Information processing method and device

Abstract

The embodiment of the invention provides an information processing method and device.The information processing method is applied to a management and control platform and comprises the steps that strategy configuration information associated with a target application and application state information corresponding to the target application are obtained; constructing application address information according to the strategy configuration information and the application state information, wherein the application address information is used for deploying an access control strategy corresponding to the target application according to the application address information by an outgoing network controller; and when it is detected that the application address of the target application changes, calling an address change rule to update the application address information, so that the outgoing network controller deploys the access control strategy according to the updated application address information.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of container management technology, and more particularly to information processing methods and devices. Background Art

[0002] Kubernetes is an open source platform for managing containerized workloads and services. Its self-healing and dynamic scaling capabilities can cause changes in the application's IP address; outbound network access control policies are primarily deployed based on the source IP address, and changes in the application's IP address will render the policy ineffective. To accommodate this IP change issue, existing technologies typically require adding the IP address segments of applications accessing Internet resources to an access control whitelist to control intranet applications' access to the Internet. Although this approach can accommodate IP change issues, this release strategy will cause all applications within the same IP address segment to be whitelisted, resulting in a coarse-grained control system that makes it impossible to independently manage applications. Therefore, an effective solution is urgently needed to address the above issues. Summary of the Invention

[0003] In view of this, embodiments of this specification provide an information processing method. One or more embodiments of this specification also relate to an information processing apparatus, a computing device, a computer-readable storage medium, and a computer program product to address technical deficiencies in the prior art.

[0004] According to a first aspect of an embodiment of this specification, there is provided an information processing method, which is applied to a management and control platform, comprising:

[0005] Obtaining policy configuration information associated with a target application and application status information corresponding to the target application;

[0006] Constructing application address information according to the policy configuration information and the application state information, and deploying the access control policy corresponding to the target application according to the application address information to the outbound network controller;

[0007] When a change in the application address of the target application is detected, the address change rule is called to update the application address information, so that the outbound network controller deploys the access control policy according to the updated application address information.

[0008] Optionally, before the step of obtaining the policy configuration information associated with the target application and the application status information corresponding to the target application is performed, the method further includes:

[0009] If the target application is a container application, determining a container cluster associated with the container application;

[0010] Subscribe to the container status of the container cluster through the proxy node corresponding to the container cluster;

[0011] When the proxy node receives the target state information corresponding to the container application, the proxy node stores the target state information in a configuration management database;

[0012] The information stored in the configuration management database is used to generate the application status information.

[0013] Optionally, before the step of obtaining the policy configuration information associated with the target application and the application status information corresponding to the target application is performed, the method further includes:

[0014] In a case where the target application is a basic application, obtaining basic application information corresponding to the basic application;

[0015] The basic application information is stored in the configuration management database.

[0016] Optionally, obtaining policy configuration information associated with the target application and application status information corresponding to the target application includes:

[0017] In response to a policy configuration request submitted by a business user for a target application, presenting a policy configuration page to the business user;

[0018] The policy configuration information submitted by the business user through the policy configuration page is received, and the application status information corresponding to the target application is extracted from the target configuration management database.

[0019] Optionally, constructing application address information according to the policy configuration information and the application state information, for deploying an access control policy corresponding to the target application according to the application address information to the outbound network controller, includes:

[0020] Translate the policy configuration information and the application status to obtain communication information and address information;

[0021] generating application address information based on the communication information and the address information, and sending the application address information to an outbound network controller;

[0022] The outbound network controller deploys the access control policy corresponding to the target application according to the application address information.

[0023] Optionally, when a change in the application address of the target application is detected, calling an address change rule to update the application address information, so that the outbound network controller deploys the access control policy according to the updated application address information, includes:

[0024] When a change in the application address of the target application is detected, obtaining address change information pushed by the configuration management database;

[0025] calling the address change rule corresponding to the outgoing network controller, and updating the application address information according to the address change information;

[0026] The updated application address information is sent to the egress network controller, wherein the egress network controller deploys the access control policy according to the updated application address information.

[0027] Optionally, after executing the step of calling an address change rule to update the application address information when a change in the application address of the target application is detected, the method further includes:

[0028] Detect the updated application address information;

[0029] If the detection result is failed, an address update error report is generated according to the updated application address information, and the address update error report is sent to the operation and maintenance node;

[0030] If the detection result is passed, the application test task corresponding to the target application is executed based on the deployed access control policy.

[0031] According to a second aspect of the embodiments of this specification, there is provided an information processing device, applied to a management and control platform, comprising:

[0032] an acquisition module configured to acquire policy configuration information associated with a target application and application state information corresponding to the target application;

[0033] A construction module is configured to construct application address information according to the policy configuration information and the application state information, and is used to deploy the access control policy corresponding to the target application according to the application address information to the network controller;

[0034] The update module is configured to call the address change rule to update the application address information when detecting a change in the application address of the target application, so that the outbound network controller deploys the access control policy according to the updated application address information.

[0035] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0036] memory and processor;

[0037] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned information processing method are implemented.

[0038] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned information processing method are implemented.

[0039] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, comprising a computer program or instructions, which implement the steps of the above-mentioned information processing method when executed by a processor.

[0040] The information processing method provided in this embodiment can reduce the usage load, improve the efficiency of changing the access control policy, and reduce the error probability. After obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application, the policy configuration information and the application status information are combined to construct the application address information, so that the outbound network controller can deploy the access control policy corresponding to the target application according to the application address information. Afterwards, if the application address of the target application is detected to have changed, it means that the originally deployed access control policy may not support the use of the target application after the address change information. In order to continue to support the normal operation of the target application, the address change rule can be called to update the application address information, so that the outbound network controller can deploy the access control policy according to the updated application address information. The dynamic adjustment of address information at the application level is achieved to complete the deployment of the access control policy, so that the target application can still complete outbound network access even if the address is changed due to other operations, thereby effectively ensuring the control measures for intranet applications to access network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is a flow chart of an information processing method provided by one embodiment of this specification;

[0042] Figure 2 This is a schematic diagram of a policy configuration interface in an information processing method provided in one embodiment of this specification;

[0043] Figure 3 This is a flowchart of a processing process of an information processing method provided by one embodiment of this specification;

[0044] Figure 4 This is a schematic diagram of the structure of an information processing device provided by one embodiment of this specification;

[0045] Figure 5 This is a structural block diagram of a computing device provided by one embodiment of this specification. DETAILED DESCRIPTION

[0046] The following description sets forth many specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0047] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0048] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0049] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0050] First, the terms involved in one or more embodiments of this specification are explained.

[0051] Kubernetes (K8s for short) is a portable, scalable, open source platform for managing containerized workloads and services.

[0052] In this specification, an information processing method is provided. This specification also relates to an information processing apparatus, a computing device, a computer-readable storage medium, and a computer program product, which are described in detail one by one in the following embodiments.

[0053] See also Figure 1 , Figure 1 A flowchart of an information processing method provided according to an embodiment of this specification is shown. The method is applied to a management and control platform and specifically includes the following steps.

[0054] Step S102: Acquire policy configuration information associated with a target application and application status information corresponding to the target application.

[0055] The information processing method provided in this embodiment is applied to the management and control platform connected to the K8s platform. The platform provides business users with a deployment interface for outbound access control policies, so that business users can adjust the outbound access control policies of applications as needed, and can implement application-level IP address adjustments without the need for adjustments in the outbound access controller, thereby effectively improving the operational convenience of business users and reducing the professional requirements.

[0056] Specifically, the target application refers to the application that currently requires the deployment of an access control policy. It can be a container application or a traditional application. Accordingly, the policy configuration information refers to the configuration information submitted by the business user when deploying the access control policy for the target application. This information can record the release information when the target application accesses the specified network resource. This information is used to complete the access operation when the application accesses the network resource if this information is hit. Correspondingly, the application status information refers to the current status obtained at the time of access control policy deployment for the target application. It is used to subsequently construct application address information and deploy access control policies.

[0057] Based on this, in order to reduce the usage load, improve the efficiency of changing the access control policy, and reduce the error probability, after obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application, the application address information can be constructed in combination with the policy configuration information and the application status information, so that the outbound network controller can deploy the access control policy corresponding to the target application according to the application address information; thereafter, if it is detected that the application address of the target application has changed, it means that the originally deployed access control policy may not support the use of the target application after the address change information. In order to continue to support the normal operation of the target application, the address change rule can be called to update the application address information, so that the outbound network controller can deploy the access control policy according to the updated application address information.

[0058] Furthermore, considering that the control platform needs to implement the control and update of application-level address information, in order to be able to implement control for any type of application under the container platform, different information can be selected for different types of applications and stored in the configuration management database. In this embodiment, the specific implementation method is as follows:

[0059] (1) When the target application is a container application, determine the container cluster associated with the container application; subscribe to the container status of the container cluster through the agent node corresponding to the container cluster; when the agent node receives the target status information corresponding to the container application, store the target status information in a configuration management database; wherein the information stored in the configuration management database is used to generate the application status information.

[0060] (2) When the target application is a basic application, basic application information corresponding to the basic application is obtained; and the basic application information is stored in the configuration management database.

[0061] Specifically, the container cluster refers to the cluster to which the container of the target application is deployed. Accordingly, the target state information refers to the description of the current state of the corresponding container application received by the proxy node after subscribing to the container state of the container application. Accordingly, the configuration management database refers to the application cmdb (Configuration Management Database), which is used to integrate application-related attribute information. Accordingly, the basic application refers to the traditional application, and the basic application information refers to the basic application's IP address and other information.

[0062] Based on this, when the target application is a container application, in order to integrate its related attribute information through the application cmdb, you can first determine the container cluster associated with the container application; at this time, you can subscribe to the container status of the container cluster through the agent node corresponding to the container cluster; when the agent node receives the target status information corresponding to the container application, you can store the target status information in the configuration management database.

[0063] If the target application is a base application, it does not need to subscribe to the status information of the proxy node. Therefore, the base application information corresponding to the base application can be directly obtained and stored in the configuration management database. The information stored in the configuration management database can then be used to generate application status information, so that the application address information can be used to deploy access control policies.

[0064] In other words, container applications can use proxy nodes within a container cluster to subscribe to changes in container status within the cluster and add the collected status information to a message queue. Messages can include information such as IP addresses. Traditional applications, on the other hand, can directly collect information such as IP addresses during deployment. Using cmd.com, applications can then integrate relevant attributes for each application, enabling business users to deploy access control policies for those applications.

[0065] In summary, by collecting different information for different types of applications and storing it in the configuration management database, it is possible to directly read relevant information from the library when subsequently deploying access control policies, thereby effectively managing information of different types of applications and improving policy deployment efficiency.

[0066] Furthermore, in order to support business users to complete the deployment of access control policies more concisely, a policy configuration page can be displayed to business users. In this embodiment, the specific implementation is as follows:

[0067] In response to a policy configuration request submitted by a business user for a target application, a policy configuration page is displayed to the business user; policy configuration information submitted by the business user through the policy configuration page is received, and application status information corresponding to the target application is extracted from a target configuration management database.

[0068] Specifically, the policy configuration request refers to the request triggered when the business user submits the configuration access control policy for the target application. Correspondingly, the policy configuration page refers to the page that supports the business user to set the specific information of the policy. Figure 2 As shown, the business user can select the outbound access control policy corresponding to the target application and then configure the specific parameters of the policy.

[0069] Based on this, to facilitate operations for business users, a policy configuration page can be displayed to business users in response to policy configuration requests submitted by business users for target applications. This policy configuration interface provides business users with a configuration interface for specific policy parameters, allowing the policy configuration information submitted by business users through the policy configuration page to be used later. At the same time, application status information corresponding to the target application can be extracted from the target configuration management database, allowing the deployment of access control policies after the application address information is constructed by combining the policy configuration information and application status information.

[0070] For example, to support the implementation of the specified function of container application a, container application a needs to access the interface of network b to obtain information. At this time, the configuration interface of different policies can be displayed to the business user according to the configuration requirements, supporting the business user to configure the outbound access control policy for container application a. When the business user chooses to add a new outbound access control policy control for container application a, the following information can be displayed to the business user: Figure 2The diagram shown allows business users to configure relevant information about container application A and network B on this page, such as the target address type, destination address, protocol type, port address, and application layer protocol. After receiving the policy configuration information submitted by the business user, you can obtain the current status information of container application A from the application cmdb to subsequently deploy an outbound access control policy for container application A's access to network B.

[0071] In summary, by providing business users with a policy configuration interface, it is easier for business users to deploy access control policies, and the professional requirements for business users are lower, making the deployment of access control policies more convenient.

[0072] Step S104 : constructing application address information according to the policy configuration information and the application state information, so as to enable the outbound network controller to deploy an access control policy corresponding to the target application according to the application address information.

[0073] Specifically, after obtaining the policy configuration information and application status information corresponding to the target application as mentioned above, in order to be able to deploy access control policies for the target application and enable the target application to access Internet resources, the application address information corresponding to the target application can be constructed based on the policy configuration information and application status information, so that the outbound network controller can deploy the access control policy corresponding to the target application according to the application address information, so as to support the operation of controlling the target application's access to Internet resources after the access control policy is deployed.

[0074] The application address information specifically refers to the IP policy that is translated from the policy configuration information and application status information, and supports the recognition of the outbound network controller, so that the controller can complete the deployment of the access control policy according to this information. This information records information such as the source IP group, destination address, destination port, communication protocol, and policy text. Accordingly, the outbound network controller specifically refers to a controller that can deploy access control policies for the target container based on the application address information. Accordingly, the access control policy is the policy that controls the target application's access to Internet resources.

[0075] Furthermore, when constructing application address information, considering that application address information is an important element in deploying access control policies, which determines whether the target application can successfully access Internet resources, information that can be recognized by the controller can be obtained through translation for its use. In this embodiment, the specific implementation method is as follows:

[0076] The policy configuration information and the application status are translated to obtain communication information and address information; application address information is generated based on the communication information and the address information, and the application address information is sent to the outbound network controller; wherein the outbound network controller deploys the access control policy corresponding to the target application according to the application address information.

[0077] Specifically, communication information refers to a data structure including information such as port, protocol, etc. Correspondingly, address information refers to a data structure including information such as destination address, source IP group, etc.

[0078] Based on this, after obtaining the policy configuration information and application status information, the policy configuration information and application status can be translated and processed to obtain communication information and address information based on the translation results; on this basis, the communication information and address information can be combined to generate application address information that can be recognized by the outgoing network controller, and send it to the outgoing network controller; thereby, the outgoing network controller can deploy the access control policy corresponding to the target application according to the application address information.

[0079] Continuing with the above example, after obtaining the policy configuration information corresponding to container application a and the current status information of container application a provided by cmdb, the policy configuration information and status information can be translated to generate an IP policy that can be recognized by the outbound network access controller in the K8s platform, and then sent to the outbound network access controller. This allows the outbound network access controller to deploy the outbound access control policy of network b associated with container application a according to the IP policy, so that container application a can obtain relevant information from network b for subsequent use when the rules in the outbound access control policy are matched during the working phase. For example, if application a provides a summary function, after obtaining relevant information related to news event A from network b, it can combine the relevant information to generate a summary of news event A for subsequent use.

[0080] In summary, by combining communication information and address information to construct application address information and sending it to the outbound network controller, the controller can deploy access control policies for target applications to achieve control over target applications' access to Internet resources.

[0081] Step S106 : When a change in the application address of the target application is detected, the address change rule is called to update the application address information, so that the outbound network controller deploys the access control policy according to the updated application address information.

[0082] Specifically, after the access control policy is deployed for the target application, the target application can be supported to access Internet resources. During this process, due to the self-repair and dynamic scaling capabilities of the container deployment scenario, the application's IP address will change; and the access control policy is deployed based on the application IP address. When the IP address changes, the previously deployed access control policy may no longer be adapted to the target application, and will not be able to support the target application to continue accessing the Internet resources corresponding to the policy. Therefore, in order to be able to follow the IP address in the access control policy after the IP address changes, thereby realizing application-level outbound network access control, the address change rule can be called to update the application address information, so that the outbound network controller can update the access control policy according to the updated application address information, so that the access control policy can continue to support the target application's Internet resource access operations.

[0083] The address change rule specifically refers to the address change rule corresponding to the network controller. The rule can directly change the IP address in the access control policy according to the IP address after the target application is changed, thereby realizing dynamic adjustment of the application address information in the policy.

[0084] Furthermore, when a change in the application address of the target application is detected, the application address information can be updated based on the address change information provided by the configuration management database. In this embodiment, the specific implementation is as follows:

[0085] When a change in the application address of the target application is detected, the address change information pushed by the configuration management database is obtained; the address change rule corresponding to the outbound network controller is called, and the application address information is updated according to the address change information; the updated application address information is sent to the outbound network controller, wherein the outbound network controller deploys the access control policy according to the updated application address information.

[0086] Based on this, when a change in the application address of the target application is detected, it means that the originally deployed access control policy may no longer be available. Therefore, the access control policy needs to be updated according to the changed address of the target application. At this time, the address change information pushed by the configuration management database can be obtained; on this basis, the address change rule of the corresponding outbound network controller can be called to update the application address information according to the address change information; the application address information is updated to the application address information corresponding to the target application in the current state, and then the updated application address information can be sent to the outbound network controller, so that the outbound network controller can deploy the access control policy corresponding to the current state according to the updated application address information to support the target application to continue to access Internet resources.

[0087] Continuing with the previous example, if the IP address of container application A changes, the change rule sent to the network controller based on the application IP change message pushed by application cmdb at the current moment can be invoked to update the source IP address in the access control policy. After the update, the source IP address in the policy is aligned with the current source IP address of the running container application A. This ensures that external calls initiated by the application will still match the user-defined policy, allowing container application A to continue to obtain information from network B.

[0088] In summary, by dynamically adjusting the application address information in the access control policy, the target application can continue to match the rules in the policy, thereby automatically completing the policy update without manual adjustment.

[0089] In addition, in order to ensure that the target application can run correctly, a detection mechanism can also be provided. In this embodiment, the specific implementation method is as follows:

[0090] Perform a test on the updated application address information; if the test result is failed, generate an address update error report based on the updated application address information, and send the address update error report to the operation and maintenance node; if the test result is passed, execute the application test task corresponding to the target application based on the deployed access control policy.

[0091] Based on this, the updated application address information is tested; if the test result is failed, it means that after the application address is updated, even if the application address in the access control policy is dynamically adjusted, the target application cannot continue to work. Therefore, an address update error report can be generated based on the updated application address information, and the address update error report can be sent to the operation and maintenance node to notify the relevant operation and maintenance users to conduct troubleshooting.

[0092] If the test result is passed, it means that the update of the application address information can be used. At this time, the application test task corresponding to the target application can be executed based on the deployed access control policy to provide a backup through testing to ensure that the target application can operate normally.

[0093] The information processing method provided in this embodiment can reduce the usage load, improve the efficiency of changing the access control policy, and reduce the error probability. After obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application, the policy configuration information and the application status information are combined to construct the application address information, so that the outbound network controller can deploy the access control policy corresponding to the target application according to the application address information. Afterwards, if the application address of the target application is detected to have changed, it means that the originally deployed access control policy may not support the use of the target application after the address change information. In order to continue to support the normal operation of the target application, the address change rule can be called to update the application address information, so that the outbound network controller can deploy the access control policy according to the updated application address information. The dynamic adjustment of address information at the application level is achieved to complete the deployment of the access control policy, so that the target application can still complete outbound network access even if the address is changed due to other operations, thereby effectively ensuring the control measures for intranet applications to access network resources.

[0094] The following combined Figure 3 , taking the application of the information processing method provided in this specification in the container deployment scenario as an example, the information processing method is further explained. Figure 3 A flowchart of a processing process of an information processing method provided by an embodiment of this specification is shown, which specifically includes the following steps.

[0095] Step S302 : In response to a policy configuration request submitted by a business user for a target application, a policy configuration page is displayed to the business user.

[0096] Step S304: receiving the policy configuration information submitted by the business user through the policy configuration page, and extracting the application status information corresponding to the target application from the target configuration management database.

[0097] Step S306: Translate the policy configuration information and the application status to obtain communication information and address information.

[0098] Step S308 : Generate application address information based on the communication information and the address information, and send the application address information to the egress network controller; wherein the egress network controller deploys an access control policy corresponding to the target application according to the application address information.

[0099] Step S310: When a change in the application address of the target application is detected, the address change information pushed by the configuration management database is obtained.

[0100] Step S312: calling the address change rule corresponding to the outgoing network controller, and updating the application address information according to the address change information.

[0101] Step S314: Send the updated application address information to the egress network controller, wherein the egress network controller deploys an access control policy according to the updated application address information.

[0102] In summary, in order to reduce usage load, improve the efficiency of access control policy changes, and reduce the probability of errors, after obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application, the policy configuration information and the application status information can be combined to construct the application address information, so that the outbound network controller can deploy the access control policy corresponding to the target application according to the application address information; thereafter, if a change in the application address of the target application is detected, it means that the originally deployed access control policy may not support the use of the target application after the address change information. In order to continue to support the normal operation of the target application, the address change rule can be called to update the application address information, so that the outbound network controller can deploy the access control policy according to the updated application address information. The deployment of the access control policy is completed by dynamically adjusting the address information at the application level, so that the target application can still complete outbound network access even if the address is changed due to other operations, thereby effectively ensuring the control measures for intranet applications to access network resources.

[0103] Corresponding to the above method embodiment, this specification also provides an information processing device embodiment, Figure 4 FIG1 shows a schematic diagram of the structure of an information processing device provided by an embodiment of this specification. Figure 4 As shown, the device is applied to the management and control platform, including:

[0104] An acquisition module 402 is configured to acquire policy configuration information associated with a target application and application state information corresponding to the target application;

[0105] A construction module 404 is configured to construct application address information according to the policy configuration information and the application state information, and to deploy the access control policy corresponding to the target application according to the application address information to the outbound network controller;

[0106] The update module 406 is configured to call the address change rule to update the application address information when a change in the application address of the target application is detected, so that the outbound network controller deploys the access control policy according to the updated application address information.

[0107] In an optional embodiment, the device further includes:

[0108] The subscription module is configured to, when the target application is a container application, determine the container cluster associated with the container application; subscribe to the container status of the container cluster through the proxy node corresponding to the container cluster; and, when the proxy node receives the target status information corresponding to the container application, store the target status information in a configuration management database; wherein the information stored in the configuration management database is used to generate the application status information.

[0109] In an optional embodiment, the device further includes:

[0110] The storage module is configured to, when the target application is a basic application, obtain basic application information corresponding to the basic application; and store the basic application information in the configuration management database.

[0111] In an optional embodiment, the acquisition module 402 is further configured to:

[0112] In response to a policy configuration request submitted by a business user for a target application, a policy configuration page is displayed to the business user; policy configuration information submitted by the business user through the policy configuration page is received, and application status information corresponding to the target application is extracted from a target configuration management database.

[0113] In an optional embodiment, the construction module 404 is further configured to:

[0114] The policy configuration information and the application status are translated to obtain communication information and address information; application address information is generated based on the communication information and the address information, and the application address information is sent to the outbound network controller; wherein the outbound network controller deploys the access control policy corresponding to the target application according to the application address information.

[0115] In an optional embodiment, the updating module 406 is further configured to:

[0116] When a change in the application address of the target application is detected, the address change information pushed by the configuration management database is obtained; the address change rule corresponding to the outbound network controller is called, and the application address information is updated according to the address change information; the updated application address information is sent to the outbound network controller, wherein the outbound network controller deploys the access control policy according to the updated application address information.

[0117] In an optional embodiment, the device further includes:

[0118] The detection module is configured to detect the updated application address information; if the detection result is failed, an address update error report is generated based on the updated application address information, and the address update error report is sent to the operation and maintenance node; if the detection result is passed, the application test task corresponding to the target application is executed based on the access control policy after deployment.

[0119] The information processing device provided in this embodiment can, in order to reduce the usage load, improve the efficiency of changing the access control policy, and reduce the error probability, after obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application, combine the policy configuration information and the application status information to construct the application address information, so that the outbound network controller can deploy the access control policy corresponding to the target application according to the application address information; thereafter, if it is detected that the application address of the target application has changed, it means that the originally deployed access control policy may not support the use of the target application after the address change information. In order to continue to support the normal operation of the target application, the address change rule can be called to update the application address information, so that the outbound network controller can deploy the access control policy according to the updated application address information. The dynamic adjustment of address information at the application level is achieved to complete the deployment of the access control policy, so that even if the address of the target application changes due to other operations, it can still complete the outbound network access, thereby effectively ensuring the control measures for the intranet application to access network resources.

[0120] The above is a schematic diagram of an information processing device according to this embodiment. It should be noted that the technical solution of the information processing device and the technical solution of the above-mentioned information processing method are based on the same concept. For details not described in detail in the technical solution of the information processing device, please refer to the description of the technical solution of the above-mentioned information processing method.

[0121] Figure 5 The block diagram of a computing device 500 according to one embodiment of the present disclosure is shown. Components of the computing device 500 include, but are not limited to, a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and a database 550 is used to store data.

[0122] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of such networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, or a near field communication (NFC) interface.

[0123] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. Figure 5 The computing device structure block diagram shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art may add or replace other components as needed.

[0124] Computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, personal digital assistant, laptop computer, notebook computer, netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or personal computer (PC). Computing device 500 may also be a mobile or stationary server.

[0125] The processor 520 is configured to execute the following computer-executable instructions, which implement the steps of the above-mentioned information processing method when executed by the processor.

[0126] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned information processing method are based on the same concept. For details not described in detail in the technical scheme of the computing device, please refer to the description of the technical scheme of the above-mentioned information processing method.

[0127] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which implement the steps of the above-mentioned information processing method when executed by a processor.

[0128] The above is a schematic diagram of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of the storage medium and the technical solution of the information processing method described above are based on the same concept. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the information processing method described above.

[0129] An embodiment of the present specification further provides a computer program product, including a computer program or instructions, which implement the steps of the above-mentioned information processing method when executed by a processor.

[0130] The above is an illustrative solution of a computer program product of this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the above-mentioned information processing method are based on the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the above-mentioned information processing method.

[0131] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0132] The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media does not include electric carrier signals and telecommunication signals.

[0133] It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0134] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0135] The preferred embodiments disclosed above are intended only to help illustrate this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of the embodiments described herein. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification.

Claims

1. An information processing method, It is characterized in that Applied to the management and control platform, including: Obtaining policy configuration information associated with a target application and application status information corresponding to the target application; Constructing application address information according to the policy configuration information and the application status information, and using it to deploy the access control policy corresponding to the target application according to the application address information to the outbound network controller; When a change in the application address of the target application is detected, the address change rule is called to update the application address information, so that the outbound network controller deploys the access control policy according to the updated application address information.

2. The information processing method according to claim 1, It is characterized in that Before the step of obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application is performed, the method further includes: When the target application is a container application, determining a container cluster associated with the container application; Subscribe to the container status of the container cluster through the proxy node corresponding to the container cluster; When the proxy node receives the target state information corresponding to the container application, the target state information is stored in a configuration management database; The information stored in the configuration management database is used to generate the application status information.

3. The information processing method according to claim 2, It is characterized in that Before the step of obtaining the policy configuration information of the associated target application and the application status information corresponding to the target application is performed, the method further includes: In the case where the target application is a basic application, obtaining basic application information corresponding to the basic application; The basic application information is stored in the configuration management database.

4. The information processing method according to claim 1, It is characterized in that The acquiring of the policy configuration information associated with the target application and the application status information corresponding to the target application includes: In response to a policy configuration request submitted by a business user for a target application, displaying a policy configuration page to the business user; The policy configuration information submitted by the business user through the policy configuration page is received, and the application state information corresponding to the target application is extracted from the target configuration management database.

5. The information processing method according to claim 1, It is characterized in that The constructing the application address information according to the policy configuration information and the application state information, for deploying the access control policy corresponding to the target application according to the application address information to the outbound network controller, includes: Translating the policy configuration information and the application status to obtain communication information and address information; generating application address information based on the communication information and the address information, and sending the application address information to an outbound network controller; The outbound network controller deploys the access control policy corresponding to the target application according to the application address information.

6. The information processing method according to claim 2 or 3, It is characterized in that The calling of the address change rule to update the application address information when a change in the application address of the target application is detected, so that the outbound network controller deploys the access control policy according to the updated application address information, comprises: When a change in the application address of the target application is detected, obtaining address change information pushed by the configuration management database; Calling the address change rule corresponding to the outgoing network controller, and updating the application address information according to the address change information; The updated application address information is sent to the egress network controller, wherein the egress network controller deploys the access control policy according to the updated application address information.

7. The information processing method according to claim 1, It is characterized in that After the step of calling the address change rule to update the application address information when a change in the application address of the target application is detected, the method further includes: Detect the updated application address information; If the detection result is failed, an address update error report is generated according to the updated application address information, and the address update error report is sent to the operation and maintenance node; When the detection result is passed, the application test task corresponding to the target application is executed based on the deployed access control policy.

8. An information processing device, It is characterized in that Applied to the management and control platform, including: An acquisition module is configured to acquire policy configuration information associated with a target application and application status information corresponding to the target application; A construction module is configured to construct application address information according to the policy configuration information and the application state information, and is used to deploy the access control policy corresponding to the target application according to the application address information to the network controller; The update module is configured to call the address change rule to update the application address information when a change in the application address of the target application is detected, so that the outbound network controller deploys the access control policy according to the updated application address information.

9. A computing device, It is characterized in that include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, It is characterized in that It stores computer executable instructions, which, when executed by a processor, implement the steps of the method described in any one of claims 1 to 7.

11. A computer program product, It is characterized in that The method comprises a computer program or an instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images