 102 can be referred to as the first internal network address and the first external network address respectively, and the internal network address and the external network address of the second gateway server 103 can be referred to as the second internal network address and the second external network address respectively in the embodiments of the present application.

[0041] After receiving the message through the internal network, the first gateway server 102 can perform network address translation to convert the message from the internal network to the external network, and then send the message to the second gateway server 103 through the external network. After receiving the message, the second gateway server 103 can perform network address translation to convert the message from the external network to the internal network, and then send the message to the corresponding message response server through the internal network.

[0042] That is, the first gateway server and the second gateway server of the embodiments of the present application both have internal network cards and external network cards, so that under the bridging effect of the orchestration server, the cross-resource transmission of the service message can be realized through twice network address translation, and the corresponding message response server is reached, without the need to additionally add a policy in the firewall gateway, thereby simplifying the cross-resource pool service access process.

[0043] The network address conversion process will be described in detail below, and the specific process is as follows:

[0044] Taking the first service request message including first source address information and first destination address information, and the first address mapping table including the first external network address of the first gateway server 102 and the first mapping relationship between the first internal network address information of the first gateway server 102 and the second external network address information of the second gateway server 103 as an example, the first gateway server 102 is specifically used for:

[0045] Matching the first destination address information with the first address mapping table to obtain the second external network address information corresponding to the first destination address information and the first external network address;

[0046] Generating a second message header according to the first external network address and the second external network address information, the second message header including second source address information and second destination address information;

[0047] Replacing the first message header with the second message header to obtain a second service request message.

[0048] The second source address information can include a second source address and a second source port, and the second destination address information can include a second destination address and a second destination port.

[0049] Taking an example in which the first destination address information includes 192.168.1.2:8080, assuming that the first address mapping table includes: 192.168.1.2:8080→10.10.1.3:8080, and the forwarding IP is 10.10.1.2, the first destination address information is matched with the first address mapping table, the second external network address information 10.10.1.3:8080 corresponding to the first destination address information 192.168.1.2:8080 and the first external network address 10.10.1.2 can be obtained, at this time, 10.10.1.2 can be taken as the second source address, and a port 50123 is randomly allocated on 10.10.1.2 as the second source port, 10.10.1.3 is taken as the second destination address, and 8080 is taken as the second destination port.

[0050] The first service request message can obtain the second service request message after passing through the first gateway server 102, that is, the source IP of the message header is converted from the first source address 192.168.1.3 to the second source address 10.10.1.2, the source port is converted from the first source port 40123 to the second source port 50123, the destination IP is converted from the first destination address 192.168.1.2 to the second destination address 10.10.1.3, and the destination port remains unchanged and is still 8080.

[0051] Through the above network address conversion, the second service request message can be transmitted from the first resource pool to the second resource pool without opening an additional strategy on the firewall gateway, thereby reducing the cost.

[0052] Taking an example in which the second address mapping table includes a second mapping relationship between the second internal network address of the second gateway server and the second external network address information of the second gateway server and the response address information of the message response server, the second gateway server 103 is specifically used for:

[0053] Matching the second destination address information with the second address mapping table, the second internal network address and the response address information corresponding to the second destination address information are obtained.

[0054] Generating a third message header according to the second internal network address and the response address information, the third message header including third source address information and third destination address information;

[0055] Replacing the second message header with the third message header to obtain a third service request message.

[0056] Exemplarily, the third source address information can include a third source address and a third source port, and the third destination address information can include a third destination address and a third destination port.

[0057] Taking an example that the second address mapping table includes: 10.10.1.3:8080→192.168.2.3:8080, the forwarding IP is 192.168.2.2, and the second destination address information is: 10.10.1.3:8080, the second destination address information is matched with the second address mapping table, and the second intranet address 192.168.2.2 corresponding to the second destination address information 10.10.1.3:8080 and the reply address information 192.168.2.3:8080 can be obtained. At this time, 192.168.2.2 can be taken as the third source address, and a random port 60123 is allocated on 192.168.2.2 as the third source port, 192.168.2.3 is taken as the third destination address, and 8080 is taken as the third destination port.

[0058] The second service request message can obtain the third service request message after passing through the second gateway server 103, that is, the source IP of the message header is converted from the second source address 10.10.1.2 to the third source address 192.168.2.2, the source port is converted from the second source port 50123 to the third source port 60123, the destination IP is converted from the second destination address 10.10.1.3 to the third destination address 192.168.2.3, and the destination port remains unchanged and is still 8080.

[0059] Through the above network address conversion, the second service request message can be converted from the external network to the internal network, providing a basis for subsequent forwarding to the corresponding message reply server, without the need to open additional strategies on the firewall gateway, reducing the cost.

[0060] In actual application, the first service request message can not include the source address information and the destination address information. Only when the first service request message includes the source address information and the destination address information, the above network address conversion process is executed. Based on this, in some embodiments, the first gateway server 102 is specifically used for:

[0061] In the case that the first service request message includes the first source address information and the first destination address information, the first message header of the first service request message is updated according to the first address mapping table to obtain a second service request message, and the second service request is forwarded to the second gateway server 103.

[0062] In the embodiment of the present application, after receiving the first service request message, the first gateway server 102 needs to filter the first service request message, that is, it can check whether the message header of the first service request message contains source address information and destination address information, so as to filter the first service request message.

[0063] For example, when the message header of the first service request message does not contain source address information and destination address information, the first service request message can be directly forwarded or subjected to other operations. When the message header of the first service request message contains source address information and destination address information, the first service request message can be subjected to network address translation according to the first address mapping table, the message header thereof is updated to obtain a second service request message, and then the second service request message is forwarded to the second gateway server 103 through the external network.

[0064] That is, after receiving the first service request message, the first gateway server of the embodiment of the present application first checks the first service request message. Only when the message header of the first service request message meets the condition, the first service request message is subjected to network address translation to meet the service access demand of the user across the resource pool. That is, the embodiment of the present application can adaptively execute different strategies according to the type of the message, so as to meet different demands of the user.

[0065] After receiving the third service request message, the message reply server 107 can parse the third service request message to obtain a message body, and then process the message body to obtain a reply message and return the reply message to the message request server 106.

[0066] The return process of the reply message is similar to the transmission process of the request message, and also needs to be subjected to network address translation twice before reaching the message request server 106.

[0067] The return process of the reply message is described in detail below.

[0068] Exemplarily, the second gateway server 103 is further configured to receive the first reply message sent by the message reply server 107, match the fourth source address information and the fourth destination address information in the first reply message with the locally stored message forwarding session, obtain a second reply message, and send the second reply message to the first gateway server 102.

[0069] The first gateway server 102 is further configured to match the fifth source address information and the fifth destination address information in the second reply message with the locally stored message forwarding session, obtain a third reply message, and send the third reply message to the message request server 106.

[0070] In the process of transmitting service request messages, the forwarding session can be retained simultaneously when performing network address translation on the service request messages. Subsequently, when the message response server 107 returns a response message, it only needs to match it with the forwarding session retained on the gateway server, without having to look up the corresponding address mapping table again.

[0071] The source IP and source port of the first response message are 192.168.2.3:8080, and the destination IP and destination port are 192.168.2.2:60123. After the first response message arrives at the second gateway server 103, the second gateway server 103 matches the forwarding session based on the source IP, source port, destination IP, and destination port in the first response message, updates the source IP, source port, destination IP, and destination port in the first response message, and obtains the second response message. That is, after the first response message passes through the second gateway server 103, the second response message is obtained. The source IP and source port of the second response message are 10.10.1.3:8080, and the destination IP and destination port are 10.10.1.2:50123. At this time, the second gateway server 103 can forward the second response message to the first gateway server 102 through the external network.

[0072] Similarly, after the second response message arrives at the first gateway server 102, the first gateway server 102 can match and forward the session based on the source IP, source port, destination IP, and destination port of the second response message, and update the source IP, source port, destination IP, and destination port in the second response message to obtain the third response message. That is, after the second response message passes through the first gateway server 102, the third response message is obtained. The source IP and source port of the third response message are 192.168.1.2:8080, and the destination IP and destination port are 192.168.1.3:40123. At this time, the first gateway server 102 can forward the third response message to the message request server 106 through the internal network. Thus, cross-resource pool service access is realized.

[0073] In this embodiment of the application, through the bridging function of the orchestration server, cross-resource pool business access is achieved through four network address translations, without the need to additionally enable cross-resource pool access policies on the firewall gateway, thus simplifying the business access process.

[0074] In some embodiments, such as Figure 2 As shown, the business access system 10 may also include: a first firewall gateway 108 and a second firewall gateway 109, wherein the first firewall gateway 108 is set in the first resource pool 104 and the second firewall gateway 109 is set in the second resource pool 105.

[0075] The second gateway server 103 is specifically configured to send the second service request to the second gateway server 103 through the first firewall gateway 108 and the second firewall gateway 109 in sequence.

[0076] In the embodiment of the present application, the external network address 10.10.1.2 of the first gateway server 102 and the external network address 10.10.1.3 of the second gateway server 103 can pass through the firewall gateway for intercommunication, that is, through network address translation, the message can be converted from the internal network to the external network, and under the action of the external network address, the message can directly pass through the firewall gateway and enter the next resource pool, without the need of adding other strategies in the firewall gateway, thereby reducing the cost in the case of realizing cross-resource pool service access.

[0077] In some embodiments, as shown in Figure 2 The service access system 10 can further include a first gateway switch 1010 and a second gateway switch 1011.

[0078] The first gateway server 102 is in communication connection with the message request server 106 through the first gateway switch 1010, and the second gateway server 103 is in communication connection with the message response server 107 through the second gateway switch 1011.

[0079] In the embodiment of the present application, through four times of network address translation, the service access across the resource pools can be realized under the bridging of the server, without the need of changing or adding the strategy of the gateway switch, so that the transmission of other services will not be affected.

[0080] Taking the server A in the first resource pool accessing the port 8080 of the server B in the second resource pool as an example, the service access process across the resource pools provided by the embodiment of the present application will be described below. Figure 3 The FullNAT1 is the first gateway server in the first resource pool, and the FullNAT2 is the second gateway server in the second resource pool.

[0081] 1. The server A sends a request message to the FullNAT1, and the original message header of the request message is source IP: 192.168.1.3, destination IP: 192.168.1.2, source port: 40123 (random), and destination port: 8080.

[0082] 2. The destination IP and the destination port are matched with the first address mapping table, a port is randomly allocated on 10.10.1.2 for network address translation and forwarding, and the forwarding session is reserved.

[0083] 3. The request message is forwarded from FullNAT1 to FullNAT2, with the source IP and port in the message header being 10.10.1.2:50123, and the destination IP and port being 10.10.1.3:8080.

[0084] 4. The request message reaches FullNAT2, and FullNAT2 matches the second address mapping table according to the destination IP and port in the request message, and randomly allocates a port 60123 on 192.168.2.2 for network address translation and forwarding, while retaining the forwarding session.

[0085] 5. The request message is forwarded from FullNAT2 to server B, with the source IP and port in the message header being 192.168.2.2:60123, and the destination IP and port being 192.168.2.3:8080.

[0086] 6. Server B processes the request message and returns a response message.

[0087] 7. The response message is sent from server B, with the source IP and port in the message header being 192.168.2.3:8080, and the destination IP and port being 192.168.2.2:60123.

[0088] 8. The response message reaches FullNAT2, and FullNAT2 matches the forwarding session according to the source IP, source port, destination IP and destination port in the message, and performs network address translation and forwarding.

[0089] 9. The response message is forwarded from FullNAT2 to FullNAT1, with the source IP and port in the message header being 10.10.1.3:8080, and the destination IP and port being 10.10.1.2:50123.

[0090] 10. The response message reaches FullNAT1, and FullNAT1 matches the forwarding session according to the source IP, source port, destination IP and destination port in the message, and performs network address translation and forwarding again.

[0091] 11. The response message is forwarded from FullNAT1 to server A, with the source IP and port in the message header being 192.168.1.2:8080, and the destination IP and port being 192.168.1.3:40123.

[0092] Through the above four network address translations, cross-resource-pool service access is achieved.

[0093] Figure 4 FIG. 2 is a structural diagram of another service access system provided by the embodiments of the present application, Figure 4Take three resource pools 401, 402 and 403 and two tenants, tenant A and tenant B, as examples. In actual applications, more resource pools and tenants can be included. Each resource pool corresponds to a firewall gateway, for example, resource pool 401 corresponds to firewall gateway C, resource pool 402 corresponds to firewall gateway D, and resource pool 403 corresponds to firewall gateway E.

[0094] The same tenant can correspond to multiple tenant servers, which can be distributed in the same resource pool or different resource pools. For example, server 404 of tenant A is distributed in three resource pools, and server 405 of tenant B is also distributed in three resource pools. The same resource pool can be rented by tenant A and tenant B at the same time.

[0095] In each resource pool, different tenants correspond to different gateway servers. For example, in resource pool 1, server 404 of tenant A is in communication connection with gateway server 406, and server 405 of tenant B is in communication connection with gateway server 407. Server 404 and server 405 share a gateway switch 408 to communicate with corresponding gateway server 406 and gateway server 407. In this case, gateway switch 408 can isolate the permissions of server 404 and server 405.

[0096] The distribution in other resource pools is similar and will not be described here. Figure 4 Only some cross-resource pool business access diagrams are exemplarily listed, for example, server 404 in resource pool 401 accesses server 404 in resource pool 2, and server 405 in resource pool 401 accesses server 405 in resource pool 403. In actual applications, more access situations can be included, for example, server 404 in resource pool 401 accesses server 404 in resource pool 403, or server 404 in resource pool 401 accesses server 405 in resource pool 403.

[0097] The embodiments of the application can be applied to single-tenant cross-resource pool business access scenarios and multi-tenant cross-resource pool business access scenarios. The cross-resource pool business access process in the multi-tenant scenario is similar to that in the single-tenant scenario. For details, refer to the above embodiments, which will not be described here.

[0098] In the multi-tenant scenario, the orchestration server can have one or more, Figure 4Taking an example of two orchestration servers, each of which corresponds to a different tenant, for example, the orchestration server 400 can be controlled by tenant A, and the orchestration server 409 can be controlled by tenant B. Thus, without the need for permission isolation for different tenants, it is simpler. Of course, one orchestration server can also be used, that is, the control permission of the orchestration server can be opened to multiple tenants. In this case, cross-tenant and cross-resource pool business access can also be implemented.

[0099] The embodiment of the present application opens the orchestration service function of the orchestration server to the tenant for control, so that the tenant can customize the cross-resource pool intercommunication of its own business, realizes the network autonomous ability at the tenant level, and can be extended from the single-tenant scenario to the multi-tenant scenario, and can meet more business demands.

[0100] It should be noted that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0101] The functional blocks shown in the structural block diagram described above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave on a transmission medium or communication link. The "machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segments can be downloaded via a computer network such as the Internet, an intranet, etc.

[0102] It should also be noted that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in an order different from the embodiments, or several steps can be performed simultaneously.

[0103] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0104] The above describes only specific implementation of the present application. For the convenience and brevity of description, the specific working process of the system, module and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described herein. It should be understood that the protection scope of the present application is not limited in this way. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A service access system, characterized by The system comprises an orchestration server and at least two gateway servers, the orchestration server is communicatively connected with the at least two gateway servers, the at least two gateway servers comprise a first gateway server and a second gateway server, the first gateway server is arranged in a first resource pool, and the second gateway server is arranged in a second resource pool; The orchestration server is configured to generate a first address mapping table and a second address mapping table according to a received access request, and send the first address mapping table to the first gateway server and the second address mapping table to the second gateway server; wherein the first address mapping table comprises a first address mapping relationship between the first gateway server and the second gateway server, and the second address mapping table comprises a second address mapping relationship between the second gateway server and a message response server; The first gateway server is configured to receive a first service request message sent by a message request server, update a first message header of the first service request message according to the first address mapping table to obtain a second service request message, and forward the second service request message to the second gateway server, wherein the message request server is arranged in the first resource pool; The second gateway server is configured to update a second message header of the second service request message according to the second address mapping table to obtain a third service request message, and forward the third service request message to the message response server, wherein the message response server is arranged in the second resource pool.

2. The service access system according to claim 1, characterized by, The first gateway server comprises a first internal network card and a first external network card, and the second gateway server comprises a second internal network card and a second external network card.

3. The service access system of claim 1, wherein, The first service request message comprises first source address information and first destination address information, and the first address mapping table comprises a first external network address of the first gateway server and a first mapping relationship between first internal network address information of the first gateway server and second external network address information of the second gateway server; The first gateway server is specifically configured to: match the first destination address information with the first address mapping table to obtain second external network address information and the first external network address corresponding to the first destination address information; generate a second message header according to the first external network address and the second external network address information, wherein the second message header comprises second source address information and second destination address information; replace the first message header with the second message header to obtain a second service request message.

4. The service access system according to claim 3, characterized by The second address mapping table comprises a second internal network address of the second gateway server and a second mapping relationship between second external network address information of the second gateway server and response address information of the message response server; The second gateway server is specifically configured to: match the second destination address information with the second address mapping table to obtain the second internal network address and the response address information corresponding to the second destination address information; According to the second internal network address and the response address information, a third packet header is generated, the third packet header including third source address information and third destination address information; The third packet header is used to replace the second packet header, so as to obtain a third service request packet.

5. The service access system of claim 1, wherein, The first gateway server is specifically configured to: In a case where the first service request packet includes first source address information and first destination address information, the first address mapping table is used to update a first packet header of the first service request packet, so as to obtain a second service request packet, and the second service request is forwarded to the second gateway server.

6. The service access system of claim 1, wherein, The second gateway server is further configured to receive a first response packet sent by the packet response server, and match fourth source address information and fourth destination address information in the first response packet with a locally stored packet forwarding session, so as to obtain a second response packet, and send the second response packet to the first gateway server. The first gateway server is further configured to match fifth source address information and fifth destination address information in the second response packet with the locally stored packet forwarding session, so as to obtain a third response packet, and send the third response packet to the packet request server.

7. A service access system according to any of claims 1 to 6, characterised in that, The service access system further includes a first firewall gateway and a second firewall gateway, the first firewall gateway being arranged in the first resource pool, and the second firewall gateway being arranged in the second resource pool. The second gateway server is specifically configured to: send the second service request to the second gateway server through the first firewall gateway and the second firewall gateway in sequence.

8. A service access system according to any of claims 1 to 6, characterised in that, The service access system further includes a first gateway switch and a second gateway switch. The first gateway server is in communication connection with the packet request server through the first gateway switch, and the second gateway server is in communication connection with the packet response server through the second gateway switch.

9. The service access system of claim 8, wherein, The at least two gateway servers further include a third gateway server and a fourth gateway server. The third gateway server is arranged in the first resource pool, and the fourth gateway server is arranged in the second resource pool, the third gateway server corresponding to a tenant different from the first gateway server, and the fourth gateway server corresponding to a tenant different from the second gateway server. The first gateway server is in communication connection with a first server corresponding to a first tenant through the first gateway switch, and the second gateway server is in communication connection with a second server corresponding to a second tenant through the first gateway switch. The second gateway server is in communication connection with a third server corresponding to a third tenant through the second gateway switch, and the fourth gateway server is in communication connection with a fourth server corresponding to a fourth tenant through the second gateway switch.

10. The service access system of claim 9, wherein, The orchestration server includes at least one.

Images