Cloud platform supports SSLVPN gateway methods, systems, devices and media

Abstract

This application relates to a method, system, device, and medium for enabling cloud platforms to support SSLVPN gateways, and relates to the field of network technology. By implementing a secure gateway proxy module within an SSLVPN gateway node and a secure gateway plug-in within the cloud platform's virtual network service, this application enables the cloud platform to create an SSLVPN server, receive SSLVPN connection requests, negotiate and establish SSLVPN connections, and implement SSLVPN functionality. This addresses the issue of cloud platforms not supporting SSLVPN functionality, enabling mobile devices to securely and conveniently access cloud platform data.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method, system, computer device and storage medium for supporting an SSLVPN gateway on a cloud platform. Background Art

[0002] VPN stands for Virtual Private Network. When users access OpenStack platform resources from external networks, VPN functionality is required to protect data and ensure secure transmission. Currently, the cloud platform only supports IPSec-VPN, not SSL-VPN. IPSec-VPN is a site-to-site VPN that offers strong security, but is complex to configure and deploy. Furthermore, because it operates at the network layer, it is subject to network environment constraints and is limited in use within firewalls and NAT networks. SSL, on the other hand, stands for Secure Sockets Layer, which operates at the application layer and provides secure connections. SSL-VPN uses point-to-site VPN functionality, making configuration and deployment simple. Because it operates at the application layer, it is more adaptable to complex networks. SSL-VPN offers unique advantages in mobile office scenarios, making support for SSL-VPN deployment on the cloud platform a pressing technical challenge. Summary of the Invention

[0003] Based on this, a cloud platform supporting SSLVPN gateway method, system, computer equipment and storage medium are provided to solve the technical problem that the current cloud platform only supports IPSec-VPN but not SSLVPN, so that mobile devices can access cloud platform data safely and conveniently.

[0004] On the one hand, a cloud platform supports an SSLVPN gateway method, wherein a security gateway agent module is provided in the SSLVPN gateway node, and a security gateway plug-in is provided in the virtual network service of the cloud platform, wherein the security gateway plug-in and the security gateway agent module establish a remote call connection; the cloud platform supports an SSLVPN gateway method comprising:

[0005] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0006] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0007] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0008] In one embodiment, the cloud platform supports the SSLVPN gateway method and method further includes:

[0009] After the security gateway proxy module is started, the security gateway proxy module deployment data is written into the chassis private table of the southbound database of the cloud platform;

[0010] After the security gateway plug-in is started, the security gateway plug-in obtains the deployment information of the security gateway agent module by reading the deployment data in the chassis private table of the southbound database;

[0011] The secure gateway plug-in and the secure gateway proxy module are set to establish a remote call connection through a message queue, so that the secure gateway plug-in sends the configuration information data in the create SSLVPN request, and the secure gateway proxy module reports the operation information data of the SSLVPN gateway node.

[0012] In one embodiment, the cloud platform supports SSLVPN gateway method further comprising:

[0013] Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform;

[0014] When the security gateway proxy module is started, the security gateway proxy module reads the chassis private table of the southbound database, searches for the SSLVPN gateway node where the security gateway proxy module is located, and adds the security gateway proxy module deployment data to the SSLVPN gateway node;

[0015] The security gateway plug-in reads the chassis private table of the southbound database and obtains the deployment status of all security gateway proxy modules according to the security gateway proxy module deployment data;

[0016] The security gateway agent module monitors the chassis private table and regularly updates the security gateway agent module deployment data in the chassis private table;

[0017] The security gateway plug-in monitors the chassis private table, reads the latest security gateway proxy module deployment data in the chassis private table, updates the local security gateway proxy module deployment data, and updates the remote call connection at the same time.

[0018] In one embodiment, the security gateway plug-in receives a request to create an SSLVPN, and based on the configuration information in the request to create an SSLVPN, applies for a gateway port on an external network, creates a transport network and a router associated with the transport network, and creating the transport port includes:

[0019] The security gateway plug-in receives the create SSLVPN request and parses the configuration information in the create SSLVPN request;

[0020] The security gateway plug-in calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router;

[0021] The security gateway plug-in calls the ml2 plug-in to apply for a gateway port from the external network;

[0022] The security gateway plug-in calls the ml2 plug-in to create a transmission network and a transmission port at the same time;

[0023] The security gateway plug-in calls the ovn-l3 plug-in to associate the transmission network with the router;

[0024] The transmission port is placed in the security gateway network namespace to connect the network link between the router and the security gateway network namespace.

[0025] In one embodiment, the mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in sends a static route for diverting traffic to the router so that the mobile device can access data on the cloud platform through the SSLVPN connection, including:

[0026] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through the SSLVPN client, and the SSLVPN client and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection;

[0027] After the SSLVPN connection is successfully established, the security gateway plug-in sends a static route for diversion to the router, forwarding the received SSLVPN network traffic to the cloud host through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0028] In one embodiment, the mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client, the SSLVPN client and the SSLVPN server negotiate to create a tun interface, and establishing the SSLVPN connection includes:

[0029] The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device;

[0030] The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface;

[0031] When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port;

[0032] The security gateway proxy module monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in through a remote call connection. After the security gateway plug-in confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace through the transmission network;

[0033] When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

[0034] In one embodiment, when the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes:

[0035] The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace;

[0036] The tun interface in the network namespace of the security gateway decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission interface. The router transmits the user data message to the corresponding cloud host;

[0037] After the cloud host performs business processing, it sends the cloud host data message to the router;

[0038] The router sends the cloud host data message to the security gateway network namespace according to the static flow table;

[0039] The tun interface in the network namespace of the security gateway encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

[0040] On the other hand, a cloud platform supporting SSLVPN gateway system is provided, the system including a control node, an SLVPN gateway node and a computing node;

[0041] The SLVPN gateway node is provided with a security gateway agent module, the control node is provided with a virtual network service, the virtual network service is provided with a security gateway plug-in, the security gateway plug-in and the security gateway agent module establish a remote call connection through a message queue;

[0042] The computing node is provided with a router, a switch and a cloud host, and the router is connected to the cloud host via the switch;

[0043] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0044] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace in the SLVPN gateway node, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0045] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request. The security gateway plug-in sends a static route for diversion to the router, and forwards the received SSLVPN network traffic to the cloud host through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0046] In another aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0047] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0048] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0049] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0050] In another aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0051] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0052] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0053] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0054] The cloud platform supports an SSLVPN gateway method, system, computer device, and storage medium. By installing a secure gateway proxy module in the SSLVPN gateway node and a secure gateway plug-in in the cloud platform's virtual network service, the cloud platform can create an SSLVPN server, receive SSLVPN connection requests, negotiate and establish SSLVPN connections, and implement SSLVPN functionality. This fills the gap in cloud platforms' lack of SSLVPN functionality and enables mobile devices to securely and conveniently access cloud platform data. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0056] Figure 1 This is a diagram of a cloud platform application environment in which a cloud platform supports an SSLVPN gateway method in one embodiment of the present application;

[0057] Figure 2 This is a flow chart of a method for a cloud platform to support an SSLVPN gateway in one embodiment of the present application;

[0058] Figure 3 A schematic diagram of the path of a network link transmitting a message after a successful SSLVPN connection is established in one embodiment of the present application;

[0059] Figure 4 This is a diagram of the internal structure of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0061] The cloud platform provided by this application supports the SSLVPN gateway method, which can be applied to Figure 1In the cloud platform application environment shown. Among them, the cloud platform is preferably an OpenStack cloud platform, and the control plane of the cloud platform is provided with a control node, an SLVPN gateway node and a computing node. A virtual network service (neutron) is provided in the control node, a security gateway plug-in (SSLVPN plug-in), an ovn-l3 plug-in and an ml2 plug-in are provided in the virtual network service (neutron), and ovn-nb, ovn-northd and a southbound database (ovn-sb database) are also provided in the control node. A security gateway agent module (sslvpn-agent), a virtual switch OVS, an ovn controller (ovn-controller) and a security gateway network namespace (sslvpn-netns) are provided in the SLVPN gateway node, and an openvpn program is set in the security gateway network namespace (sslvpn-netns). The security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) establish a remote call (rpc) connection through a message queue (rabbitmq). The computing node is provided with an ovn controller, a virtual router, a virtual switch, and a cloud host (VM). The virtual router is connected to the cloud host via the virtual switch. The virtual router can be called a logical router or a router, and the virtual switch can be called a switch.

[0062] In one embodiment, Figure 2 As shown, a cloud platform supports an SSLVPN gateway method, wherein a security gateway agent module (sslvpn-agent) is provided in the SSLVPN gateway node, and a security gateway plug-in (SSLVPN plug-in) is provided in the virtual network service (neutron) of the cloud platform, and the security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) establish a remote call (RPC) connection; the cloud platform supports the SSLVPN gateway method including:

[0063] Step S1, the secure gateway plug-in (SSLVPN plug-in) receives a request to create an SSLVPN, and (SSLVPN plug-in) applies for a gateway port (SSLVPN gateway port) on the external network according to the configuration information in the request to create an SSLVPN, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0064] In step S2, the secure gateway plug-in (SSLVPN plug-in) transmits the configuration information to the secure gateway agent module (sslvpn-agent), and the secure gateway agent module (sslvpn-agent) creates a secure gateway network namespace (sslvpn-netns), creates a tap device (tap device) corresponding to the secure gateway network namespace (sslvpn-netns), binds the gateway port (SSLVPN gateway port) and the transmission port, and starts the SSLVPN server (starting the openvpn program) to receive a request to establish an SSLVPN connection.

[0065] In step S3, the mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in (SSLVPN plug-in) sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0066] OpenStack is an open-source cloud platform management project that allows you to manage your own infrastructure, such as servers, networks, and storage. Neutron is OpenStack's virtual network service, a module within OpenStack that provides network services. VPN: Virtual Private Network. SSL: Secure Sockets Layer, which operates at the application layer and provides secure connections. A TAP device is a virtual Ethernet adapter that emulates a physical Ethernet interface. A tap stands for Test Access Point, a splitter / splitter / tapper.

[0067] This embodiment implements SSLVPN functionality by setting up a secure gateway agent module (sslvpn-agent) in the SSLVPN gateway node and a secure gateway plug-in in the cloud platform's virtual network service. This enables the cloud platform to create an SSLVPN server, receive SSLVPN connection requests, negotiate and establish SSLVPN connections, and implement SSLVPN functionality. This addresses the lack of SSLVPN support on cloud platforms. It enables mobile devices to securely and conveniently access cloud platform data, independent of the underlying CPU architecture, supporting multiple architectures including x86 and ARM.

[0068] In this embodiment, the cloud platform supports the SSLVPN gateway method further comprising:

[0069] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) deployment data is written into the chassis private table (ChassisPrivate table) of the southbound database (ovn-sb database) of the cloud platform;

[0070] After the security gateway plug-in (SSLVPN plug-in) is started, the security gateway plug-in (SSLVPN plug-in) obtains the deployment information of the security gateway agent module (sslvpn-agent) by reading the deployment data in the chassis private table (Chassis Private table) of the southbound database (ovn-sb database);

[0071] The security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) are set to establish a remote call (RPC) connection through a message queue (rabbitmq), so that the security gateway plug-in (SSLVPN plug-in) sends the configuration information data in the SSLVPN creation request, and the security gateway agent module (sslvpn-agent) reports the operation information data of the SSLVPN gateway node.

[0072] In this embodiment, the cloud platform supports the SSLVPN gateway method further comprising:

[0073] Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform;

[0074] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), searches for the SSLVPN gateway node where the security gateway agent module (sslvpn-agent) is located, and adds the security gateway agent module (sslvpn-agent) deployment data in the SSLVPN gateway node;

[0075] The security gateway plug-in (SSLVPN plug-in) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), and obtains the deployment status of all security gateway agent modules (sslvpn-agent) according to the security gateway agent module (sslvpn-agent) deployment data;

[0076] The security gateway agent module (sslvpn-agent) monitors the chassis private table (Chassis Private table) and regularly updates the security gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table);

[0077] The secure gateway plug-in (SSLVPN plug-in) monitors the chassis private table (Chassis Private table), reads the latest secure gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table), updates the local secure gateway agent module (sslvpn-agent) deployment data, and updates the remote call (rpc) connection at the same time.

[0078] In this embodiment, the secure gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request, and (SSLVPN plug-in) applies for a gateway port (SSLVPN gateway port) on the external network according to the configuration information in the create SSLVPN request, creates a transmission network and a router associated with the transmission network, and creates the transmission port including:

[0079] The security gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request and parses the configuration information in the create SSLVPN request;

[0080] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router;

[0081] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to apply for a gateway port (SSLVPN gateway port) from the external network;

[0082] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to create a transmission network and a transmission port at the same time;

[0083] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to associate the transport network with the router;

[0084] The transmission port is placed in a security gateway network namespace (sslvpn-netns) to connect the network link between the router and the security gateway network namespace (sslvpn-netns).

[0085] The configuration information includes the SSLVPN connection name, description, router associated with the transmission network, IP address segments allowed by the remote end, and IP address segments allowed by the local end.

[0086] In this embodiment, the mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in (SSLVPN plug-in) sends a static route for diversion to the router to enable the mobile device to access data of the cloud platform through the SSLVPN connection, including:

[0087] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection;

[0088] After the SSLVPN connection is successfully established, the security gateway plug-in (SSLVPN plug-in) sends a static route to the router to forward the received SSLVPN network traffic to the cloud host (VM) through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0089] In this embodiment, the mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface. Establishing the SSLVPN connection includes:

[0090] The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device;

[0091] The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface;

[0092] When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port;

[0093] The security gateway agent module (sslvpn-agent) monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in (SSLVPN plug-in) through a remote call (RPC) connection. After the security gateway plug-in (SSLVPN plug-in) confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace (sslvpn-netns) through the transmission network;

[0094] When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

[0095] The SSLVPN plug-in provides an application programming interface (API) for the SSLVPN function, which can receive and create SSLVPN requests:

[0096] 1) / sslvpn-services service: creates the SSLVPN service, the router associated with the transport network, and the SSLVPN gateway port;

[0097] 2) / sslvpn-endpoint-groups: Create endpoint groups and specify remote IP address ranges and local IP address ranges;

[0098] 3) / sslvpn-servers: Creates an SSLVPN server, starts the SSLVPN server, receives SSLVPN client requests, negotiates to create SSLVPN connections, and obtains the number and status of established connections.

[0099] The SSLVPN plugin receives the SSLVPN creation request and parses the configuration information from it, including the SSLVPN connection name, description, router associated with the transit network, remote allowed IP address segments, and local allowed IP address segments. The SSLVPN plugin then calls the ovn-l3 plugin to obtain the NAT gateway and external network from the router. The SSLVPN plugin then calls the ml2 plugin to request the SSLVPN gateway port from the external network to create the transit network. The SSLVPN plugin also calls the ml2 plugin to create the transit network and the transit port. The SSLVPN plugin then calls the ovn-l3 plugin to associate the transit network with the router. The transit port is placed in the sslvpn network namespace to establish a network link between the router and the sslvpn network namespace. Static routes are also issued in the sslvpn network namespace to forward incoming SSLVPN network traffic to the router and then to the cloud host.

[0100] In this embodiment, the cloud platform supports the SSLVPN gateway method further comprising:

[0101] A first virtual switch is set in the SSLVPN gateway node, and the sslvpn-agent and the network namespace are connected to the sslvpn-agent;

[0102] A virtual router and a second virtual switch are set in the computing node, the first virtual switch is connected to the second virtual switch through the virtual router, the first virtual router serves as a router associated with the transmission network, and the second virtual switch is connected to the cloud host.

[0103] This embodiment connects the SSLVPN gateway node and the computing node by setting up a virtual switch in the SSLVPN gateway node and the computing node to form an SSLVPN connection network.

[0104] Based on the current sslvpn-agent status and the lowest priority scheduling policy, the SSLVPN plug-in dispatches the router to a surviving sslvpn-agent. It sends SSLVPN configuration information, transmission ports, SSLVPN gateway ports, and other information to the sslvpn-agent via a remote procedure call (RPC). Based on this information, the sslvpn-agent creates the sslvpn-netns network namespace, creates tap devices for the transmission ports and SSLVPN gateway ports within the network namespace, and associates them with OVS to ensure network connectivity. The sslvpn-agent converts this information into an OpenVPN configuration and starts OpenVPN. OpenVPN starts the SSLVPN server based on the configuration and receives SSLVPN connection requests.

[0105] In this embodiment, when the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes:

[0106] The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace (sslvpn-netns);

[0107] The tun interface in the security gateway network namespace (sslvpn-netns) decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission interface. The router transmits the user data message to the corresponding cloud host (VM);

[0108] After the cloud host performs business processing, it sends the cloud host data message to the router;

[0109] The router sends the cloud host data message to the security gateway network namespace (sslvpn-netns) according to the static flow table;

[0110] The tun interface in the secure gateway network namespace (sslvpn-netns) encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

[0111] The aforementioned cloud platform SSLVPN gateway support method implements SSLVPN functionality by configuring a secure gateway agent module (sslvpn-agent) within the SSLVPN gateway node and a secure gateway plug-in within the cloud platform's virtual network service. This enables the cloud platform to create an SSLVPN server, receive SSLVPN connection requests, and negotiate and establish SSLVPN connections. This addresses the issue of cloud platforms lacking SSLVPN functionality and enables secure and convenient mobile device access to cloud platform data.

[0112] It should be understood that although Figure 2-Figure 4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 2-Figure 4 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0113] In one embodiment, Figure 1 、 Figure 3 As shown, a cloud platform supporting SSLVPN gateway system is provided, the system including a control node, an SLVPN gateway node and a computing node;

[0114] The SLVPN gateway node is provided with a security gateway agent module, the control node is provided with a virtual network service, the virtual network service is provided with a security gateway plug-in, the security gateway plug-in and the security gateway agent module establish a remote call connection through a message queue;

[0115] The computing node is provided with a router, a switch and a cloud host, and the router is connected to the cloud host via the switch;

[0116] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0117] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace in the SLVPN gateway node, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0118] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request. The security gateway plug-in sends a static route for diversion to the router, and forwards the received SSLVPN network traffic to the cloud host through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0119] Among them, the virtual network service (neutron) is provided with an ovn-l3 plug-in and an ml2 plug-in connected to the security gateway plug-in (SSLVPN plug-in), and the control node is also provided with ovn-nb, ovn-northd and a southbound database (ovn-sb database). The SLVPN gateway node is provided with a security gateway agent module (sslvpn-agent), a virtual switch OVS, an ovn controller (ovn-controller) and a security gateway network namespace (sslvpn-netns), and an openvpn program is set in the security gateway network namespace (sslvpn-netns). The computing node is also provided with an ovn controller (ovn-controller). The ovn controller (ovn-controller) is connected to the switch.

[0120] In this embodiment, after the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) deployment data is written into the chassis private table (Chassis Private table) of the southbound database (ovn-sb database) of the cloud platform;

[0121] After the security gateway plug-in (SSLVPN plug-in) is started, the security gateway plug-in (SSLVPN plug-in) obtains the deployment information of the security gateway agent module (sslvpn-agent) by reading the deployment data in the chassis private table (Chassis Private table) of the southbound database (ovn-sb database);

[0122] The security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) are set to establish a remote call (RPC) connection through a message queue (rabbitmq), so that the security gateway plug-in (SSLVPN plug-in) sends the configuration information data in the SSLVPN creation request, and the security gateway agent module (sslvpn-agent) reports the operation information data of the SSLVPN gateway node.

[0123] In this embodiment, the cloud platform supports the SSLVPN gateway method further comprising:

[0124] Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform;

[0125] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), searches for the SSLVPN gateway node where the security gateway agent module (sslvpn-agent) is located, and adds the security gateway agent module (sslvpn-agent) deployment data in the SSLVPN gateway node;

[0126] The security gateway plug-in (SSLVPN plug-in) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), and obtains the deployment status of all security gateway agent modules (sslvpn-agent) according to the security gateway agent module (sslvpn-agent) deployment data;

[0127] The security gateway agent module (sslvpn-agent) monitors the chassis private table (Chassis Private table) and regularly updates the security gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table);

[0128] The secure gateway plug-in (SSLVPN plug-in) monitors the chassis private table (Chassis Private table), reads the latest secure gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table), updates the local secure gateway agent module (sslvpn-agent) deployment data, and updates the remote call (rpc) connection at the same time.

[0129] In this embodiment, the secure gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request, and (SSLVPN plug-in) applies for a gateway port (SSLVPN gateway port) on the external network according to the configuration information in the create SSLVPN request, creates a transmission network and a router associated with the transmission network, and creates the transmission port including:

[0130] The security gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request and parses the configuration information in the create SSLVPN request;

[0131] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router;

[0132] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to apply for a gateway port (SSLVPN gateway port) from the external network;

[0133] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to create a transmission network and a transmission port at the same time;

[0134] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to associate the transport network with the router;

[0135] The transmission port is placed in a security gateway network namespace (sslvpn-netns) to connect the network link between the router and the security gateway network namespace (sslvpn-netns).

[0136] In this embodiment, the mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in (SSLVPN plug-in) sends a static route for diversion to the router to enable the mobile device to access data of the cloud platform through the SSLVPN connection, including:

[0137] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection;

[0138] After the SSLVPN connection is successfully established, the security gateway plug-in (SSLVPN plug-in) sends a static route to the router to forward the received SSLVPN network traffic to the cloud host (VM) through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0139] In this embodiment, the mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface. Establishing the SSLVPN connection includes:

[0140] The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device;

[0141] The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface;

[0142] When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port;

[0143] The security gateway agent module (sslvpn-agent) monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in (SSLVPN plug-in) through a remote call (RPC) connection. After the security gateway plug-in (SSLVPN plug-in) confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace (sslvpn-netns) through the transmission network;

[0144] When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

[0145] In this embodiment, when the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes:

[0146] The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace (sslvpn-netns);

[0147] The tun interface in the security gateway network namespace (sslvpn-netns) decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission interface. The router transmits the user data message to the corresponding cloud host (VM);

[0148] After the cloud host performs business processing, it sends the cloud host data message to the router;

[0149] The router sends the cloud host data message to the security gateway network namespace (sslvpn-netns) according to the static flow table;

[0150] The tun interface in the secure gateway network namespace (sslvpn-netns) encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

[0151] The aforementioned cloud platform supports an SSLVPN gateway system. By configuring a secure gateway agent module (sslvpn-agent) in the SSLVPN gateway node and a secure gateway plug-in in the cloud platform's virtual network service, the cloud platform can create an SSLVPN server, receive SSLVPN connection requests, negotiate and establish SSLVPN connections, and implement SSLVPN functionality. This fills the gap in cloud platforms' lack of SSLVPN functionality and enables mobile devices to securely and conveniently access cloud platform data.

[0152] The specific limitations of the cloud platform's support for the SSLVPN gateway system can be found in the limitations of the cloud platform's support for the SSLVPN gateway method described above and will not be further elaborated here. Each module in the aforementioned cloud platform's support for the SSLVPN gateway system can be implemented in whole or in part through software, hardware, or a combination thereof. Each of these modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a computer device's memory in software form, so that the processor can call and execute the corresponding operations of each of these modules.

[0153] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0154] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0155] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0156] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0157] In one embodiment, the computer program further performs the following steps when executed by a processor:

[0158] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) deployment data is written into the chassis private table (ChassisPrivate table) of the southbound database (ovn-sb database) of the cloud platform;

[0159] After the security gateway plug-in (SSLVPN plug-in) is started, the security gateway plug-in (SSLVPN plug-in) obtains the deployment information of the security gateway agent module (sslvpn-agent) by reading the deployment data in the chassis private table (Chassis Private table) of the southbound database (ovn-sb database);

[0160] The security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) are set to establish a remote call (RPC) connection through a message queue (rabbitmq), so that the security gateway plug-in (SSLVPN plug-in) sends the configuration information data in the SSLVPN creation request, and the security gateway agent module (sslvpn-agent) reports the operation information data of the SSLVPN gateway node.

[0161] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0162] Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform;

[0163] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), searches for the SSLVPN gateway node where the security gateway agent module (sslvpn-agent) is located, and adds the security gateway agent module (sslvpn-agent) deployment data in the SSLVPN gateway node;

[0164] The security gateway plug-in (SSLVPN plug-in) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), and obtains the deployment status of all security gateway agent modules (sslvpn-agent) according to the security gateway agent module (sslvpn-agent) deployment data;

[0165] The security gateway agent module (sslvpn-agent) monitors the chassis private table (Chassis Private table) and regularly updates the security gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table);

[0166] The secure gateway plug-in (SSLVPN plug-in) monitors the chassis private table (Chassis Private table), reads the latest secure gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table), updates the local secure gateway agent module (sslvpn-agent) deployment data, and updates the remote call (rpc) connection at the same time.

[0167] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0168] The secure gateway plug-in (SSLVPN plug-in) receives the SSLVPN creation request, and (SSLVPN plug-in) applies for a gateway port (SSLVPN gateway port) on the external network according to the configuration information in the SSLVPN creation request, and creates a transmission network and a router associated with the transmission network. Creating the transmission port includes:

[0169] The security gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request and parses the configuration information in the create SSLVPN request;

[0170] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router;

[0171] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to apply for a gateway port (SSLVPN gateway port) from the external network;

[0172] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to create a transmission network and a transmission port at the same time;

[0173] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to associate the transport network with the router;

[0174] The transmission port is placed in a security gateway network namespace (sslvpn-netns) to connect the network link between the router and the security gateway network namespace (sslvpn-netns).

[0175] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0176] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in (SSLVPN plug-in) sends a static route for diverting traffic to the router so that the mobile device can access data on the cloud platform through the SSLVPN connection.

[0177] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection;

[0178] After the SSLVPN connection is successfully established, the security gateway plug-in (SSLVPN plug-in) sends a static route to the router to forward the received SSLVPN network traffic to the cloud host (VM) through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0179] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0180] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface. Establishing the SSLVPN connection includes:

[0181] The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device;

[0182] The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface;

[0183] When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port;

[0184] The security gateway agent module (sslvpn-agent) monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in (SSLVPN plug-in) through a remote call (RPC) connection. After the security gateway plug-in (SSLVPN plug-in) confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace (sslvpn-netns) through the transmission network;

[0185] When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

[0186] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0187] When the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes:

[0188] The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace (sslvpn-netns);

[0189] The tun interface in the security gateway network namespace (sslvpn-netns) decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission interface. The router transmits the user data message to the corresponding cloud host (VM);

[0190] After the cloud host performs business processing, it sends the cloud host data message to the router;

[0191] The router sends the cloud host data message to the security gateway network namespace (sslvpn-netns) according to the static flow table;

[0192] The tun interface in the secure gateway network namespace (sslvpn-netns) encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

[0193] For the specific limitations on the steps implemented when the computer program is executed by the processor, please refer to the above limitations on the method for the cloud platform to support the SSLVPN gateway, which will not be repeated here.

[0194] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data on the cloud platform supporting SSLVPN gateway. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for cloud platform supporting SSLVPN gateway is implemented.

[0195] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0196] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are performed:

[0197] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0198] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0199] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0200] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0201] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) deployment data is written into the chassis private table (ChassisPrivate table) of the southbound database (ovn-sb database) of the cloud platform;

[0202] After the security gateway plug-in (SSLVPN plug-in) is started, the security gateway plug-in (SSLVPN plug-in) obtains the deployment information of the security gateway agent module (sslvpn-agent) by reading the deployment data in the chassis private table (Chassis Private table) of the southbound database (ovn-sb database);

[0203] The security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) are set to establish a remote call (RPC) connection through a message queue (rabbitmq), so that the security gateway plug-in (SSLVPN plug-in) sends the configuration information data in the SSLVPN creation request, and the security gateway agent module (sslvpn-agent) reports the operation information data of the SSLVPN gateway node.

[0204] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0205] Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform;

[0206] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), searches for the SSLVPN gateway node where the security gateway agent module (sslvpn-agent) is located, and adds the security gateway agent module (sslvpn-agent) deployment data in the SSLVPN gateway node;

[0207] The security gateway plug-in (SSLVPN plug-in) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), and obtains the deployment status of all security gateway agent modules (sslvpn-agent) according to the security gateway agent module (sslvpn-agent) deployment data;

[0208] The security gateway agent module (sslvpn-agent) monitors the chassis private table (Chassis Private table) and regularly updates the security gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table);

[0209] The secure gateway plug-in (SSLVPN plug-in) monitors the chassis private table (Chassis Private table), reads the latest secure gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table), updates the local secure gateway agent module (sslvpn-agent) deployment data, and updates the remote call (rpc) connection at the same time.

[0210] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0211] The secure gateway plug-in (SSLVPN plug-in) receives the SSLVPN creation request, and (SSLVPN plug-in) applies for a gateway port (SSLVPN gateway port) on the external network according to the configuration information in the SSLVPN creation request, and creates a transmission network and a router associated with the transmission network. Creating the transmission port includes:

[0212] The security gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request and parses the configuration information in the create SSLVPN request;

[0213] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router;

[0214] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to apply for a gateway port (SSLVPN gateway port) from the external network;

[0215] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to create a transmission network and a transmission port at the same time;

[0216] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to associate the transport network with the router;

[0217] The transmission port is placed in a security gateway network namespace (sslvpn-netns) to connect the network link between the router and the security gateway network namespace (sslvpn-netns).

[0218] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0219] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in (SSLVPN plug-in) sends a static route for diverting traffic to the router so that the mobile device can access data on the cloud platform through the SSLVPN connection.

[0220] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection;

[0221] After the SSLVPN connection is successfully established, the security gateway plug-in (SSLVPN plug-in) sends a static route to the router to forward the received SSLVPN network traffic to the cloud host (VM) through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0222] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0223] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface. Establishing the SSLVPN connection includes:

[0224] The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device;

[0225] The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface;

[0226] When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port;

[0227] The security gateway agent module (sslvpn-agent) monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in (SSLVPN plug-in) through a remote call (RPC) connection. After the security gateway plug-in (SSLVPN plug-in) confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace (sslvpn-netns) through the transmission network;

[0228] When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

[0229] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0230] When the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes:

[0231] The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace (sslvpn-netns);

[0232] The tun interface in the security gateway network namespace (sslvpn-netns) decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission interface. The router transmits the user data message to the corresponding cloud host (VM);

[0233] After the cloud host performs business processing, it sends the cloud host data message to the router;

[0234] The router sends the cloud host data message to the security gateway network namespace (sslvpn-netns) according to the static flow table;

[0235] The tun interface in the secure gateway network namespace (sslvpn-netns) encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

[0236] For the specific limitations on the steps implemented when the processor executes the computer program, please refer to the above limitations on the method for the cloud platform to support the SSLVPN gateway, which will not be repeated here.

[0237] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0238] The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port;

[0239] The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection;

[0240] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

[0241] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0242] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) deployment data is written into the chassis private table (ChassisPrivate table) of the southbound database (ovn-sb database) of the cloud platform;

[0243] After the security gateway plug-in (SSLVPN plug-in) is started, the security gateway plug-in (SSLVPN plug-in) obtains the deployment information of the security gateway agent module (sslvpn-agent) by reading the deployment data in the chassis private table (Chassis Private table) of the southbound database (ovn-sb database);

[0244] The security gateway plug-in (SSLVPN plug-in) and the security gateway agent module (sslvpn-agent) are set to establish a remote call (RPC) connection through a message queue (rabbitmq), so that the security gateway plug-in (SSLVPN plug-in) sends the configuration information data in the SSLVPN creation request, and the security gateway agent module (sslvpn-agent) reports the operation information data of the SSLVPN gateway node.

[0245] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0246] Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform;

[0247] After the security gateway agent module (sslvpn-agent) is started, the security gateway agent module (sslvpn-agent) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), searches for the SSLVPN gateway node where the security gateway agent module (sslvpn-agent) is located, and adds the security gateway agent module (sslvpn-agent) deployment data in the SSLVPN gateway node;

[0248] The security gateway plug-in (SSLVPN plug-in) reads the chassis private table (Chassis Private table) of the southbound database (ovn-sb database), and obtains the deployment status of all security gateway agent modules (sslvpn-agent) according to the security gateway agent module (sslvpn-agent) deployment data;

[0249] The security gateway agent module (sslvpn-agent) monitors the chassis private table (Chassis Private table) and regularly updates the security gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table);

[0250] The secure gateway plug-in (SSLVPN plug-in) monitors the chassis private table (Chassis Private table), reads the latest secure gateway agent module (sslvpn-agent) deployment data in the chassis private table (Chassis Private table), updates the local secure gateway agent module (sslvpn-agent) deployment data, and updates the remote call (rpc) connection at the same time.

[0251] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0252] The secure gateway plug-in (SSLVPN plug-in) receives the SSLVPN creation request, and (SSLVPN plug-in) applies for a gateway port (SSLVPN gateway port) on the external network according to the configuration information in the SSLVPN creation request, and creates a transmission network and a router associated with the transmission network. Creating the transmission port includes:

[0253] The security gateway plug-in (SSLVPN plug-in) receives the create SSLVPN request and parses the configuration information in the create SSLVPN request;

[0254] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router;

[0255] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to apply for a gateway port (SSLVPN gateway port) from the external network;

[0256] The secure gateway plug-in (SSLVPN plug-in) calls the ml2 plug-in to create a transmission network and a transmission port at the same time;

[0257] The secure gateway plug-in (SSLVPN plug-in) calls the ovn-l3 plug-in to associate the transport network with the router;

[0258] The transmission port is placed in a security gateway network namespace (sslvpn-netns) to connect the network link between the router and the security gateway network namespace (sslvpn-netns).

[0259] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0260] The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in (SSLVPN plug-in) sends a static route for diverting traffic to the router so that the mobile device can access data on the cloud platform through the SSLVPN connection.

[0261] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection;

[0262] After the SSLVPN connection is successfully established, the security gateway plug-in (SSLVPN plug-in) sends a static route to the router to forward the received SSLVPN network traffic to the cloud host (VM) through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

[0263] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0264] The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through an SSLVPN client (sslvpn-client), and the SSLVPN client (sslvpn-client) and the SSLVPN server negotiate to create a tun interface. Establishing the SSLVPN connection includes:

[0265] The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device;

[0266] The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface;

[0267] When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port;

[0268] The security gateway agent module (sslvpn-agent) monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in (SSLVPN plug-in) through a remote call (RPC) connection. After the security gateway plug-in (SSLVPN plug-in) confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace (sslvpn-netns) through the transmission network;

[0269] When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

[0270] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0271] When the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes:

[0272] The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace (sslvpn-netns);

[0273] The tun interface in the security gateway network namespace (sslvpn-netns) decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission interface. The router transmits the user data message to the corresponding cloud host (VM);

[0274] After the cloud host performs business processing, it sends the cloud host data message to the router;

[0275] The router sends the cloud host data message to the security gateway network namespace (sslvpn-netns) according to the static flow table;

[0276] The tun interface in the secure gateway network namespace (sslvpn-netns) encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

[0277] For the specific limitations on the steps implemented when the computer program is executed by the processor, please refer to the above limitations on the method for the cloud platform to support the SSLVPN gateway, which will not be repeated here.

[0278] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0279] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0280] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A cloud platform supports SSLVPN gateway method, characterized in that: A secure gateway proxy module is provided in the SSLVPN gateway node, and a secure gateway plug-in is provided in the virtual network service of the cloud platform, wherein the secure gateway plug-in and the secure gateway proxy module establish a remote call connection; The cloud platform supports SSLVPN gateway methods including: The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port; The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection; The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request, and the security gateway plug-in sends a static route for diversion to the router to enable the mobile device to access the data of the cloud platform through the SSLVPN connection.

2. The cloud platform supporting SSLVPN gateway method according to claim 1, characterized in that: The cloud platform supports the SSLVPN gateway method and method further includes: After the security gateway proxy module is started, the security gateway proxy module deployment data is written into the chassis private table of the southbound database of the cloud platform; After the security gateway plug-in is started, the security gateway plug-in obtains the deployment information of the security gateway agent module by reading the deployment data in the chassis private table of the southbound database; The secure gateway plug-in and the secure gateway proxy module are set to establish a remote call connection through a message queue, so that the secure gateway plug-in sends the configuration information data in the create SSLVPN request, and the secure gateway proxy module reports the operation information data of the SSLVPN gateway node.

3. The cloud platform supporting SSLVPN gateway method according to claim 2, characterized in that: The cloud platform supports the SSLVPN gateway method further comprising: Setting the SSLVPN gateway node to a distributed deployment mode, deploying multiple SSLVPN gateway nodes in the same cloud platform; When the security gateway proxy module is started, the security gateway proxy module reads the chassis private table of the southbound database, searches for the SSLVPN gateway node where the security gateway proxy module is located, and adds the security gateway proxy module deployment data to the SSLVPN gateway node; The security gateway plug-in reads the chassis private table of the southbound database and obtains the deployment status of all security gateway proxy modules according to the security gateway proxy module deployment data; The security gateway agent module monitors the chassis private table and regularly updates the security gateway agent module deployment data in the chassis private table; The security gateway plug-in monitors the chassis private table, reads the latest security gateway proxy module deployment data in the chassis private table, updates the local security gateway proxy module deployment data, and updates the remote call connection at the same time.

4. The cloud platform supporting SSLVPN gateway method according to claim 1, characterized in that: The security gateway plug-in receives the SSLVPN creation request and applies for a gateway port on the external network according to the configuration information in the SSLVPN creation request, and creates a transmission network and a router associated with the transmission network. Creating the transmission port includes: The security gateway plug-in receives the create SSLVPN request and parses the configuration information in the create SSLVPN request; The security gateway plug-in calls the ovn-l3 plug-in to obtain the NAT gateway and external network from the router; The security gateway plug-in calls the ml2 plug-in to apply for a gateway port from the external network; The security gateway plug-in calls the ml2 plug-in to create a transmission network and a transmission port at the same time; The security gateway plug-in calls the ovn-l3 plug-in to associate the transmission network with the router; The transmission port is placed in the security gateway network namespace to connect the network link between the router and the security gateway network namespace.

5. The cloud platform supporting SSLVPN gateway method according to claim 1, characterized in that: The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection establishment request, and the security gateway plug-in sends a static route for diverting traffic to the router so that the mobile device can access data on the cloud platform through the SSLVPN connection. The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through the SSLVPN client, and the SSLVPN client and the SSLVPN server negotiate to create a tun interface and establish an SSLVPN connection; After the SSLVPN connection is successfully established, the security gateway plug-in sends a static route for diversion to the router, forwarding the received SSLVPN network traffic to the cloud host through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

6. The cloud platform supporting SSLVPN gateway method according to claim 5, characterized in that: The mobile device sends an SSLVPN connection establishment request to the SSLVPN server through the SSLVPN client, and the SSLVPN client and the SSLVPN server negotiate to create a tun interface. Establishing the SSLVPN connection includes: The user sends a request to create an SSLVPN connection to the SSLVPN server via the SSLVPN client on the mobile device; The SSLVPN server verifies the user's authentication information. After the authentication is completed, the SSLVPN client and the SSLVPN server negotiate the encryption algorithm and key and create a tun interface; When receiving an SSLVPN message, the tun interface decrypts and decapsulates the SSLVPN message received by the cloud platform according to the negotiated encryption algorithm and key, obtains the user data message, and forwards it to the cloud host through the transmission port; The security gateway proxy module monitors the SSLVPN connection status in the SSLVPN server and notifies the security gateway plug-in through a remote call connection. After the security gateway plug-in confirms that the SSLVPN connection is successful, it sends a static route to the router and forwards the cloud host data message to the security gateway network namespace through the transmission network; When the tun interface receives the cloud host data message, it encrypts and encapsulates the cloud host data message according to the negotiated encryption algorithm and secret key, obtains the SSLVPN reply message, and forwards it to the cloud platform.

7. The cloud platform supporting SSLVPN gateway method according to claim 6, characterized in that: When the mobile device accesses data on the cloud platform through the SSLVPN connection, the method includes: The cloud platform receives the SSLVPN message sent by the mobile device from the external network, and forwards the SSLVPN message to the security gateway network namespace; The tun interface in the network namespace of the security gateway decapsulates the SSLVPN message, decrypts the user data message in the SSLVPN message, and then transmits the user data message to the router through the transmission port. The router transmits the user data message to the corresponding cloud host; After the cloud host performs business processing, it sends the cloud host data message to the router; The router sends the cloud host data message to the security gateway network namespace according to the static flow table; The tun interface in the network namespace of the security gateway encrypts the cloud host data message, encapsulates it into an SSLVPN reply message, forwards it to the external network, and forwards it to the mobile device through the external network.

8. A cloud platform supports SSLVPN gateway system, characterized in that: The system includes a control node, an SLVPN gateway node and a computing node; The SLVPN gateway node is provided with a security gateway agent module, the control node is provided with a virtual network service, the virtual network service is provided with a security gateway plug-in, the security gateway plug-in and the security gateway agent module establish a remote call connection through a message queue; The computing node is provided with a router, a switch and a cloud host, and the router is connected to the cloud host via the switch; The security gateway plug-in receives the SSLVPN creation request and, based on the configuration information in the SSLVPN creation request, applies for a gateway port on the external network, creates a transmission network and a router associated with the transmission network, and creates a transmission port; The security gateway plug-in transmits the configuration information to the security gateway agent module, and the security gateway agent module creates a security gateway network namespace in the SLVPN gateway node, creates a diversion device corresponding to the security gateway network namespace, binds the gateway port and the transmission port, and starts the SSLVPN server to receive a request to establish an SSLVPN connection; The mobile device establishes an SSLVPN connection with the SSLVPN server by sending an SSLVPN connection request. The security gateway plug-in sends a static route for diversion to the router, and forwards the received SSLVPN network traffic to the cloud host through the router, so that the mobile device can access the data of the cloud platform through the SSLVPN connection.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images