Method and device for controlling private cloud server, electronic equipment, storage medium and program product

Abstract

The invention provides a method and a device for controlling a private cloud server, electronic equipment, a storage medium and a program product, which can be applied to the technical field of information security. The method comprises the following steps: acquiring a destination identifier of an extranet server and a source address of a private cloud server; converting the source address and the destination identifier to obtain a source conversion address and a destination conversion address; based on the source address, the destination identifier, the source translation address and the destination translation address, performing firewall policy configuration on the private cloud server and the extranet server to obtain a private cloud policy configuration result and an extranet policy configuration result; generating an access strategy message according to the private cloud strategy configuration result, the extranet strategy configuration result, the source translation address and the destination translation address; and sending the access strategy message to the private cloud server.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and more specifically, to a method and device, electronic device, storage medium and program product for controlling a private cloud server. Background Art

[0002] With the rapid release of resources, large financial enterprises currently need to build large-scale private clouds. It is common for public Internet addresses to be used for private purposes. When the Internet address that needs to be accessed conflicts with the intranet address, it is difficult to determine the ownership of the Internet address and the access route, which leads to access failures.

[0003] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following problems in the related technology: the existing method of resolving conflicts by manually modifying the intranet address has high business access risks and complex access operation processes. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method and device, an electronic device, a storage medium and a program product for controlling a private cloud server.

[0005] According to a first aspect of the present disclosure, a method for controlling a private cloud server is provided, which is applied to an intranet service area and includes:

[0006] Obtain a destination identifier of an external network server and a source address of a private cloud server, wherein the destination identifier is used to access the external network server; convert the source address and the destination identifier to obtain a source conversion address and a destination conversion address; based on the source address, the destination identifier, the source conversion address and the destination conversion address, respectively configure firewall policies for the private cloud server and the external network server to obtain a private cloud policy configuration result and an external network policy configuration result; generate an access policy message according to the private cloud policy configuration result and the external network policy configuration result, as well as the source conversion address and the destination conversion address; and send an access policy message to the private cloud server, wherein the private cloud server accesses the external network server based on the access policy message.

[0007] According to an embodiment of the present disclosure, converting a destination identifier to obtain a destination conversion address includes:

[0008] When the destination identifier is the destination domain name, the domain name resolution server is controlled to resolve the destination domain name to obtain the destination domain name address; the configured network address translation device is called to translate the destination domain name address to obtain the destination domain name translation address, wherein the network address translation device is deployed outside the private cloud area, and the configured network address translation device includes the configuration of the destination domain name network segment, the destination domain name address translation relationship and the domain name resolution server address translation relationship; the domain name resolution server address is translated according to the network address translation device to obtain the domain name resolution server translation address, wherein the domain name resolution server address represents the address of the domain name resolution server in the external network area; the destination translation address is obtained according to the destination domain name translation address and the domain name resolution server translation address.

[0009] According to an embodiment of the present disclosure, based on the source address, the destination identifier, the source conversion address, and the destination conversion address, firewall policy configuration is performed on the private cloud server and the external network server respectively, and a private cloud policy configuration result and an external network policy configuration result are obtained, including:

[0010] Based on the source address, the destination conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a private cloud policy configuration result, wherein the private cloud server is used to access the destination conversion address from the source address based on the private cloud policy configuration result; based on the destination identifier, the source conversion address and the preset destination service protocol, a firewall policy is configured for the external network server to obtain an external network policy configuration result, wherein the private cloud server is used to access the destination identifier from the source conversion address based on the external network policy configuration result.

[0011] According to an embodiment of the present disclosure, based on the source address, the destination conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a private cloud policy configuration result, including:

[0012] Based on the source address, the destination domain name conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a first private cloud policy configuration result, wherein the private cloud server is used to access the destination domain name conversion address from the source address based on the first private cloud policy configuration result; based on the source address, the domain name resolution server conversion address and the destination service protocol, a firewall policy is configured for the private cloud server to obtain a second private cloud policy configuration result, wherein the private cloud server is used to access the domain name resolution server conversion address from the source address based on the second private cloud policy configuration result; the private cloud policy configuration result is determined based on the first private cloud policy configuration result and the second private cloud policy configuration result.

[0013] According to an embodiment of the present disclosure, based on the destination identifier, source translation address, destination service protocol and port, a firewall policy is configured for the external network server to obtain an external network policy configuration result, including:

[0014] Based on the destination domain name address, source conversion address, destination service protocol and port, a firewall policy is configured on the external network server to obtain a first external network policy configuration result, wherein the private cloud server is used to access the destination domain name address from the source conversion address based on the first external network policy configuration result; based on the domain name resolution server address, source conversion address, destination service protocol and port, a firewall policy is configured on the external network server to obtain a second external network policy configuration result, wherein the private cloud server is used to access the domain name resolution server address from the source conversion address based on the second external network policy configuration result; the external network policy configuration result is determined based on the first external network policy configuration result and the second external network policy configuration result.

[0015] According to an embodiment of the present disclosure, converting the destination identifier to obtain the destination conversion address also includes:

[0016] In the case where the destination identifier is a protocol address, the configured network address translation device is called to translate the destination identifier to obtain a destination translation address, wherein the configured network address translation device includes the configuration of the destination address network segment and the protocol address translation relationship.

[0017] According to an embodiment of the present disclosure, converting a source address to obtain a source conversion address includes:

[0018] Perform address conversion configuration on the private cloud server to obtain a source address conversion relationship; convert the source address according to the source address conversion relationship to obtain a source conversion address.

[0019] According to an embodiment of the present disclosure, the method for controlling a private cloud server further includes:

[0020] Acquire communication data of multiple routing paths, obtain communication load data corresponding to each of the multiple routing paths, the routing path being a communication path for a source conversion address to access a destination identifier; process the multiple communication load data according to a load balancing algorithm, and obtain a target routing path for a source conversion address to access a destination identifier.

[0021] A second aspect of the present disclosure provides a device for controlling a private cloud server, comprising:

[0022] An acquisition module, used to acquire a destination identifier of an external network server and a source address of a private cloud server, wherein the destination identifier is used to access the external network server;

[0023] A conversion module, used for converting the source address and the destination identifier to obtain a source conversion address and a destination conversion address;

[0024] A configuration module is used to configure firewall policies for the private cloud server and the external network server respectively based on the source address, the destination identifier, the source translation address, and the destination translation address, and obtain a private cloud policy configuration result and an external network policy configuration result;

[0025] A generation module, used to generate an access policy message according to the private cloud policy configuration result and the external network policy configuration result, as well as the source translation address and the destination translation address; and

[0026] The sending module is used to send an access policy message to the private cloud server, wherein the private cloud server accesses the external network server based on the access policy message.

[0027] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned method for controlling a private cloud server.

[0028] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned method for controlling a private cloud server.

[0029] The fifth aspect of the present disclosure also provides a program product, including a computer program, which implements the above-mentioned method for controlling a private cloud server when executed by a processor.

[0030] According to the method and device, electronic device, computer-readable storage medium and program product for controlling a private cloud server provided by the present disclosure, the source address and the destination identifier are converted to obtain the source conversion address and the destination conversion address, and then the firewall policy configuration is performed on the private cloud server and the external network server respectively to obtain the private cloud policy configuration result and the external network policy configuration result; then, according to the private cloud policy configuration result and the external network policy configuration result, as well as the source conversion address and the destination conversion address, an access policy message is generated and sent to the private cloud server. Since the source address and the destination identifier are converted and the firewall policies of the private cloud server and the external network server are configured accordingly, it is possible to access the destination conversion address from the source address in the private cloud area and access the destination address from the source conversion address in the external network area, which solves the technical problem that when the external network server address is similar to the private cloud server address, the attribution of the external network server address cannot be determined, resulting in access failure, improves the stability and convenience of private cloud access to the external network, and reduces business access risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0032] Figure 1 The application scenario of the method for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown;

[0033] Figure 2 A flowchart of a method for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown;

[0034] Figure 3 The example schematic diagram of determining the source conversion address and the destination conversion address according to the embodiment of the present disclosure is schematically shown;

[0035] Figure 4 The example schematic diagram of generating an access policy message according to an embodiment of the present disclosure is schematically shown;

[0036] Figure 5 A structural block diagram of a device for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown; and

[0037] Figure 6 A block diagram of an electronic device suitable for implementing a method for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0038] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0039] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0040] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0041] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0042] At present, private clouds generally access the Internet by directly accessing Internet domain names or Internet addresses through address translation in the cloud. When the Internet address to be accessed conflicts with the intranet address, it is difficult to determine the ownership of the Internet address and the access route, resulting in access failure. The existing method of resolving conflicts by manually modifying the intranet address has high business access risks and complicated access operation processes.

[0043] In view of this, an embodiment of the present disclosure provides a method for controlling a private cloud server. The method includes: obtaining a destination identifier of an external network server and a source address of a private cloud server; converting the source address and the destination identifier to obtain a source conversion address and a destination conversion address; configuring firewall policies for the private cloud server and the external network server respectively based on the source address, the destination identifier, the source conversion address and the destination conversion address to obtain a private cloud policy configuration result and an external network policy configuration result; generating an access policy message according to the private cloud policy configuration result and the external network policy configuration result, as well as the source conversion address and the destination conversion address; and sending an access policy message to the private cloud server.

[0044] It should be noted that the method for controlling a private cloud server and the device for controlling a private cloud server provided in the present disclosure can be used in the financial field, such as banks and other financial institutions, and can also be used in any field other than the financial field. Therefore, the application field of the method for controlling a private cloud server and the device for controlling a private cloud server provided in the present disclosure is not limited.

[0045] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0046] Figure 1 The application scenario of the method for controlling a private cloud server according to an embodiment of the present disclosure is schematically illustrated.

[0047] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0048] The user may use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0049] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0050] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0051] It should be noted that the method for controlling the private cloud server provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the device for controlling the private cloud server provided in the embodiment of the present disclosure can generally be set in the server 105. The method for controlling the private cloud server provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the device for controlling the private cloud server provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0052] Alternatively, the method for controlling the private cloud server provided in the embodiment of the present disclosure may also be executed by the first terminal device 101, the second terminal device 102, or the third terminal device 103, or may also be executed by other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103. Accordingly, the apparatus for controlling the private cloud server provided in the embodiment of the present disclosure may also be provided in the first terminal device 101, the second terminal device 102, or the third terminal device 103, or may be provided in other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103.

[0053] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0054] It should be noted that the sequence numbers of the operations in the following method are only used as representations of the operations for the purpose of description, and should not be regarded as representing the execution order of the operations. Unless explicitly stated, the method does not need to be executed completely in the order shown.

[0055] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The method for controlling a private cloud server in a disclosed embodiment is described in detail.

[0056] Figure 2 A flowchart of a method for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown.

[0057] like Figure 2 As shown, the method 200 includes operations S210 to S250.

[0058] In operation S210, a destination identifier of the external network server and a source address of the private cloud server are obtained.

[0059] According to an embodiment of the present disclosure, a method for controlling a private cloud server is applied to an intranet service area.

[0060] According to an embodiment of the present disclosure, the intranet service area represents the intranet communication area, the private cloud server is deployed in the intranet communication area, and the private cloud server represents the server that provides computing services only to selected users through the public network or a dedicated internal network. For example, an enterprise internal cloud.

[0061] According to an embodiment of the present disclosure, the destination identifier is used to access the external network server, and the destination identifier can be the external network server address or the external network server domain name. The external network server refers to the server of other computers on the Internet outside the intranet service area. For example, the server of Company B is an external network server relative to the server of Company A.

[0062] According to an embodiment of the present disclosure, the private cloud server receives an access request sent by a user terminal, and obtains a destination identifier of the external network server and a source address of the private cloud server from the access request.

[0063] In operation S220, the source address and the destination identifier are converted to obtain a source conversion address and a destination conversion address.

[0064] According to an embodiment of the present disclosure, for example, an application on a private cloud server converts a source address according to a network address translation relationship to obtain a source translation address. According to a network address translation relationship, a destination identifier is converted to obtain a destination translation address.

[0065] In operation S230, based on the source address, the destination identifier, the source conversion address, and the destination conversion address, firewall policies are configured for the private cloud server and the external network server, respectively, to obtain a private cloud policy configuration result and an external network policy configuration result.

[0066] According to an embodiment of the present disclosure, an application on a private cloud server configures a firewall policy for the private cloud server, activates a firewall policy for accessing a destination conversion address from a source address within the private cloud, and a private cloud policy configuration result represents a firewall policy activation result for an area within the private cloud.

[0067] For example, configuring a firewall policy for a private cloud server may include configuring a route with a destination translation address pointing to an external network.

[0068] According to an embodiment of the present disclosure, a firewall policy is configured for an external network server, and a firewall policy for accessing a destination address from a source translation address in an external network boundary area is enabled. The external network policy configuration result represents the firewall policy enabling result in the external network boundary area.

[0069] For example, configuring a firewall policy for an external network server may include configuring a route in which a source translation address points to an internal network.

[0070] In operation S240, an access policy message is generated according to the private cloud policy configuration result and the external network policy configuration result, as well as the source translation address and the destination translation address.

[0071] According to an embodiment of the present disclosure, the private cloud policy configuration result may be that the firewall policy of the private cloud internal area has been activated, and the external network policy configuration result may be that the firewall policy of the external network boundary area has been activated.

[0072] According to an embodiment of the present disclosure, an application on a private cloud server generates an access policy message according to a private cloud policy configuration result and an external network policy configuration result, a source translation address, and a destination translation address.

[0073] In operation S250, an access policy message is sent to the private cloud server.

[0074] According to an embodiment of the present disclosure, an application on a private cloud server sends an access policy message to the private cloud server, and the private cloud server accesses the external network server according to the access policy message.

[0075] According to an embodiment of the present disclosure, the private cloud server accesses the external network server according to the access policy message, including: accessing the destination conversion address from the source address in the private cloud area, and accessing the destination address from the source conversion address in the external network area.

[0076] According to the embodiments of the present disclosure, since the source address and the destination identifier are respectively converted and the firewall policies of the private cloud server and the external network server are configured accordingly, it is possible to access the destination conversion address from the source address in the private cloud area and to access the destination address from the source conversion address in the external network area. This solves the technical problem of access failure caused by the inability to determine the ownership of the external network server address when the external network server address is similar to the private cloud server address, thereby improving the stability and convenience of the private cloud access to the external network.

[0077] According to an embodiment of the present disclosure, converting a destination identifier to obtain a destination conversion address includes:

[0078] When the destination identifier is the destination domain name, the domain name resolution server is controlled to resolve the destination domain name to obtain the destination domain name address; the configured network address translation device is called to translate the destination domain name address to obtain the destination domain name translation address, wherein the network address translation device is deployed outside the private cloud area, and the configured network address translation device includes the configuration of the destination domain name network segment, the destination domain name address translation relationship and the domain name resolution server address translation relationship; the domain name resolution server address is translated according to the network address translation device to obtain the domain name resolution server translation address, wherein the domain name resolution server address represents the address of the domain name resolution server in the external network area; the destination translation address is obtained according to the destination domain name translation address and the domain name resolution server translation address.

[0079] According to an embodiment of the present disclosure, when the source address accesses the destination domain name, the private cloud service end sends a request to the domain name resolution server in the external network area, and uses the domain name resolution server to resolve the destination domain name to obtain the destination domain name address. The destination domain name address represents the network protocol (intellectual property, IP) address of the external network server. The domain name resolution server is used to provide domain name and network protocol (IP) address resolution services.

[0080] According to an embodiment of the present disclosure, the configuration of the destination domain name network segment is used for dynamic conversion of the destination domain name.

[0081] According to the embodiments of the present disclosure, since there may be multiple servers accessing the same destination domain name in a private cloud, the configuration of the destination domain name address conversion relationship adopts a dynamic many-to-one address conversion method, thereby improving the address conversion efficiency.

[0082] According to an embodiment of the present disclosure, the configuration of resolving the server address translation relationship adopts a one-to-one address translation method.

[0083] According to an embodiment of the present disclosure, a configured network address translation device is called to translate a destination domain name address to obtain a destination domain name translation address; and a domain name resolution server address is translated to obtain a domain name resolution server translation address.

[0084] According to an embodiment of the present disclosure, a combination of a destination domain name translation address and a domain name resolution server translation address constitutes a destination translation address.

[0085] According to an embodiment of the present disclosure, the configured network address translation device also includes basic device configuration, such as network address translation device VRRP (Virtual Router Redundancy Protocol) configuration, network address translation connection table synchronization configuration, interface address, routing configuration, and enabling application layer gateway (ALG) function.

[0086] According to an embodiment of the present disclosure, a configured network address translation device is deployed outside the private cloud area, thereby achieving address translation of the destination domain name address and the domain name resolution server address when the private cloud server accesses the destination domain name.

[0087] According to an embodiment of the present disclosure, based on the source address, the destination identifier, the source conversion address, and the destination conversion address, firewall policy configuration is performed on the private cloud server and the external network server respectively, and a private cloud policy configuration result and an external network policy configuration result are obtained, including:

[0088] Based on the source address, the destination conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a private cloud policy configuration result, wherein the private cloud server is used to access the destination conversion address from the source address based on the private cloud policy configuration result; based on the destination identifier, the source conversion address and the preset destination service protocol, a firewall policy is configured for the external network server to obtain an external network policy configuration result, wherein the private cloud server is used to access the destination identifier from the source conversion address based on the external network policy configuration result.

[0089] According to an embodiment of the present disclosure, the private cloud server receives an access request sent by the user terminal, and also obtains the preset destination service protocol, private cloud server port, and external network server port from the access request. For example, the preset destination service protocol is HyperText Transfer Protocol (http), etc.

[0090] According to an embodiment of the present disclosure, configuring a firewall policy for a private cloud server may include: configuring a firewall policy for accessing a destination conversion address from a source address based on a source address, a destination conversion address, a preset destination service protocol, a private cloud server port, and an external network server port.

[0091] According to an embodiment of the present disclosure, firewall policy configuration for a private cloud server includes destination translation address routing configuration and virtual firewall policy configuration. The destination translation address routing configuration includes configuring the destination translation address to point to the external network and configuring a route for accessing the destination address from the source address.

[0092] According to an embodiment of the present disclosure, when the private cloud policy configuration result is enabled, the destination conversion address can be accessed from the source address in the private cloud area.

[0093] According to an embodiment of the present disclosure, configuring a firewall policy for an external network server may include: configuring a firewall policy for accessing the destination identifier from the source conversion address based on the destination identifier, source conversion address, preset destination service protocol, private cloud server port, and external network server port.

[0094] According to an embodiment of the present disclosure, firewall policy configuration for an external network server includes source translation address routing configuration and virtual firewall policy configuration. Source translation address routing configuration includes configuring the source translation address to point to the internal network and configuring a route to access the destination identifier from the source translation address.

[0095] According to an embodiment of the present disclosure, when the external network policy configuration result is enabled, the destination identifier can be accessed from the source translation address within the external network boundary area.

[0096] According to an embodiment of the present disclosure, based on the source address, the destination conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a private cloud policy configuration result, including:

[0097] Based on the source address, the destination domain name conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a first private cloud policy configuration result, wherein the private cloud server is used to access the destination domain name conversion address from the source address based on the first private cloud policy configuration result; based on the source address, the domain name resolution server conversion address and the destination service protocol, a firewall policy is configured for the private cloud server to obtain a second private cloud policy configuration result, wherein the private cloud server is used to access the domain name resolution server conversion address from the source address based on the second private cloud policy configuration result; the private cloud policy configuration result is determined based on the first private cloud policy configuration result and the second private cloud policy configuration result.

[0098] According to an embodiment of the present disclosure, when a private cloud server accesses a destination domain name, the destination conversion address includes a destination domain name conversion address and a domain name resolution server conversion address.

[0099] According to an embodiment of the present disclosure, configuring a firewall policy for a private cloud server may include: configuring a firewall policy for accessing a destination domain name conversion address from a source address based on a source address, a destination domain name conversion address, a preset destination service protocol, a private cloud server port, and an external network server port, to obtain a first private cloud policy configuration result; configuring a firewall policy for accessing a domain name resolution server conversion address from a source address based on a source address, a domain name resolution server conversion address, a preset destination service protocol, a private cloud server port, and an external network server port, to obtain a second private cloud policy configuration result.

[0100] According to an embodiment of the present disclosure, firewall policy configuration for a private cloud server includes destination domain name translation address routing configuration, domain name resolution server translation address routing configuration, and virtual firewall policy configuration. The destination domain name translation address routing configuration includes configuring the destination domain name translation address to point to the external network, configuring a route to access the destination domain name translation address from a source address, and configuring a route to access the domain name resolution server translation address from a source address.

[0101] According to an embodiment of the present disclosure, when the first private cloud policy configuration result and the second private cloud policy configuration result are both activated, the private cloud policy configuration result is obtained as activated, and then the destination domain name conversion address can be accessed from the source address within the private cloud area, and the domain name resolution server conversion address can be accessed from the source address.

[0102] According to an embodiment of the present disclosure, based on the destination identifier, source translation address, destination service protocol and port, a firewall policy is configured for the external network server to obtain an external network policy configuration result, including:

[0103] Based on the destination domain name address, source conversion address, destination service protocol and port, a firewall policy is configured on the external network server to obtain a first external network policy configuration result, wherein the private cloud server is used to access the destination domain name address from the source conversion address based on the first external network policy configuration result; based on the domain name resolution server address, source conversion address, destination service protocol and port, a firewall policy is configured on the external network server to obtain a second external network policy configuration result, wherein the private cloud server is used to access the domain name resolution server address from the source conversion address based on the second external network policy configuration result; the external network policy configuration result is determined based on the first external network policy configuration result and the second external network policy configuration result.

[0104] According to an embodiment of the present disclosure, configuring a firewall policy for an external network server may include: configuring a firewall policy for accessing a destination domain name address from a source conversion address based on a destination domain name address, a source conversion address, a preset destination service protocol, a private cloud server port, and an external network server port, to obtain a first external network policy configuration result; configuring a firewall policy for accessing a domain name resolution server address from a source conversion address based on a source conversion address, a domain name resolution server address, a preset destination service protocol, a private cloud server port, and an external network server port, to obtain a second external network policy configuration result.

[0105] According to an embodiment of the present disclosure, firewall policy configuration for an external network server includes source translation address routing configuration and virtual firewall policy configuration. Source translation address routing configuration includes configuring the source translation address to point to the intranet, configuring the route from the source translation address to access the destination domain name address, and configuring the route from the source translation address to access the domain name resolution server address.

[0106] According to an embodiment of the present disclosure, when the first external network policy configuration result and the second external network policy configuration result are both activated, the external network policy configuration result is obtained as activated, and then the destination domain name address can be accessed from the source conversion address in the external network boundary area, and the domain name resolution server address can be accessed from the source conversion address.

[0107] According to an embodiment of the present disclosure, converting the destination identifier to obtain the destination conversion address also includes:

[0108] In the case where the destination identifier is a protocol address, the configured network address translation device is called to translate the destination identifier to obtain a destination translation address, wherein the configured network address translation device includes the configuration of the destination address network segment and the protocol address translation relationship.

[0109] According to an embodiment of the present disclosure, the protocol address is an Internet Protocol Address (Internet Protocol Address). When the private cloud server directly accesses the protocol address of the external network server, the configured network address translation device is called to translate the protocol address to obtain the destination translation address.

[0110] According to an embodiment of the present disclosure, the configured network address translation device includes basic device configuration, configuration of destination address network segment and protocol address translation relationship. The configuration of destination address network segment is used to clarify the translation of protocol address.

[0111] According to an embodiment of the present disclosure, the configuration of the protocol address translation relationship adopts a one-to-one translation method between the protocol address and the destination translation address.

[0112] According to an embodiment of the present disclosure, configuring a firewall policy for a private cloud server may include: configuring a firewall policy for accessing a destination conversion address from a source address based on a source address, a destination conversion address, a preset destination service protocol, a private cloud server port, and an external network server port.

[0113] According to an embodiment of the present disclosure, configuring a firewall policy for an external network server may include: configuring a firewall policy for accessing the protocol address from the source conversion address based on the protocol address, source conversion address, preset destination service protocol, private cloud server port, and external network server port.

[0114] According to an embodiment of the present disclosure, when the private cloud policy configuration result is enabled, the destination conversion address can be accessed from the source address in the private cloud area.

[0115] According to an embodiment of the present disclosure, when the external network policy configuration result is enabled, the protocol address can be accessed from the source translation address within the external network boundary area.

[0116] According to an embodiment of the present disclosure, converting a source address to obtain a source conversion address includes:

[0117] Perform address conversion configuration on the private cloud server to obtain a source address conversion relationship; convert the source address according to the source address conversion relationship to obtain a source conversion address.

[0118] According to an embodiment of the present disclosure, an address pool is configured on a private cloud server, the address pool stores a mapping relationship between a source address and a source conversion address, and the source address is bound to the address pool to obtain a source address conversion relationship.

[0119] According to an embodiment of the present disclosure, the source address is converted according to the source address conversion relationship to obtain a source conversion address. For example, the source address 192.168.1.x is converted to the source conversion address 203.0.113.0.

[0120] Figure 3 The example diagram of determining a source conversion address and a destination conversion address according to an embodiment of the present disclosure is schematically shown.

[0121] like Figure 3 As shown, the private cloud server receives an access request 301 sent by a user terminal, and obtains the destination identifier of the external network server and the source address 302 of the private cloud server from the access request. When the destination identifier is a destination domain name, the network address translation device is configured 303, including basic device configuration, destination domain name network segment configuration, destination domain name address translation relationship configuration, and domain name resolution server address translation relationship configuration, and the configured network address translation device is called to translate the destination domain name address to obtain the destination domain name translation address 304, and the domain name resolution server address is translated to obtain the domain name resolution server translation address 304, and the destination translation address 306 is obtained according to the destination domain name translation address and the domain name resolution server translation address; when the destination identifier is a protocol address, the network address translation device is configured 305, including basic device configuration, destination address network segment configuration, and protocol address translation relationship configuration, and the configured network address translation device is called to translate the protocol address to obtain the destination translation address 306. The private cloud server is configured for address translation 307 to obtain the source address translation relationship; the source address is translated according to the source address translation relationship to obtain the source translation address 308.

[0122] According to an embodiment of the present disclosure, the method for controlling a private cloud server further includes:

[0123] Acquire communication data of multiple routing paths, obtain communication load data corresponding to each of the multiple routing paths, the routing path being a communication path for a source conversion address to access a destination identifier; process the multiple communication load data according to a load balancing algorithm, and obtain a target routing path for a source conversion address to access a destination identifier.

[0124] According to an embodiment of the present disclosure, there may be multiple routing paths for accessing a destination identifier from a source conversion address, and communication of a data stream on each routing path will generate communication load data.

[0125] According to an embodiment of the present disclosure, multiple communication load data are processed according to a load balancing algorithm, and weights are redistributed according to the reload result for polling to obtain a target routing path for a source conversion address to access a destination identifier. The target routing path represents a routing path with the smallest overall load from the source conversion address to the destination identifier.

[0126] Figure 4 The following schematically shows an example of generating an access policy message according to an embodiment of the present disclosure.

[0127] like Figure 4 As shown, according to the source address 402, the destination conversion address 401, the preset destination service protocol 403, the private cloud server port 403, and the external network server port 403, a firewall policy for accessing the destination conversion address from the source address is configured to obtain a private cloud policy configuration result 406; according to the destination identifier 404, the source conversion address 405, the preset destination service protocol 403, the private cloud server port 403, and the external network server port 403, a firewall policy for accessing the destination identifier from the source conversion address is configured to obtain an external network policy configuration result 407; the application on the private cloud server generates an access policy message 408 according to the private cloud policy configuration result 406 and the external network policy configuration result 407, the source conversion address 405, and the destination conversion address 401. The access policy message is sent to the private cloud server, and the private cloud server determines the target routing path for the source conversion address to access the destination identifier according to the load balancing algorithm and then accesses the external network server.

[0128] Based on the above method for controlling a private cloud server, the present disclosure also provides a device for controlling a private cloud server. Figure 5 The device is described in detail.

[0129] Figure 5 The structural block diagram of the device for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown.

[0130] like Figure 5 As shown, the device 500 for controlling a private cloud server in this embodiment includes an acquisition module 510 , a conversion module 520 , a configuration module 530 , a generation module 540 and a sending module 550 .

[0131] The acquisition module 510 is used to acquire the destination identifier of the external network server and the source address of the private cloud server, wherein the destination identifier is used to access the external network server. In one embodiment, the acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0132] The conversion module 520 is used to convert the source address and the destination identifier to obtain a source conversion address and a destination conversion address. In one embodiment, the conversion module 520 can be used to perform the operation S220 described above, which will not be described in detail here.

[0133] The configuration module 530 is used to configure the firewall policy for the private cloud server and the external network server respectively based on the source address, the destination identifier, the source conversion address and the destination conversion address, and obtain the private cloud policy configuration result and the external network policy configuration result. In one embodiment, the configuration module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0134] The generation module 540 is used to generate an access policy message according to the private cloud policy configuration result and the external network policy configuration result, as well as the source translation address and the destination translation address. In one embodiment, the generation module 540 can be used to perform the operation S240 described above, which will not be described in detail here.

[0135] The sending module 550 is used to send an access policy message to the private cloud server, wherein the private cloud server accesses the external network server based on the access policy message. In one embodiment, the sending module 550 is used to perform the operation S250 described above, which will not be described in detail here.

[0136] According to an embodiment of the present disclosure, the conversion module 520 includes a first conversion submodule, a second conversion submodule, a third conversion submodule and a fourth conversion submodule.

[0137] The first conversion submodule is used to control the domain name resolution server to resolve the destination domain name to obtain the destination domain name address when the destination identifier is the destination domain name.

[0138] The second conversion submodule is used to call the configured network address translation device to convert the destination domain name address to obtain the destination domain name conversion address, wherein the network address translation device is deployed outside the private cloud area, and the configured network address translation device includes the configuration of the destination domain name segment, the destination domain name address conversion relationship and the domain name resolution server address conversion relationship.

[0139] The third conversion submodule is used to convert the domain name resolution server address according to the network address translation device to obtain the domain name resolution server conversion address, wherein the domain name resolution server address represents the address of the domain name resolution server in the external network area.

[0140] The fourth conversion submodule is used to obtain a destination conversion address according to the destination domain name conversion address and the domain name resolution server conversion address.

[0141] According to an embodiment of the present disclosure, the configuration module 530 includes a first configuration submodule and a second configuration submodule.

[0142] The first configuration submodule is used to configure the firewall policy for the private cloud server based on the source address, the destination conversion address and the preset destination service protocol to obtain the private cloud policy configuration result, wherein the private cloud server is used to access the destination conversion address from the source address based on the private cloud policy configuration result.

[0143] The second configuration submodule is used to configure the firewall policy for the external network server based on the destination identifier, the source conversion address and the preset destination service protocol, and obtain the external network policy configuration result, wherein the private cloud server is used to access the destination identifier from the source conversion address based on the external network policy configuration result.

[0144] According to an embodiment of the present disclosure, the first configuration submodule includes a first configuration unit, a second configuration unit and a third configuration unit.

[0145] The first configuration unit is used to configure the firewall policy for the private cloud server based on the source address, the destination domain name conversion address and the preset destination service protocol, and obtain a first private cloud policy configuration result, wherein the private cloud server is used to access the destination domain name conversion address from the source address based on the first private cloud policy configuration result.

[0146] The second configuration unit is used to configure the firewall policy for the private cloud server based on the source address, the domain name resolution server conversion address and the destination service protocol, and obtain a second private cloud policy configuration result, wherein the private cloud server is used to access the domain name resolution server conversion address from the source address based on the second private cloud policy configuration result.

[0147] The third configuration unit is used to determine the private cloud policy configuration result according to the first private cloud policy configuration result and the second private cloud policy configuration result.

[0148] According to an embodiment of the present disclosure, the second configuration submodule includes a fourth configuration unit, a fifth configuration unit and a sixth configuration unit.

[0149] The fourth configuration unit is used to configure the firewall policy for the external network server based on the destination domain name address, source conversion address, destination service protocol and port, and obtain the first external network policy configuration result, wherein the private cloud server is used to access the destination domain name address from the source conversion address based on the first external network policy configuration result.

[0150] The fifth configuration unit is used to configure the firewall policy for the external network server based on the domain name resolution server address, the source conversion address, the destination service protocol and the port, and obtain the second external network policy configuration result, wherein the private cloud server is used to access the domain name resolution server address from the source conversion address based on the second external network policy configuration result.

[0151] The sixth configuration unit is used to determine the external network policy configuration result according to the first external network policy configuration result and the second external network policy configuration result.

[0152] According to an embodiment of the present disclosure, the conversion module 520 further includes a fifth conversion submodule.

[0153] The fifth conversion submodule is used to call the configured network address translation device to convert the destination identifier to obtain the destination conversion address when the destination identifier is a protocol address, wherein the configured network address translation device includes the configuration of the destination address network segment and the protocol address conversion relationship.

[0154] According to an embodiment of the present disclosure, the conversion module 520 further includes a sixth conversion submodule and a seventh conversion submodule.

[0155] The sixth conversion submodule is used to perform address conversion configuration on the private cloud server to obtain a source address conversion relationship.

[0156] The seventh conversion submodule is used to convert the source address according to the source address conversion relationship to obtain a source conversion address.

[0157] According to an embodiment of the present disclosure, the device 500 for controlling a private cloud server further includes a load calculation submodule and a path determination submodule.

[0158] The load calculation submodule is used to obtain communication data of multiple routing paths and obtain communication load data corresponding to each of the multiple routing paths. The routing path is a communication path for accessing a destination identifier through a source conversion address.

[0159] The path determination submodule is used to process multiple communication load data according to the load balancing algorithm to obtain a target routing path for the source conversion address to access the destination identifier.

[0160] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 510, the conversion module 520, the configuration module 530, the generation module 540 and the sending module 550 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0161] According to an embodiment of the present disclosure, at least one of the acquisition 510, the conversion module 520, the configuration module 530, the generation module 540 and the sending module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the acquisition 510, the conversion module 520, the configuration module 530, the generation module 540 and the sending module 550 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0162] Figure 6 A block diagram of an electronic device suitable for implementing a method for controlling a private cloud server according to an embodiment of the present disclosure is schematically shown.

[0163] Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0164] like Figure 6 As shown, the computer electronic device 600 according to the embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 602 or the program loaded from the storage part 609 to the random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0165] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0166] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0167] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0168] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0169] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0170] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or the RAM 603 described above and / or one or more memories other than the ROM 602 and the RAM 603 .

[0171] An embodiment of the present disclosure also includes a program product, which includes a computer program, which contains program code for executing the method provided by the embodiment of the present disclosure. When the program product is run on an electronic device, the program code is used to enable the electronic device to implement the method for controlling a private cloud server provided by the embodiment of the present disclosure.

[0172] When the computer program is executed by the processor 601, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0173] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0174] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0175] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0176] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0177] The above specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present disclosure in detail. It should be understood that the above are only specific embodiments of the present disclosure and are not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A method for controlling a private cloud server, characterized in that: Applied to the intranet service area, the method includes: Obtaining a destination identifier of the external network server and a source address of the private cloud server, wherein the destination identifier is used to access the external network server; Converting the source address and the destination identifier to obtain a source conversion address and a destination conversion address; Based on the source address, the destination identifier, the source conversion address, and the destination conversion address, firewall policy configuration is performed on the private cloud server and the external network server respectively to obtain a private cloud policy configuration result and an external network policy configuration result; Generate an access policy message according to the private cloud policy configuration result and the external network policy configuration result, as well as the source translation address and the destination translation address; and The access policy message is sent to the private cloud server, wherein the private cloud server accesses the external network server based on the access policy message.

2. The method according to claim 1, characterized in that Converting the destination identifier to obtain a destination conversion address includes: In the case where the destination identifier is a destination domain name, controlling the domain name resolution server to resolve the destination domain name to obtain a destination domain name address; Calling a configured network address translation device to translate the destination domain name address to obtain a destination domain name translation address, wherein the network address translation device is deployed outside the private cloud area, and the configured network address translation device includes configurations of a destination domain name network segment, a destination domain name address translation relationship, and a domain name resolution server address translation relationship; The domain name resolution server address is converted according to the network address translation device to obtain a domain name resolution server conversion address, wherein the domain name resolution server address represents an address of a domain name resolution server in an external network area; The destination conversion address is obtained according to the destination domain name conversion address and the domain name resolution server conversion address.

3. The method according to claim 2, characterized in that Based on the source address, the destination identifier, the source conversion address, and the destination conversion address, firewall policy configuration is performed on the private cloud server and the external network server respectively to obtain a private cloud policy configuration result and an external network policy configuration result, including: Based on the source address, the destination conversion address and the preset destination service protocol, the private cloud server is configured with a firewall policy to obtain the private cloud policy configuration result, wherein the private cloud server is used to access the destination conversion address from the source address based on the private cloud policy configuration result; Based on the destination identifier, the source conversion address and the preset destination service protocol, the firewall policy is configured for the external network server to obtain the external network policy configuration result, wherein the private cloud server is used to access the destination identifier from the source conversion address based on the external network policy configuration result.

4. The method according to claim 3, characterized in that Based on the source address, the destination conversion address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain the private cloud policy configuration result, including: Based on the source address, the destination domain name translation address and the preset destination service protocol, a firewall policy is configured for the private cloud server to obtain a first private cloud policy configuration result, wherein the private cloud server is used to access the destination domain name translation address from the source address based on the first private cloud policy configuration result; Based on the source address, the domain name resolution server conversion address and the destination service protocol, a firewall policy is configured for the private cloud server to obtain a second private cloud policy configuration result, wherein the private cloud server is used to access the domain name resolution server conversion address from the source address based on the second private cloud policy configuration result; Determine the private cloud policy configuration result according to the first private cloud policy configuration result and the second private cloud policy configuration result.

5. The method according to claim 3, characterized in that: Based on the destination identifier, the source conversion address, the destination service protocol and the port, a firewall policy is configured for the external network server to obtain the external network policy configuration result, including: Based on the destination domain name address, the source translation address, the destination service protocol and the port, a firewall policy is configured for the external network server to obtain a first external network policy configuration result, wherein the private cloud server is used to access the destination domain name address from the source translation address based on the first external network policy configuration result; Based on the domain name resolution server address, the source translation address, the destination service protocol and the port, a firewall policy is configured for the external network server to obtain a second external network policy configuration result, wherein the private cloud server is used to access the domain name resolution server address from the source translation address based on the second external network policy configuration result; The external network policy configuration result is determined according to the first external network policy configuration result and the second external network policy configuration result.

6. The method according to claim 1, characterized in that Converting the destination identifier to obtain a destination conversion address also includes: In the case where the destination identifier is a protocol address, the configured network address translation device is called to translate the destination identifier to obtain the destination translation address, wherein the configured network address translation device includes the configuration of the destination address network segment and the protocol address translation relationship.

7. The method according to claim 1, characterized in that Converting the source address to obtain a source conversion address includes: Performing address translation configuration on the private cloud server to obtain a source address translation relationship; The source address is converted according to the source address conversion relationship to obtain a source conversion address.

8. The method according to claim 1, characterized in that The method further comprises: Acquire communication data of a plurality of routing paths, and obtain communication load data corresponding to each of the plurality of routing paths, wherein the routing path is a communication path for the source conversion address to access the destination identifier; The plurality of communication load data are processed according to a load balancing algorithm to obtain a target routing path for the source conversion address to access the destination identifier.

9. A device for controlling a private cloud server, characterized in that: The device comprises: An acquisition module, used to acquire a destination identifier of an external network server and a source address of a private cloud server, wherein the destination identifier is used to access the external network server; A conversion module, used for converting the source address and the destination identifier to obtain a source conversion address and a destination conversion address; A configuration module, configured to perform firewall policy configuration on the private cloud server and the external network server respectively based on the source address, the destination identifier, the source conversion address, and the destination conversion address, and obtain a private cloud policy configuration result and an external network policy configuration result; A generation module, configured to generate an access policy message according to the private cloud policy configuration result and the external network policy configuration result, as well as the source translation address and the destination translation address; and A sending module is used to send the access policy message to the private cloud server, wherein the private cloud server accesses the external network server based on the access policy message.

10. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images