Network access configuration method and device based on IPv6 address

Abstract

The invention discloses a network access configuration method and device based on an IPv6 address, and relates to the technical field of communication. The method is applied to a cloud management platform, the cloud management platform is used for managing an infrastructure, the infrastructure runs a first public cloud, the first public cloud comprises a first virtual private network VPC, a first network bound with an IPv6 address is arranged in the first VPC, and the method comprises the following steps: obtaining an access relationship and a sub-access relationship of the first network, and determining a target network according to the access relationship and the sub-access relationship of the first network, wherein the target network is a network allowed to access the first network. Therefore, under the condition that the source IP address does not belong to the target network, the first network cannot be accessed, so that the condition that the first network is maliciously accessed is avoided.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for configuring network access based on IPv6 addresses. Background Art

[0002] A virtual private cloud (VPC) is a private network created by users on a public cloud. VPCs are usually configured with an Internet Protocol version 4 (IPv4) private network address, which can only be routed within the VPC and cannot be used for access outside the VPC. In order to achieve access outside the VPC, public cloud vendors have invented many services that can enable VPC access to the public network and VPC mutual access. The addresses within the VPC cannot be announced to the public. The main reason is that different VPCs use the same private network segment. If the addresses are announced to the public, these addresses may conflict. Another reason is that VPCs must implement access control for traffic in and out of the VPC to prevent illegal access.

[0003] If the VPC uses Internet Protocol version 6 (IPv6) addresses, address conflicts can be avoided. However, IPv6 addresses are public addresses, which will increase the exposure of the VPC. Summary of the invention

[0004] The embodiments of the present application provide an access method and device, which can limit the publishing scope and access scope of services when VPC users use IPv6 addresses, thereby reducing the possibility of malicious access to the VPC.

[0005] In a first aspect, an embodiment of the present application provides a network access configuration method based on an IPv6 address, the method being applied to a cloud management platform, the cloud management platform being used to manage infrastructure, the infrastructure running a first public cloud, the first public cloud including a target virtual private network VPC, the target VPC being provided with a first network bound to an IPv6 address, the method comprising: providing a network configuration rule, the network configuration rule comprising a public network access relationship, a specific access relationship, and a private access relationship, wherein the public network access relationship is used to indicate that the scope of access to the first network is the public network, the specific access relationship is used to indicate that the scope of access to the first network is the first public cloud, and the private access relationship is used to indicate that the scope of access to the first network is the target VPC; obtaining an access relationship of the first network, the access relationship of the first network being one of the network configuration rules; obtaining a sub-access relationship of the first network, the sub-access relationship being used to indicate a sub-access range based on the access relationship of the first network; configuring the target VPC, determining a target network according to the access relationship of the first network and the sub-access relationship, the target network being a network that is allowed to access the first network.

[0006] In this network access configuration method, a cloud management platform is used to manage an infrastructure, on which a first public cloud runs, the first public cloud includes a target VPC, and the target VPC is provided with a first network bound to an IPv6 address. The cloud management platform provides a variety of network configuration rules, including: public network access relations, specific access relations, and private access relations. Among them, the public network access relation is used to indicate that the scope of access to the first network is the public network, which is equivalent to that any network in the public network is allowed to access the first network, and any network in the public network includes the network in the first public cloud and the network in the target VPC; the specific access relation is used to indicate that the scope of access to the first network is the first public cloud, which is equivalent to that any network in the first public cloud is allowed to access the first network; the private access relation is used to indicate that the scope of access to the first network is the target VPC, which is equivalent to that any network in the target VPC is allowed to access the first network.

[0007] Acquiring the access relationship of the first network can be understood as selecting an access relationship from the above network configuration rules based on the first indication information and determining it as the access relationship of the first network. The first indication information can be indication information received from the user by the cloud management platform through the human-computer interaction interface, and the first indication information can also be indication information received from other network devices.

[0008] Obtaining the sub-access relationship of the first network can be understood as a sub-access relationship determined based on the second indication information. The second indication information can be indication information received from the user by the cloud management platform through the human-computer interaction interface, and the second indication information can also be indication information received from other network devices. The sub-access relationship is used to indicate the sub-access scope based on the access relationship of the first network, which can be understood as the sub-access relationship is associated with the access relationship of the first network, and is used to limit or expand the access relationship of the first network.

[0009] The target network is determined according to the access relationship and sub-access relationship of the first network. The target network is a network that is allowed to access the first network, so that networks other than the target network are not allowed to access the first network, thereby limiting the scope of access to the first network, thereby avoiding malicious access to the first network.

[0010] Optionally, the target network may also be determined only according to the access relationship of the first network.

[0011] In a possible implementation of the first aspect, the access relationship of the first network is the public network access relationship; the sub-access range is to deny the second network access to the first network; and the target network is a network in the public network other than the second network.

[0012] In the implementation manner of the present application, when it is determined that the access relationship of the first network is a public network access relationship, the subnet access permission is determined to deny the second network access to the first network, so that networks other than the second network in the public network are allowed to access the first network. The access of the second network to the first network can be restricted, and the phenomenon of malicious access of the second network to the first network can be avoided, thereby reducing the possibility of malicious access to the first network.

[0013] Optionally, the target network may be determined based on the public network access relationship only, and the target network is the public network, which is equivalent to allowing any network in the public network to access the first network.

[0014] In another possible implementation of the first aspect, the access relationship of the first network is the specific access relationship; the sub-access range is to allow a third network to access the first network, and the third network is located in a second public cloud; and the target network includes the first public cloud and the third network.

[0015] In the implementation manner of the present application, when the access relationship of the first network is determined to be a specific access relationship, the subnet access permission is determined to allow the third network to access the first network, so that the target network allowed to access the first network includes the cloud network in the first public cloud and the third network. Correspondingly, networks other than the target network cannot access the first network, thereby limiting the access of networks other than the target network to the first network, thereby reducing the possibility of malicious access to the first network.

[0016] Optionally, the target network may be determined based on only the specific access relationship, and the target network is a network in the first public cloud, which is equivalent to allowing any network in the first public cloud to access the first network.

[0017] In another possible implementation of the first aspect, the access relationship of the first network is the specific access relationship; the sub-access range is that a fourth network is not allowed to access the first network, and the fourth network is located in the first public cloud; and the target network is a network in the first public cloud other than the fourth network.

[0018] In the implementation manner of the present application, when the access relationship of the first network is determined to be a specific access relationship, the subnet access right is determined to not allow the fourth network to access the first network, wherein the fourth network is a network in the first public cloud. The target network that is allowed to access the first network is a network other than the fourth network in the first public cloud. Alternatively, when the following conditions are met at the same time: 1. Belonging to the first public cloud, 2. Not belonging to the fourth network, it is called the target network. This method can restrict networks outside the first public cloud and the fourth network from accessing the first network, thereby reducing the possibility of malicious access to the first network.

[0019] In another possible implementation of the first aspect, the access relationship of the first network is the private access relationship; the sub-access scope is to allow a fifth network to access the first network, the fifth network is located in a second VPC, and the second VPC is located in the first public cloud; the target network includes the target VPC and the fifth network.

[0020] In the implementation manner of the present application, when the private relationship of the first network is determined to be a specific access relationship, the subnet access permission is determined to allow the fifth network to access the first network, so that the target networks allowed to access the first network include the cloud network in the first VPC and the fifth network. Correspondingly, networks other than the target network cannot access the first network, thereby limiting the access of networks other than the target network to the first network, thereby reducing the possibility of malicious access to the first network.

[0021] Optionally, the target network may be determined based on the private access-only relationship, and the target network is a network in the first VPC, which is equivalent to allowing the network in the first VPC to access the first network.

[0022] In another possible implementation of the first aspect, the access relationship of the first network is the private access relationship; the sub-access scope is to not allow the sixth network to access the first network, and the sixth network is located in the first VPC; and the target network is a network in the first VPC other than the sixth network.

[0023] In the implementation manner of the present application, when it is determined that the access relationship of the first network is a private access relationship, the subnet access right is determined to not allow the sixth network to access the first network, and the sixth network is a network in the first VPC. The target network that is allowed to access the first network is a network other than the sixth network in the first VPC. Alternatively, it is called a target network when it satisfies: 1. Belongs to the first VPC, 2. Does not belong to the sixth network. This method can restrict networks outside the first VPC and the sixth network from accessing the first network, thereby reducing the possibility of malicious access to the first network.

[0024] In yet another possible implementation manner of the first aspect, the public network access relationship is further used to indicate that the first network is allowed to access a network in the public network.

[0025] In the implementation manner of the present application, by allowing the first network to access the network in the public network, combined with allowing the network in the public network to access the first network in the above implementation manner, mutual access between the first network and the network in the public network can be achieved.

[0026] Optionally, when the public network access relationship is used to indicate that the first network is allowed to access a network in the public network, the sub-access range may also be that the first network is not allowed to access the second network.

[0027] In the implementation manner of the present application, by not allowing the first network to access the second network, the scope of the service sent by the first network can be limited.

[0028] In yet another possible implementation of the first aspect, the specific access relationship is further used to indicate that the first network is allowed to access a network in the first public cloud.

[0029] In the implementation manner of the present application, by allowing the first network to access the network in the first public cloud, combined with the above implementation manner allowing the network in the first public cloud to access the first network, mutual access between the first network and the network in the first public cloud can be achieved.

[0030] Optionally, in a case where the specific access relationship is used to indicate that the first network is allowed to access the network in the first public cloud, the sub-access scope may also be to allow the first network to access the third network.

[0031] In the implementation manner of the present application, when the first network is allowed to access the network in the first public cloud, by allowing the first network to access the third network, combined with allowing the third network to access the first network in the above implementation manner, mutual access between the first network and the third network can be achieved.

[0032] Optionally, in a case where the specific access relationship is used to indicate that the first network is allowed to access the network in the first public cloud, the sub-access range may also be that the first network is not allowed to access the fourth network.

[0033] In the implementation manner of the present application, when the first network is allowed to access the network in the first public cloud, by not allowing the first network to access the fourth network, the scope of the service sent by the first network in the first public cloud can be limited.

[0034] In yet another possible implementation of the first aspect, the private access relationship is further used to indicate that the first network is allowed to access a network in the first VPC.

[0035] In the implementation manner of the present application, by allowing the first network to access the network in the first VPC, combined with the above implementation manner allowing the network in the first VPC to access the first network, mutual access between the first network and the network in the first VPC can be achieved.

[0036] Optionally, when the private access relationship is used to indicate that the first network is allowed to access the network in the first VPC, the sub-access scope may also be to allow the first network to access the fifth network.

[0037] In the implementation manner of the present application, when the first network is allowed to access the network in the first VPC, by allowing the first network to access the fifth network, combined with allowing the fifth network to access the first network in the above implementation manner, mutual access between the first network and the fifth network can be achieved.

[0038] Optionally, when the private access relationship is used to indicate that the first network is allowed to access the network in the first VPC, the sub-access scope may also be that the first network is not allowed to access the sixth network.

[0039] In the implementation manner of the present application, when the first network is allowed to access the network in the first public cloud, by not allowing the first network to access the sixth network, the scope of the service sent by the first network in the above-mentioned first VPC can be limited.

[0040] In yet another possible implementation of the first aspect, the first network is allowed to access the target network.

[0041] In the implementation manner of the present application, by allowing the first network to access the target network, the first network and the target network can access each other.

[0042] In a second aspect, an embodiment of the present application further provides a configuration device, the device comprising a unit for executing any method according to the first aspect, the device comprising:

[0043] a processing unit, configured to provide a network configuration rule, wherein the network configuration rule includes a public network access relationship, a specific access relationship, and a private access relationship, wherein the public network access relationship is used to indicate that the scope of access to the first network is the public network, the specific access relationship is used to indicate that the scope of access to the first network is the first public cloud, and the private access relationship is used to indicate that the scope of access to the first network is the first VPC;

[0044] an acquiring unit, configured to acquire an access relationship of the first network, wherein the access relationship of the first network is one of the network configuration rules;

[0045] The acquiring unit is further used to acquire a sub-access relationship of the first network, where the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network;

[0046] The processing unit is further used to configure the first VPC, determine a target network according to the access relationship of the first network and the sub-access relationship, and the target network is a network that is allowed to access the first network.

[0047] Optionally, the target network may also be determined only according to the access relationship of the first network.

[0048] In another possible implementation, the access relationship of the first network is the public network access relationship; the sub-access range is to deny the second network access to the first network; and the target network is a network in the public network other than the second network.

[0049] Optionally, the target network may be determined based on the public network access relationship only, and the target network is the public network, which is equivalent to allowing any network in the public network to access the first network.

[0050] In another possible implementation, the access relationship of the first network is the specific access relationship; the sub-access range is to allow a third network to access the first network, and the third network is located in the second public cloud; and the target network includes the first public cloud and the third network.

[0051] Optionally, the target network may be determined based on only the specific access relationship, and the target network is a network in the first public cloud, which is equivalent to allowing any network in the first public cloud to access the first network.

[0052] In another possible implementation, the access relationship of the first network is the specific access relationship; the sub-access range is that the fourth network is not allowed to access the first network, and the fourth network is located in the first public cloud; and the target network is a network in the first public cloud other than the fourth network.

[0053] In another possible implementation, the access relationship of the first network is the private access relationship; the sub-access scope is to allow the fifth network to access the first network, the fifth network is located in the second VPC, and the second VPC is located in the first public cloud; the target network includes the target VPC and the fifth network.

[0054] Optionally, the target network may be determined based on the private access-only relationship, and the target network is a network in the first VPC, which is equivalent to allowing the network in the first VPC to access the first network.

[0055] In another possible implementation, the access relationship of the first network is the private access relationship; the sub-access scope is to not allow the sixth network to access the first network, and the sixth network is located in the first VPC; and the target network is a network in the first VPC other than the sixth network.

[0056] In yet another possible implementation manner, the public network access relationship is further used to indicate that the first network is allowed to access a network in the public network.

[0057] Optionally, when the public network access relationship is used to indicate that the first network is allowed to access a network in the public network, the sub-access range may also be that the first network is not allowed to access the second network.

[0058] In yet another possible implementation manner, the specific access relationship is further used to indicate that the first network is allowed to access a network in the first public cloud.

[0059] Optionally, in a case where the specific access relationship is used to indicate that the first network is allowed to access the network in the first public cloud, the sub-access scope may also be to allow the first network to access the third network.

[0060] Optionally, in a case where the specific access relationship is used to indicate that the first network is allowed to access the network in the first public cloud, the sub-access range may also be that the first network is not allowed to access the fourth network.

[0061] In yet another possible implementation, the private access relationship is further used to indicate that the first network is allowed to access a network in the first VPC.

[0062] Optionally, when the private access relationship is used to indicate that the first network is allowed to access the network in the first VPC, the sub-access scope may also be to allow the first network to access the fifth network.

[0063] Optionally, when the private access relationship is used to indicate that the first network is allowed to access the network in the first VPC, the sub-access scope may also be that the first network is not allowed to access the sixth network.

[0064] In yet another possible implementation, the first network is allowed to access the target network.

[0065] Regarding the beneficial effects brought about by the second aspect and any possible implementation manner, reference may be made to the description of the beneficial effects corresponding to the first aspect and the corresponding implementation manner, which will not be repeated here.

[0066] Optionally, in the configuration device described in the second aspect and any possible implementation manner:

[0067] In one implementation, the configuration device is a communication device. When the configuration device is a communication device, the communication unit may be a transceiver, or an input / output interface; the processing unit may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0068] In another implementation, the configuration device is a chip (system) or circuit used in a communication device. When the configuration device is a chip (system) or circuit used in a communication device, the communication unit may be a communication interface (input / output interface), interface circuit, output circuit, input circuit, pin or related circuit on the chip (system) or circuit; the processing unit may be at least one processor, processing circuit or logic circuit.

[0069] In a third aspect, an embodiment of the present application provides a configuration device, which includes a processor. The processor is coupled to a memory and can be used to execute instructions in the memory to implement the method of the first aspect and any possible implementation method described above. Optionally, the configuration device also includes a memory. Optionally, the configuration device also includes a communication interface, and the processor is coupled to the communication interface.

[0070] In a fourth aspect, an embodiment of the present application provides a configuration device, comprising: a logic circuit and a communication interface. The communication interface is used to receive information or send information; the logic circuit is used to receive information or send information through the communication interface, so that the configuration device executes the method of the first aspect and any possible implementation method.

[0071] In a fifth aspect, an embodiment of the present application provides a configuration system, including: the above-mentioned configuration device and a first VPC, the configuration device is, for example, the configuration device shown in the above-mentioned second to fourth aspects, the configuration device is used to configure the first VPC, the first VPC belongs to a first public cloud, and a first network bound to an IPv6 address is set in the first VPC;

[0072] The configuration device performs the method of the first aspect and any possible implementation manner, wherein the first VPC identifies a source address of a service packet accessing the first network, and allows the service packet to access the first network if the source address belongs to a target network;

[0073] The target network depends on the access relationship of the first network and the sub-access relationship, wherein the access relationship of the first network is one of the network configuration rules, and the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network;

[0074] The network configuration rules include a public network access relationship, a specific access relationship, and a private access relationship, wherein the public network access relationship is used to indicate that the scope of access to the first network is the public network, the specific access relationship is used to indicate that the scope of access to the first network is the first public cloud, and the private access relationship is used to indicate that the scope of access to the first network is the first VPC.

[0075] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program (also referred to as code, or instructions); when the computer program runs on a computer, the method of the above-mentioned first aspect and any possible implementation method is implemented.

[0076] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes: a computer program (also referred to as code, or instructions); when the computer program is executed, it enables the computer to execute the method of the above-mentioned first aspect and any possible implementation method.

[0077] In an eighth aspect, an embodiment of the present application provides a chip, the chip including a processor, the processor being used to execute instructions, when the processor executes the instructions, the chip executes the method of the first aspect and any possible implementation method. Optionally, the chip also includes a communication interface, the communication interface being used to receive or send signals.

[0078] In addition, in the process of executing the method described in the first aspect and any possible implementation method, the process of sending information and / or receiving information in the above method can be understood as the process of outputting information by the processor, and / or the process of receiving input information by the processor. When outputting information, the processor can output the information to the transceiver (or communication interface, or sending module) so that it can be transmitted by the transceiver. After the information is output by the processor, it may also need to be processed in other ways before it reaches the transceiver. Similarly, when the processor receives input information, the transceiver (or communication interface, or sending module) receives the information and inputs it into the processor. Furthermore, after the transceiver receives the information, the information may need to be processed in other ways before it is input into the processor.

[0079] Based on the above principle, for example, the sending information mentioned in the above method can be understood as the processor outputting information. For another example, the receiving information can be understood as the processor receiving input information.

[0080] Optionally, for the operations of transmitting, sending and receiving involved in the processor, if there is no special explanation, or if they do not conflict with their actual functions or internal logic in the relevant descriptions, they can be more generally understood as operations such as processor output, reception and input.

[0081] Optionally, in the process of executing the method described in the first aspect and any possible implementation method, the processor may be a processor specifically used to execute these methods, or a processor that executes these methods by executing computer instructions in a memory, such as a general-purpose processor. The memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or may be separately arranged on different chips. The embodiment of the present application does not limit the type of memory and the arrangement of the memory and the processor.

[0082] In a possible implementation manner, the at least one memory is located outside the device.

[0083] In yet another possible implementation, the at least one memory is located within the device.

[0084] In another possible implementation, part of the at least one memory is located inside the device, and another part of the memory is located outside the device.

[0085] In the embodiment of the present application, the processor and the memory may also be integrated into one device, that is, the processor and the memory may also be integrated together. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0087] Figure 1 A schematic diagram of the first VPC architecture provided for an implementation method of the present application;

[0088] Figure 2 A schematic diagram of a second VPC architecture provided for an implementation method of the present application;

[0089] Figure 3 A schematic diagram of a global unicast address structure provided for an implementation method of the present application;

[0090] Figure 4 A schematic diagram of an access range provided for an implementation manner of the present application;

[0091] Figure 5 A flowchart of a network access configuration method based on an IPv6 address provided in an embodiment of the present application;

[0092] Figure 6A-6H A schematic diagram of a configuration interface provided for an implementation method of this application;

[0093] Figure 7 A flowchart of an access method provided for an implementation method of the present application;

[0094] Figure 8 A schematic diagram of a third VPC architecture provided for an implementation method of the present application;

[0095] Fig. 9 A schematic diagram of the structure of a configuration device provided in an embodiment of the present application;

[0096] Fig.10 A schematic diagram of the structure of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0097] In order to make the objectives, technical solutions and advantages of the present application clearer, the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0098] The terms "first" and "second" in the specification, claims and drawings of this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0099] The "embodiment" mentioned in this article means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It can be explicitly and implicitly understood by those skilled in the art that in the various embodiments of the present application, if there is no special explanation and logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0100] It should be understood that in the present application, "at least one (item)" means one or more, "more than one" means two or more, "at least two (items)" means two or three and more than three, and "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0101] It should be noted that in this application, "indication" may include direct indication, indirect indication, explicit indication, and implicit indication. When describing that a certain indication information is used to indicate A, it can be understood that the indication information carries A, directly indicates A, or indirectly indicates A.

[0102] In the present application, the information indicated by the indication information is referred to as the information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association relationship between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, the indication of specific information can also be achieved by means of the arrangement order of each information agreed in advance (for example, specified by the protocol), thereby reducing the indication overhead to a certain extent. The information to be indicated can be sent together as a whole, or it can be divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The specific sending method is not limited in this application. Among them, the sending period and / or sending time of these sub-information can be pre-defined, for example, pre-defined according to the protocol, or can be configured by the transmitting end device by sending configuration information to the receiving end device.

[0103] It should be noted that in this application, "send" can be understood as "output", and "receive" can be understood as "input". "Send information to A", where "to A" only indicates the direction of information transmission, A is the destination, and does not limit "sending information to A" to direct transmission on the air interface. "Sending information to A" includes sending information directly to A, and also includes sending information to A indirectly through a transmitter, so "sending information to A" can also be understood as "outputting information to A". Similarly, "receiving information from A" means that the source of the information is A, including receiving information directly from A, and also including receiving information from A indirectly through a receiver, so "receiving information from A" can also be understood as "inputting information from A".

[0104] Before introducing the present application, some terms in the embodiments of the present application are briefly explained first to facilitate understanding by those skilled in the art.

[0105] (1) VPC: It can be called a virtual private cloud, a private network or a proprietary network. "Cloud" can include public cloud, private cloud or hybrid cloud. However, VPC does not belong to any of the three types of clouds. VPC is a resource collection that runs on a public cloud and isolates a part of the cloud resources for a certain user for private use. VPC can be managed by a public cloud and run on public resources, while ensuring that the resources of each user are isolated from each other. A public cloud can include multiple VPCs, and users will not be affected by each other when using VPC.

[0106] (2) Public network: Also known as the external network or the Internet, it is a collection of computer networks formed by connecting computer networks (including local area networks, metropolitan area networks, and wide area networks) in different locations and sizes around the world. The Internet outside the public cloud can also be called the public network. For example, if the first VPC is located in the first public cloud, then the Internet outside the first public cloud can be called the public network of the first VPC. In addition, the public network is also configured with an IPv6 address. For example, the IPv6 address can be "2001:db8:: / 32" or "1080::8:800:200C:417A".

[0107] (3) Network: A network can be a subnet or a network segment. A network can also refer to a public network, a private network, a public cloud, or a VPC. In some scenarios, a network can also refer to a network device in the network.

[0108] (4) Access relationship: used to indicate the access rights between two networks, including public network access relationship, specific access relationship and private access relationship, etc. Among them, the public network access relationship can be the access rights between the first network and the public network, for example, the scope of access to the first network is the public network, and / or, the scope that the first network can access is the network in the public network. The specific access relationship can be the access rights between the first network and the first public cloud, for example, the scope of access to the first network is the first public cloud, and / or, the scope that the first network can access is the network in the first public cloud. The private access relationship can be the access rights between the first network and the first private cloud, for example, the scope of access to the first network is the first VPC, and / or, the scope that the first network can access is the network in the first VPC. In the above, the first network is a subnet in the first VPC, and the first VPC is located in the above-mentioned first public cloud.

[0109] (5) Access scope: This may refer to networks that are allowed to access network A and / or networks that are allowed to be accessed by network A. Network A may be any of the following: target IP address, subnet, VPC, public cloud, or public network. Networks that are allowed to access network A and / or networks that are allowed to be accessed by network A may also be any of the following: target IP address, subnet, VPC, public cloud, or public network.

[0110] (6) Public network access: may mean that the first network located on the first VPC can be accessed by a network in the public network, and / or the first network is allowed to access a network in the public network.

[0111] (7) Private network access: may mean that a first network located on a first VPC can be accessed by a network in a first public cloud, and / or the first network is allowed to access a network in the first public cloud, wherein the first VPC is located in the first public cloud.

[0112] (8) Restricted access: may mean that the first network located on the first VPC is not accessible by a certain network, and / or the first network is not allowed to access a certain network.

[0113] The above description of technical terms may be optionally used in the following embodiments.

[0114] The present application provides an access method, which is applied to the field of communication technology, such as VPC communication. In order to more clearly describe the method of the present application, some VPC-related knowledge is first introduced below.

[0115] In a VPC, devices inside the VPC can use either IPv4 private addresses or IPv6 public addresses.

[0116] See also Figure 1 , Figure 1 The first VPC architecture diagram provided for the implementation of the present application is used to show a possible architecture of the VPC when the devices inside the VPC use IPv4 private network addresses. Figure 1 As shown, Figure 1 Including the Internet, gateway, elastic public IP (elastic IP, EIP), network address translation (network address translation, NAT) gateway, VPC1, VPC2, virtual private network (virtual private network, VPN), internet data center (internet data center, IDC) and cloud dedicated line (direct connect, DC), etc.

[0117] Among them, the VPC is composed of at least one router and one subnet. For example, VPC1 is composed of a router, subnet 1 and subnet 2. For another example, VPC2 is composed of a router, subnet 3 and subnet 4. The subnet may include one or more different servers, databases, etc., which is not limited in the implementation mode of the present application.

[0118] The combination of servers and / or databases included in the subnet may include one or more of the following:

[0119] Form 1: The subnet includes elastic cloud servers (ECS).

[0120] Form 2: The subnet includes ECS and relational database service (RDS).

[0121] Form 3: The subnet includes ECS and bare metal servers (BMS).

[0122] Form 4: The subnet includes a cloud container engine (CCE).

[0123] The following is Figure 1 The possible communication modes of the VPC shown are introduced by way of example.

[0124] Method 1: Peer access between VPCs.

[0125] VPC peer access can refer to data access between two VPCs located on the same cloud server, for example, Figure 1 The VPC1 and VPC2 shown in the figure are located in the same cloud server. When VPC1 and VPC2 achieve peer access, VPC1 can access VPC2 and VPC1 can also receive access from VPC2. Similarly, VPC2 can access VPC1 and VPC2 can also receive access from VPC1.

[0126] Exemplarily, peer access to VPC can be achieved through VPC peering (VPC peering), cloud connect (CC), or elastic network interface (ENI).

[0127] Exemplarily, one-way access to VPC can also be achieved through a VPC endpoint (VPC EP). For example, one-way access from VPC1 to VPC2 can be achieved through VPC EP, or one-way access from VPC2 to VPC1 can be achieved through VPC EP.

[0128] Method 2: Mutual access between VPC and the public network.

[0129] As we can see from the previous introduction, Figure 1 The VPC shown uses an IPv4 private network address and cannot directly access the public network, and devices on the public network cannot directly access the VPC.

[0130] In a possible implementation, direct access between the VPC and the public network can be achieved through some configurations.

[0131] For example, the intercommunication between VPC and the public network can be achieved by binding the vendor manager (VM) in the VPC to the EIP. For example, the VPC can access the public network through the EIP, and the public network can also access the VPC through the EIP. Figure 1As shown in the figure, the VM in subnet 1 can be bound to the EIP and then connected to the Internet (equivalent to the public network) through the gateway, thereby achieving interoperability between the VPC and the public network.

[0132] For example, the intercommunication between VPC and the public network can also be achieved through a NAT gateway, where the NAT gateway is bound to an EIP. For example, a VPC can access the public network through a NAT gateway, and the public network can also access a VPC through a NAT gateway. Figure 1 As shown, subnet 4 is first connected to the NAT gateway, which is bound to an EIP, and then connected to the Internet through the gateway, thereby achieving interoperability between the VPC and the public network.

[0133] Method 3: Mutual access between VPC and IDC

[0134] For example, mutual access between VPC and IDC can be achieved through VPN, CC, DC or enterprise switch. Figure 1 For example, VPC1 can establish a connection with IDC through VPN and access each other. For another example, VPC2 can establish a connection with IDC through DC and access each other.

[0135] It can be seen from the three VPC connection methods provided above that the connection between VPC and other VPCs, the public network or IDC requires a lot of settings to achieve network connection. For example, it is necessary to add NAT gateways, bind EIPs, etc., which not only increases the complexity of the connection, but also may increase the cost of communication.

[0136] In view of this, the implementation method of the present application provides an access method that can simplify the connection process between VPC and other VPCs, the public network or IDC, so that VPC can directly establish a communication connection with other VPCs, the public network or IDC, and can realize private network access, public network access and restricted access of VPC.

[0137] See also Figure 2 , Figure 2 The second VPC architecture diagram provided for the implementation of the present application is used to show a possible architecture of a VPC when the devices inside the VPC use IPv6 global unicast addresses (GUA). Figure 2 As shown, Figure 2 Including the Internet, gateway, VPC1, VPC2 and IDC, etc.

[0138] Among them, VPC consists of at least one router and one subnet. For example, VPC1 consists of a router, an ACL gateway, subnet 1, and subnet 2. For another example, VPC2 consists of a router, an ACL gateway, subnet 3, and subnet 4. Subnets can include one or more different servers, databases, etc. For details, please refer to Figure 1 The corresponding description in will not be repeated here.

[0139] The above-mentioned GUA is a globally unique and globally routable address, which is equivalent to saying that in the global network, any IPv6 address is a unique address and can be directly used for communication in the global network.

[0140] See also Figure 3 , Figure 3 A schematic diagram of a global unicast address structure provided for an implementation manner of the present application is used to introduce the structure of a GUA in an IPv6 address. Figure 3 The GUA structure shown includes a global routing prefix, a subnet identifier, and an interface identifier, where:

[0141] The global routing prefix is ​​a portion of the prefix assigned by the Internet Assigned Numbers Authority (IANA) to a service provider, and the service provider then assigns a subspace to its users. The length of the global routing prefix can be n bits, for example, n is 48. According to the recommendation of RFC 3177, the length of the global routing prefix can be less than or equal to 48 bits.

[0142] The above subnet identifier is a prefix that an organization receives from its service provider, where the global routing prefix identifies the service provider and the organization within the service provider, and the subnet identifier identifies the organizational structure of its network. The length of the subnet identifier can be 64-n bits. For example, when n is 48, the length of the subnet identifier can be 16 bits.

[0143] The above interface identifier may be used to indicate an interface of a node on a link, and the length of the interface identifier may be 64 bits.

[0144] Next, see Figure 2 ,from Figure 2 As can be seen, each subnet is connected to an ACL gateway, which is used to control the inflow and outflow of subnet traffic, thereby achieving private network access, public network access, and restricted access of the VPC.

[0145] For example, taking subnet 1 in VPC1 as an example, the VPC access process with an ACL gateway added is described in an exemplary manner. Figure 2As can be seen, the ACL gateway connected to subnet 1 is also connected to the public network and IDC. It is understandable that when subnet 1 publishes information to the outside, it also needs to pass through the ACL gateway connected to subnet 1. When other VPCs in the public cloud (such as VPC2) access subnet 1 in VPC1, they also need to pass through the ACL gateway connected to subnet 1.

[0146] See also Figure 4 , Figure 4 A schematic diagram of an access scope provided for an implementation of the present application is used to show the range of network devices that may access the VPC. Figure 4 As can be seen, the network devices that access VPC can be divided into three layers, namely, network devices inside VPC, network devices in the same public cloud, and network devices on the Internet. In addition, you can also select network devices with specific IP addresses to access network devices in VPC. For a detailed introduction, please refer to the subsequent description, which will not be described in detail here.

[0147] Since the network devices in the VPC use the GUA address of IPv6, they can be directly used for global network communication. This means that without adding an ACL gateway, network devices in the Internet or in the public cloud can directly access network devices in the VPC, increasing the exposure of the VPC and the risk of malicious access to the VPC.

[0148] In view of this, the implementation method of the present application provides a network access configuration method based on IPv6 address, which can realize private network access, public network access and restricted access of VPC when the network devices in VPC use IPv6 GUA address, reduce the exposure area of ​​​​VPC, and reduce the risk of malicious access to VPC.

[0149] See also Figure 5 , Figure 5 A flow chart of a network access configuration method based on an IPv6 address provided for an implementation mode of the present application is used to demonstrate how to implement private network access, public network access, and restricted access of a VPC when the first network in the first VPC is configured with an IPv6 GUA address.

[0150] Figure 5 The access method shown is applied to a cloud management platform, which is used to manage an infrastructure, on which a first public cloud runs, the first public cloud includes a first VPC, and a first network bound to an IPv6 address is set in the first VPC. Figure 2For example, the first public cloud is the public cloud where VPC1 is located, the first VPC is VPC1, the first network is subnet 1 or subnet 2, and the IPv6 address bound to the first network is "2001:db8:: / 32" or "1080::8:800:200C:417A". The embodiment of the present application does not limit the GUA address bound to the IPv6 of the first network.

[0151] Figure 5 The flowchart of the network access configuration method shown includes but is not limited to the following steps:

[0152] Step S501: Acquire access relations of a first network.

[0153] In a possible implementation, the access relationship of the first network is obtained through a human-computer interaction interface of a cloud management platform.

[0154] Exemplarily, the user sends instruction information to the cloud management platform through the human-computer interaction interface of the cloud management platform, indicating the access relationship of the first network, and the cloud management platform determines the access relationship of the first network based on the instruction information. Figure 6H The configuration interface diagram is shown.

[0155] like Figure 6A-6H As shown, Figure 6A-6H It includes VPC selection controls, subnet selection controls, access relationship selection controls, and sub-access relationship editing controls. It should be noted that Figure 6A-6H The content with dotted or solid borders is a control. Fig. 6A For example, the displayed contents are "First VPC", "Subnet-1", "Public Network Access Relationship", and please edit "Sub-access Relationship". The corresponding controls are, in order, the VPC selection control, the subnet selection control, the access relationship selection control, and the sub-access relationship editing control.

[0156] Optional, Figure 6A-6H The name of the save control, edit control, and public cloud are also included. Fig. 6A For example, the corresponding controls for the display contents "Save" and "Edit" are the Save control and the Edit control respectively. Fig. 6A The name of the public cloud shown in is the first public cloud.

[0157] In one possible implementation, Fig. 6AThe content displayed by each control in the default state. For example, the content displayed by the VPC selection control is "First VPC", the content displayed by the subnet selection control is "Subnet-1", the content displayed by the access relationship selection control is "Public network access relationship", and the content displayed by the sub-access relationship editing control is "Please edit the subnet access relationship". It should be understood that each control can also display other content in the default state, for example, the content displayed by the VPC selection control is "Second VPC" or the content displayed by the access relationship selection control is "Private access relationship", etc., and this embodiment of the application does not limit this.

[0158] Exemplarily, by clicking the drop-down button in the VPC selection control (a black inverted triangle symbol shown in the VPC selection control), the human-computer interaction interface displays at least one VPC that can be selected.

[0159] like Figure 6B As shown, Figure 6B It is the content displayed on the human-computer interaction interface when the user clicks the black inverted triangle symbol in the VPC selection control. Figure 6B As shown, the VPC selection control displays multiple selectable VPCs, including: a first VPC, a second VPC, and a third VPC. It should be noted that the VPC selection control can display more or fewer selectable VPCs, and this embodiment of the application does not limit this.

[0160] Specifically, users can click Figure 6B Select any VPC displayed in the VPC selection control to determine the VPC that the user needs to configure. For example, if the user clicks Figure 6B The second VPC shown in the figure, the content displayed on the human-computer interaction interface is as follows Figure 6C As shown, Figure 6C The content displayed in the VPC selection control is "Second VPC", indicating that the VPC that the user needs to configure is "Second VPC".

[0161] Exemplarily, by clicking the drop-down button in the subnet selection control (a black inverted triangle symbol shown in the subnet selection control), the human-computer interaction interface displays at least one subnet that can be selected.

[0162] like Fig.6D As shown, Fig.6D It is the content displayed on the human-computer interaction interface when the user clicks the black inverted triangle symbol in the VPC selection control. Fig.6D As shown, the subnet selection control displays a variety of subnets that can be selected, including: subnet-1, subnet 2 and subnet-3. It should be noted that the subnet selection control can display more or fewer subnets that can be selected, and the embodiment of the present application does not limit this.

[0163] Specifically, users can click Fig.6D Select any subnet displayed in the subnet selection control to determine the subnet that the user needs to configure. For example, when the user clicks Fig.6D The content displayed on the human-computer interaction interface is as follows: Fig. 6E As shown, Fig. 6E The content displayed in the subnet selection control is "Subnet-2", indicating that the subnet that the user needs to configure is "Subnet-2".

[0164] Exemplarily, by clicking the drop-down button in the access relationship selection control (the black inverted triangle symbol shown in the access relationship selection control), the human-computer interaction interface displays at least one access relationship that can be selected.

[0165] like Fig. 6F As shown, Fig. 6F It is the content displayed on the human-computer interaction interface when the user clicks the black inverted triangle symbol in the access relationship selection control. Fig. 6F As shown, the access relationship selection control displays a variety of selectable access relationships, including: public network access relationships, specific access relationships, and private access relationships. It should be noted that the access relationship selection control can display more or fewer selectable access relationships, and the present application embodiment does not limit this.

[0166] Specifically, users can click Fig. 6F Select any access relationship displayed in the access relationship control to determine the access relationship that the user needs to set. For example, when the user clicks Fig. 6F The private access relationship shown in the human-computer interaction interface is as follows Figure 6G As shown, Figure 6G The content displayed in the access relationship selection control is "Private access relationship". Figure 6G The content displayed in the subnet selection control is "Subnet-1". Figure 6G The configuration shown in can be understood as that the first network is subnet-1 in the first VPC, and the access relationship is "private access relationship".

[0167] Optionally, after confirming the selections of the above VPC selection control, subnet selection control, and access relationship selection control, the user can click the save space to save the current selection. After the cloud management platform receives the instruction information corresponding to the user clicking the save control, it saves the configuration displayed in the user interface and refuses the user to edit the saved configuration.

[0168] Optionally, if the user needs to re-edit the saved configuration, he can click the edit control. After the cloud management platform receives the instruction information corresponding to the user clicking the edit control, it will reopen the user's editing permission, allowing the user to perform the above-mentioned Figure 6A-6G The operation shown.

[0169] Optionally, the user can edit the content in the "sub-access relationship editing control", and accordingly, the cloud management platform can obtain the content in the "sub-access relationship editing control" to determine the sub-access relationship of the first network. For the introduction of the "sub-access relationship editing control", please refer to the introduction of step S502 below, which will not be introduced here.

[0170] Step S502: Acquire the sub-access relationship of the first network.

[0171] For the implementation process of obtaining the sub-access relationship of the first network, reference may be made to the description of obtaining the access relationship of the first network in the above step S501.

[0172] For example, Fig. 6A For example, the user can set the sub-access relationship by editing the "sub-access relationship editing control". The cloud management platform can obtain the content edited by the user in the "sub-access relationship editing control" and determine the sub-access relationship of the first network based on the obtained content.

[0173] In a possible implementation, the content edited in the "Edit control of sub-access relationship" includes the sub-access type and the sub-network, and the cloud management platform can determine the sub-access scope based on the sub-access type and the sub-network. The sub-access type may be, for example, friend and unfriend. When the sub-access type is friend, it is used to indicate that the sub-network can access the first network, and / or that the first network can access the sub-network. When the sub-access type is unfriend, it is used to indicate that the sub-network cannot access the first network, and / or that the first network cannot access the sub-network. The above-mentioned sub-network may be any network configured with an IPv6 address.

[0174] like Figure 6H As shown, the content edited by the user in the "Edit control of sub-access relationship" is "unfriend: second network", where the sub-access type is unfriendly and the corresponding network is the second network. Based on the sub-access type and the corresponding network, the cloud management platform determines the sub-access scope as follows: the second network is not allowed to access the first network, and / or the first network is not allowed to access the second network.

[0175] Optionally, the above sub-network may be selected within a target range, and the target range depends on the access relationship shown in step S501.

[0176] Exemplarily, when the access relationship is "public network access relationship", the target range is any network in the public network.

[0177] Exemplarily, when the access relationship is "specific access relationship", the target scope is any network in other public clouds.

[0178] Exemplarily, when the access relationship is a "private access relationship", the target scope is any network in the first public cloud that is different from the first network.

[0179] Optionally, in some scenarios, the sub-access relationship may not be obtained, or the user does not edit the sub-access relationship, or there is no sub-access relationship, such as Fig. 6A As shown, the content displayed in the "Sub-access Relation Edit Control" by default is "Please edit the sub-access relationship". Accordingly, the first VPC (or the gateway bound to the first network) is configured only according to the access relationship of the first network, that is, the target network is determined based on the access relationship of the first network.

[0180] In a possible implementation manner, a target network is determined according to the access relationship and the sub-access relationship of the first network, and the target network is a network that is allowed to access the first network.

[0181] In this implementation, the public network access relationship may be a scope of access to the first network, the specific access relationship may be a scope of access to the first network, the first public cloud, and the private access relationship may be a scope of access to the first network, the first VPC.

[0182] In the case where the access relationship of the first network is a public network access relationship, the sub-access relationship may be that the second network is not allowed to access the first network. In this case, the target network is a network in the public network except the second network.

[0183] Optionally, when the access relationship of the first network is a public network access relationship, the sub-access relationship may not be configured. In this case, the target network is a public network.

[0184] In the case where the access relationship of the first network is a specific access relationship, the sub-access relationship may be to allow the third network to access the first network, in which case the target network includes the first public cloud and the third network. Optionally, the third network is a network in the second public cloud, which is different from the first public cloud.

[0185] In the case where the access relationship of the first network is a specific access relationship, the sub-access relationship may also be that the fourth network is not allowed to access the first network. In this case, the target network is a network other than the fourth network in the first public cloud. Optionally, the fourth network is a network in the first public cloud. It should be noted that the target network is a network other than the fourth network in the first public cloud, which means that the target network does not include networks other than the first public cloud and does not include the fourth network.

[0186] Optionally, when the access relationship of the first network is a specific access relationship, the sub-access relationship may not be configured. In this case, the target network is the first public cloud.

[0187] In the case where the access relationship of the first network is a private access relationship, the sub-access relationship may be to allow the fifth network to access the first network, in which case the target network includes the first VPC and the fifth network. Optionally, the fifth network is a network in the first public cloud.

[0188] In the case where the access relationship of the first network is a private access relationship, the sub-access relationship may also be that the sixth network is not allowed to access the first network. In this case, the target network is a network in the first VPC other than the sixth network. Optionally, the sixth network is a network in the first VPC. It should be noted that the target network is a network in the first VPC other than the sixth network, which means that the target network does not include networks outside the first VPC and does not include the sixth network.

[0189] Optionally, when the access relationship of the first network is a private access relationship, the sub-access relationship may not be configured. In this case, the target network is the first VPC.

[0190] In another possible implementation, the target network is determined according to the access relationship and the sub-access relationship of the first network, and the target network is a network that is allowed to be accessed by the first network.

[0191] In this implementation, the public network access relationship may be that the scope of the first network access is the public network, the specific access relationship may be that the scope of the first network access is the first public cloud, and the private access relationship may be that the scope of the first network access is the first VPC.

[0192] In the case where the access relationship of the first network is a public network access relationship, the sub-access relationship may be that the first network is not allowed to access the second network. In this case, the target network is a network in the public network other than the second network.

[0193] Optionally, when the access relationship of the first network is a public network access relationship, the sub-access relationship may not be configured. In this case, the target network is a public network.

[0194] In the case where the access relationship of the first network is a specific access relationship, the sub-access relationship may be to allow the first network to access the third network, in which case the target network includes the first public cloud and the third network. Optionally, the third network is a network in the second public cloud, which is different from the first public cloud.

[0195] In the case where the access relationship of the first network is a specific access relationship, the sub-access relationship may also be that the first network is not allowed to access the fourth network. In this case, the target network is a network other than the fourth network in the first public cloud. Optionally, the fourth network is a network in the first public cloud. It should be noted that the target network is a network other than the fourth network in the first public cloud, which means that the target network does not include networks other than the first public cloud and does not include the fourth network.

[0196] Optionally, when the access relationship of the first network is a specific access relationship, the sub-access relationship may not be configured. In this case, the target network is the first public cloud.

[0197] In the case where the access relationship of the first network is a private access relationship, the sub-access relationship may be to allow the first network to access the fifth network, in which case the target network includes the first VPC and the fifth network. Optionally, the fifth network is a network in the first public cloud.

[0198] In the case where the access relationship of the first network is a private access relationship, the sub-access relationship may also be that the first network is not allowed to access the sixth network. In this case, the target network is a network in the first VPC other than the sixth network. Optionally, the sixth network is a network in the first VPC. It should be noted that the target network is a network in the first VPC other than the sixth network, which means that the target network does not include networks outside the first VPC and does not include the sixth network.

[0199] Optionally, when the access relationship of the first network is a private access relationship, the sub-access relationship may not be configured. In this case, the target network is the first VPC.

[0200] In a possible implementation, a first gateway is configured, where the first gateway is used to control the first subnet.

[0201] In combination with the above 2, the first subnet may be subnet 1, and the first gateway may be an ACL gateway connected to subnet 1. Optionally, the first gateway may be a device (instance) with data forwarding capability, and the management of data inflow / outflow of the first network may be implemented by configuring the first gateway, and the functions of public network access, private network access or restricted access of the first network may be implemented. For example, the first gateway may also be a switch or a virtual switch.

[0202] Exemplarily, based on the access relationship and sub-access relationship of the first network obtained in step S501 and step S502, the first gateway is configured so that when the source IP address of the device accessing the first network belongs to the target network, access to the first network is allowed, or when the target IP address belongs to the target network, the first network is allowed to access the device configured with the target IP address.

[0203] Exemplarily, when the access relationship is "public network access relationship", the first network can be accessed by the network in the public network, or the first network can access the network in the public network, which is equivalent to realizing the public network access function when the access relationship is "public network access relationship".

[0204] For example, when the access relationship is "specific access relationship", the first network can be accessed by the network in the first public cloud, or the first network can access the network in the first public cloud, which is equivalent to realizing the function of private network access when the access relationship is "specific access relationship". Similarly, when the access relationship is "private access relationship", the first network can be accessed by the network in the first VPC, or the first network can access the network in the first VPC, which is equivalent to realizing the function of private network access when the access relationship is "private access relationship".

[0205] Exemplarily, a sub-access relationship is configured on the basis of configuring the access relationship of the first network, and the access type of the sub-access relationship can be used to determine whether to add or reduce the access / access scope of the first network. For example, when the access type is friend, the sub-network in the sub-access relationship can be accessed by the first network, or the first network can be accessed by the sub-network in the sub-access relationship. For another example, when the access type is unfriend, the sub-network in the sub-access relationship cannot be accessed by the first network, or the first network cannot be accessed by the sub-network in the sub-access relationship. This is equivalent to realizing the function of restricted access when the sub-access relationship is configured.

[0206] Since the first network is configured with an IPv6 GUA address, the first network can directly establish a communication connection with other networks. In the implementation mode of the present application, by configuring the gateway of the first network, public network access, private network access, and restricted access of the first network can be achieved on the premise that the first network is configured with an IPv6 GUA address. On the one hand, malicious access can be avoided, and on the other hand, the scope of the service sent by the first network can be limited.

[0207] In a possible implementation, the target network determined according to the access relationship and sub-access relationship of the first network includes the seventh network. The target network determined according to the access relationship and sub-access relationship of the seventh network also includes the first network, and mutual access between the first network and the seventh network can be achieved. Among them, the process of determining the target network of the seventh network can refer to the implementation process of determining the target network of the first network, which will not be repeated here.

[0208] For example, the above Figure 2For example, when the target network of VPC1 includes VPC2, and the target network of VPC2 includes VPC1, mutual access between VPC1 and VPC2 can be achieved.

[0209] In another possible implementation manner, when the target network is a network that allows the first network to access and a network that allows access to the first network, the first network and the target network are mutually accessible networks.

[0210] See also Figure 7 , Figure 7 A flowchart of an access method provided for an implementation of the present application is used to demonstrate how to implement private network access, public network access, and restricted access to a VPC when network devices in the VPC use IPv6 GUA addresses. Figure 7 The access method flow diagram shown includes but is not limited to the following steps:

[0211] S701: A network device receives a first message.

[0212] The above network device may be, for example, Figure 2 The ACL gateway shown in, for example, the ACL gateway connected to subnet 1 in VPC1, the ACL gateway connected to subnet 2 in VPC1, the ACL gateway connected to subnet 3 in VPC2, or the ACL gateway connected to subnet 4 in VPC2. For ease of description, the access method provided in the implementation manner of the present application can be exemplarily introduced by taking the ACL gateway connected to subnet 1 as an example.

[0213] The first message may come from a device in the public network, a device in the public cloud, or a device in another subnet in the same VPC.

[0214] Exemplarily, the first message may come from the Internet. For example, the first message may come from Figure 2 The Internet or Figure 2 The IDC shown in the above first message can also come from Figure 7 The Internet shown in .

[0215] Exemplarily, the first message may come from Figure 2 In the VPC2 shown in FIG. 1 , for example, the first message may come from subnet 3 or subnet 4 in VPC2.

[0216] Exemplarily, the first message may come from other subnets in VPC1. For example, the first message may come from subnet 1 in VPC1.

[0217] It is understood that a public cloud may include more or fewer VPCs. For example, in addition to VPC1 and VPC2, a public cloud may also include VPC3, VPC4, VPC5, etc. A VPC may also include more or fewer subnets. For example, Figure 2 The VPC1 shown in the figure may include only subnet 1 or subnet 2. VPC1 may also include subnet 5, subnet 6, subnet 7, etc.

[0218] S702: The network device determines whether the first message complies with the access rule.

[0219] For the introduction of the network device and the first message, please refer to the corresponding description in step S701, which will not be repeated here.

[0220] The access rule is used to identify the range of the IP address of the sending end network device. For example, when the source IP address in the first message belongs to the IP address of the access rule, the first message can be processed.

[0221] The present application exemplarily provides an access rule, as shown in Table 1. As can be seen from Table 1, the access rule may include an access relationship, an access relationship description, an execution action, and the like.

[0222] Among them, "Access Relationship" is used to represent the access relationship of subnet 1, which is equivalent to the access status that subnet 1 can accept. For example, when the access relationship is "Public", subnet 1 can accept access from any network device. For example, when the access relationship is "Protected", subnet 1 can accept access from network devices in the same public cloud. For another example, when the access relationship is "Private", subnet 1 can only accept access from network devices in the same subnet (for example, subnet 1).

[0223] It should be noted that "access relationship" is used to represent the access relationship of subnet 1 for exemplary purposes only, or is not limited to the term "access relationship" to represent the access relationship of subnet 1. For example, "access relationship" can be replaced by "option" or "rule", and "public" in "access relationship" can be "option one" or "rule one", "protection" in "access relationship" can be "option two" or "rule two", and "non-public" in "access relationship" can be "option three" or "rule three". The implementation method of this application does not limit which specific method is adopted. It can be understood that "access relationship" can also include more or fewer options. For example, "access relationship" can include "partial disclosure" in addition to "public", "protection" and "non-public". Equivalently, it can also include more or fewer "options", "rules", etc.

[0224] The "Description of Access Relationship" is used to describe the above-mentioned "Access Relationship", or the "Description of Access Relationship" is used to describe the risk level of access, etc., which is not limited in the implementation mode of the present application. For example, when the "Access Relationship" is "Public", the "Description of Access Relationship" can be "Risk Exists". When the "Access Relationship" is "Protection", the "Description of Access Relationship" can be "Friendly". When the "Access Relationship" is "Non-Public", the "Description of Access Relationship" can be "No Risk".

[0225] It is understandable that the implementation method of the present application does not limit the "description of access relationship". The "description of access relationship" can be used to help users better understand the "access relationship" and facilitate users to select appropriate "access relationship" to apply to subnet 1. Therefore, in the specific implementation process, other nouns can be used to represent the "description of access relationship". For example, nouns such as "rule introduction" and "option explanation" can be used to represent that this part is used to introduce the "access relationship". In addition, since the "description of access relationship" is used to help users understand the "access relationship", in some scenarios, the "description of access relationship" can be omitted.

[0226] "Execution action" may refer to the action performed by the VCL gateway on the message. The "execution action" is associated with the "access relationship". For example, when the "access relationship" is "public", the action performed by the VCL gateway may be to allow network devices with any IP address to access subnet 1. For another example, when the "access relationship" is "protection", the action performed by the VCL gateway may be to allow network devices in the public cloud to access subnet 1, allow network devices in friendly subnets to access subnet 1, and deny access by other network devices. For another example, when the "access relationship" is "non-public", the action performed by the VCL gateway may be to allow access by network devices in the same subnet, allow access by network devices in friendly subnets, and deny access by other network devices. In some scenarios, the "execution action" may be customized by the user. The "execution action" shown in Table 1 is for exemplary purposes only and does not constitute a limitation on the implementation methods of the present application.

[0227] Table 1

[0228]

[0229]

[0230] The above content introduces the "access relationship", "access relationship description" and "execution action" in Table 1 in turn. It should be noted that Table 1 only shows the above access rules for exemplary purposes and does not constitute a limitation on the implementation methods of the present application. In the specific implementation process, the above access rules may include more or fewer options. For example, in addition to the three options of "access relationship", "access relationship description" and "execution action", options such as "unfriendly IP address" and "friendly IP address" may be included. Among them, the "unfriendly IP address" option can be filled with the IP address of a high-risk network device, or the IP address of a network device that is identified as unfriendly. In the case where the source IP address in the first message belongs to the IP address included in the "unfriendly IP address" option, the first message is not processed. For another example, the "friendly IP address" option can be filled with the IP address of a friendly network device, or the IP address of a network device that is identified as being able to access subnet 1. In the case where the "source IP address" in the first message belongs to the IP address included in the "friendly IP address" option, the first message is processed. Regarding how to process the first message, please refer to the relevant description of the subsequent step S703, which will not be described in detail here.

[0231] In a possible implementation, whether the first message complies with the access rule is determined based on the source IP address in the first message. Next, taking subnet 1 and the access rule shown in Table 1 as an example, how to determine whether the first message complies with the access rule is exemplarily introduced.

[0232] For example, the access relationship of subnet 1 can be set as "public" in the VCL gateway, the corresponding "access relationship description" can be set as "risky", and the corresponding "execution action" can be set as "allow network devices with any IP address to access". This means that any message that needs to access subnet 1 complies with the access rules and can be processed by the VCL gateway.

[0233] For example, a network device from the Internet needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it will forward the first message to subnet 1.

[0234] For example, from other VPCs in the public cloud (such as Figure 2 The network device of VPC2) shown in needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it will forward the first message to subnet 1.

[0235] For example, other subnets in the same VPC (such as Figure 2The network device in subnet 2) needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it will forward the first message to subnet 1.

[0236] Exemplarily, the access relationship of subnet 1 can be set as "protection" in the VCL gateway, the corresponding "description of access relationship" can be set as "friendly", and the corresponding "execution action" can be set as "1. Allow network devices in the public cloud to access; 2. Allow network devices in friendly subnets to access; 3. Deny access from other network devices". This is equivalent to, when the network device that needs to access subnet 1 is a network device in the public cloud (it should be noted that the public cloud is the public cloud where subnet 1 is located), or when the network device that needs to access subnet 1 is a network device in the "friendly subnet", the first message complies with the access rules and can be processed by the VCL gateway. Otherwise, the first message does not comply with the access rules and cannot be processed by the VCL gateway.

[0237] For example, from other VPCs in the public cloud (such as Figure 2 The network device of VPC2) shown in needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it will forward the first message to subnet 1.

[0238] For another example, a network device from the "friendly subnet" needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it will forward the first message to subnet 1.

[0239] Among them, "friendly subnet" can be one or more subnets marked as accessible to subnet 1, and a friendly subnet can be a subnet outside the public cloud. In addition, it can also be a "friendly IP address", and a "friendly IP address" includes one or more IP addresses, and the IP addresses included in the "friendly IP address" can be IP addresses outside the public cloud. The above "3. Deny access to other network devices" can be to deny access to network devices other than network devices in the public cloud and network devices in friendly subnets.

[0240] Exemplarily, the access relationship of subnet 1 can be set as "not public" in the VCL gateway, the corresponding "description of access relationship" is "risk-free", and the corresponding "execution action" is "1. Allow access by network devices in the same subnet; 2. Allow access by network devices in friendly subnets; 3. Deny access by other network devices". This is equivalent to the case where the network device that needs to access subnet 1 is a network device in the same subnet (it should be noted that the public cloud is the public cloud where subnet 1 is located), or the network device that needs to access subnet 1 is a network device in a "friendly subnet", the first message complies with the access rules and can be processed by the VCL gateway. Otherwise, the first message does not comply with the access rules and cannot be processed by the VCL gateway.

[0241] For example, a network device from subnet 1 needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it forwards the first message to subnet 1.

[0242] For another example, a network device from the "friendly subnet" needs to access subnet 1 and sends a first message. When the VCL gateway connected to subnet 1 receives the first message, it will forward the first message to subnet 1.

[0243] Among them, "friendly subnet" can be one or more subnets marked as being able to access subnet 1, and a friendly subnet can be a subnet outside the public cloud. In addition, it can also be a "friendly IP address", and the "friendly IP address" includes one or more IP addresses, and the IP addresses included in the "friendly IP address" can be IP addresses outside the public cloud.

[0244] The above lists the process of how the VCL gateway determines whether the first message complies with the access rules when the access relationships are "public", "protected" and "non-public" respectively. From the above description, it can be known that the first message can be forwarded to subnet 1 by the VCL gateway only when the IP address of the network device sending the first message belongs to an IP address that can access subnet 1. Therefore, the above access rule can also be "determining whether the source IP address in the first message complies with the target IP address resource", wherein the target IP address resource can be a preset IP address that can access subnet 1. For example, the target IP address resource may include "2001:db8:: / 32", or "1080::8:800:200C:417A". The target IP address resource may include any IP address. For example, the target IP address resource may include an IP address within the same VPC, an IP address in the same public cloud, or an IP address on the Internet. As to which IP addresses the target IP address resource specifically includes, the implementation mode of the present application does not limit the implementation mode.

[0245] S703: The network device processes the first message.

[0246] For the introduction of the network device, please refer to the description corresponding to step S701, which will not be repeated here. For the judgment of whether the first message complies with the access rule, please refer to the description corresponding to step S702, which will not be repeated here either.

[0247] In a possible implementation manner, when the first message complies with the access rule, the network device processes the first message.

[0248] Exemplarily, when the first message meets the access rule, the VCL gateway can send the message to subnet 1. Subnet 1 can also perform corresponding operations according to the first message, for example, sending data to the network device of the source IP address in the first message. This is equivalent to establishing a communication connection between the network device corresponding to the source IP address in the first message and the network device corresponding to the destination IP address in the first message when the first message meets the access rule.

[0249] From the above Figure 7 It can be seen from the access method flow chart shown that the network device that needs to access subnet 1 will send a first message to subnet 1, and the first message will pass through the VCL gateway connected to subnet 1. The VCL gateway will determine whether to process the first message based on the source IP address carried in the first message. By setting IP addresses of different ranges as IP addresses that can access subnet 1, network devices within the specified range can access subnet 1. Equivalently, by setting access rules located on the VCL gateway, private network access, public network access and restricted access of subnet 1 can be achieved. Among them, private network access can be access by network devices belonging to the same VPC, and it can also be access by network devices belonging to the same subnet. Public network access can be access by network devices outside the shared cloud, and restricted access can be access by other VPCs in the same public cloud. So that, when the subnet in the VPC uses GUA, the exposure of network devices in the VPC can also be reduced, reducing the possibility of malicious access.

[0250] It is understandable that the above Figure 7 Taking subnet 1 as an example, the access method provided by the implementation method of this application is introduced. Figure 7 The access method shown can be used for any subnet, for example Figure 2 Subnet 2, Subnet 3, or Subnet 4, etc. shown in .

[0251] Above Figure 2 The subnets in the VPC architecture diagram shown are each connected to an ACL gateway. In some possible scenarios, a VCL gateway can be connected to multiple subnets, such as Figure 8 shown.

[0252] Figure 8 The third VPC architecture diagram provided for the implementation of the present application is used to show a possible architecture of the VPC when the devices inside the VPC use the IPv6 public network address. Figure 8 As shown, Figure 8 Including the Internet, gateway, VPC1, VPC2 and IDC, etc.

[0253] from Figure 8 As can be seen from the figure, an ACL gateway can connect to one subnet, and an ACL gateway can also connect to multiple subnets. In other words, an ACL gateway can control the inflow and outflow of traffic in one subnet, and can also control the inflow and outflow of traffic in multiple subnets. Specifically, Figure 8 As shown in the figure, subnet 1 and subnet 2 are connected to one ACL gateway, subnet 4 and subnet 5 are connected to one ACL gateway, and subnet 3 is connected to one ACL gateway alone.

[0254] When VPC1 includes only subnet 1 and subnet 2, and subnet 1 and subnet 2 are connected to an ACL gateway together, the inflow and outflow of traffic in VPC1 are controlled by an ACL gateway in VPC1. The ACL gateway can realize private network access, public network access, and restricted access of the entire VPC.

[0255] Understandably, Figure 8 The VPC architecture diagram shown is used to illustrate that an ACL gateway can be connected to multiple subnets, or even only one ACL gateway in a VPC. The implementation method of this application does not limit how many subnets an ACL gateway is connected to. For example, the number of subnets connected to an ACL gateway can be determined by the user. For example, when using a VPC, the user can set how many subnets are connected to an ACL gateway.

[0256] from Figure 8 As can be seen from the figure, the ACL gateway can not only control the inflow or outflow of a subnet traffic, but also control the inflow or outflow of multiple subnet traffic, and even control the inflow and outflow of the entire VPC traffic. By setting the control range of the ACL gateway and combining the above Figure 7 The access method shown can realize private network access, public network access or restricted access to a subnet, and can also realize private network access, public network access or restricted access to multiple subnets at the same time. It can further realize private network access, public network access or restricted access to VPC, etc.

[0257] The above content provides an exemplary introduction to the access method provided by the implementation mode of the present application. Next, the setting and modification of the access rules used in the above access method are introduced.

[0258] In a possible implementation manner, the access rules may be set in a preset manner.

[0259] For example, you can set the access rules to be used before enabling the subnet or VPC. For example, please continue to refer to the above Figure 2 , you can Figure 2 Before enabling subnet 1 in the example, add an access rule to the ACL gateway connected to subnet 1. The access rule can be any one of the items in Table 1 above. For example, the access rule added to the ACL gateway connected to subnet 1 can have "Access Relationship" as "Public", "Description of Access Relationship" as "Risk", and "Execution Action" as "Allow Network Devices with Any IP Address to Access".

[0260] For another example, please continue to parameterize the above Figure 8 , you can Figure 8 Before enabling subnet 4 and subnet 5, add access rules to the ACL gateway connecting subnet 4 and subnet 5. You can set the same access rule for subnet 4 and subnet 5, or you can set two different access rules for subnet 4 and subnet 5. For example, the access rule added to the ACL gateway connecting subnet 4 and subnet 5 can be "public" for "access relationship", "risky" for "access relationship description", and "execution action" for "allowing network devices with any IP address to access" (hereinafter referred to as "first access rule"), and this "first access rule" can act on subnet 4 and subnet 5 together. For another example, in addition to adding a "first access rule" to the ACL gateway connecting subnet 4 and subnet 5, a "second access rule" can also be added. The "second access rule" can, for example, have an "access relationship" of "protection", a "description of access relationship" of "friendly", and an "execution action" of "1. Allow network devices in the public cloud to access; 2. Allow network devices in friendly subnets to access; 3. Deny access from other network devices." Among them, the "first access rule" can be used to control the inflow and outflow of subnet 4 traffic, and the "second access rule" can be used to control the inflow and outflow of subnet 5 traffic.

[0261] In a possible implementation manner, the access rules may also be modified.

[0262] Exemplarily, the access rules of the ACL gateway may be modified while the user is using the subnet.

[0263] For example, see above Figure 8 ,by Figure 8Taking subnet 3 in the example, the access rule set in the ACL gateway connected to subnet 3 can be the above-mentioned "first access rule". During use, the user needs to adjust the scope that can access subnet 3. The access rule set in the ACL gateway connected to subnet 3 can be adjusted to the above-mentioned "second access rule" so that the scope that can access subnet 3 is the network devices in the public cloud and the network devices in the friendly subnets.

[0264] By modifying the access rules, the access scope of the subnet or VPC can be adjusted in a timely manner. On the one hand, the specified network devices can access the subnet or VPC in a timely manner. On the other hand, the specified network devices can be prevented from accessing the subnet or VPC, thereby achieving the purpose of flexibly controlling the scope of access to the subnet or VPC. While simplifying the communication process between the VPC or subnet and other network devices, it can also reduce the possibility of malicious access.

[0265] In one possible scenario, one-way access between VPCs can also be achieved by setting up a VCL gateway.

[0266] For example, see above Figure 8 If the access rules of the ACL gateway in VPC1 indicate that the network devices of VPC2 can access the subnet in VPC1, but the access rules of the ACL gateway in VPC2 indicate that the network devices of VPC1 cannot access the subnet in VPC2, it constitutes one-way access from VPC2 to VPC1.

[0267] For example, the access rules set by the ACL gateway in VPC1 may include "Access Relationship" as "Protect", "Access Relationship Description" as "Friendly", and "Action" as "Allow access by network devices in VPC2". The access rules set by the ACL gateway in VPC2 may include "Access Relationship" as "Private", "Access Relationship Description" as "Friendly", and "Action" as "Only allow access by other subnets in VPC2". Then, VPC1 can accept access from VPC2, but VPC1 cannot access VPC2, thus constituting one-way access between VPCs.

[0268] In another possible scenario, bidirectional access between VPCs can be achieved by setting up a VCL gateway.

[0269] For example, please refer to the above Figure 8 If the access rules of the ACL gateway in VPC1 indicate that the network devices of VPC2 can access the subnet in VPC1, and the access rules of the ACL gateway in VPC2 indicate that the network devices of VPC1 can also access the subnet in VPC2, then bidirectional access is formed between VPC2 and VPC1.

[0270] For example, the access rules set by the ACL gateway in VPC1 may include "Access Relationship" as "Protect", "Access Relationship Description" as "Friendly", and "Action" as "Allow Network Devices in VPC2 to Access". The access rules set by the ACL gateway in VPC2 may include "Access Relationship" as "Protect", "Access Relationship Description" as "Friendly", and "Action" as "Allow Network Devices in VPC1 to Access". Then, VPC1 can accept access from VPC2, and VPC1 can also access VPC2, thus constituting bidirectional access between VPCs.

[0271] The above describes in detail the method of the embodiments of the present application. The following provides an apparatus for implementing any method in the embodiments of the present application. For example, an apparatus is provided including units (or means) for implementing each step performed by the device in any of the above methods.

[0272] like Fig. 9 As shown, Fig. 9 This is a schematic diagram of the structure of a configuration device provided in an embodiment of the present application. The configuration device 90 may include a processing unit 901 and an acquisition unit 902. The processing unit 901 and the acquisition unit 902 may be software, hardware, or a combination of software and hardware.

[0273] The processing unit 901 can implement a receiving function, and the processing unit 901 can also be described as a transceiver unit. The processing unit 901 can be a unit integrated with a sending unit, and the sending unit is used to implement a sending function. Optionally, the processing unit 901 can be used to receive information sent by other devices, and can also be used to send information to other devices.

[0274] In a possible implementation, the configuration device 90 may correspond to the above Figure 2 or Figure 8 The configuration device 90 may also be a chip in the VCL gateway. The configuration device 90 may include a chip for performing the above Figure 5 In the method embodiment shown, the operation unit executed by the VCL gateway, and the units in the configuration device 90 are respectively for implementing the above Figure 5 The operations performed by the VCL gateway in the method embodiment shown are as follows:

[0275] Processing unit 901 is used to provide network configuration rules, and the network configuration rules include public network access relations, specific access relations, and private access relations, wherein the public network access relations are used to indicate that the scope of access to the first network is the public network, the specific access relations are used to indicate that the scope of access to the first network is the first public cloud, and the private access relations are used to indicate that the scope of access to the first network is the first VPC.

[0276] The acquisition unit 902 is used to acquire the access relationship of the first network, where the access relationship of the first network is one of the network configuration rules.

[0277] The acquiring unit 902 is further configured to acquire a sub-access relationship of the first network, where the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network.

[0278] The processing unit 901 is further configured to configure the first VPC, determine a target network according to the access relationship of the first network and the sub-access relationship, and the target network is a network that is allowed to access the first network.

[0279] Optionally, the target network may also be determined only according to the access relationship of the first network.

[0280] In another possible implementation, the access relationship of the first network is the public network access relationship; the sub-access range is to deny the second network access to the first network; and the target network is a network in the public network other than the second network.

[0281] Optionally, the target network may be determined based on the public network access relationship only, and the target network is the public network, which is equivalent to allowing any network in the public network to access the first network.

[0282] In another possible implementation, the access relationship of the first network is the specific access relationship; the sub-access range is to allow a third network to access the first network, and the third network is located in the second public cloud; and the target network includes the first public cloud and the third network.

[0283] Optionally, the target network may be determined based on only the specific access relationship, and the target network is a network in the first public cloud, which is equivalent to allowing any network in the first public cloud to access the first network.

[0284] In another possible implementation, the access relationship of the first network is the specific access relationship; the sub-access range is that the fourth network is not allowed to access the first network, and the fourth network is located in the first public cloud; and the target network is a network in the first public cloud other than the fourth network.

[0285] In another possible implementation, the access relationship of the first network is the private access relationship; the sub-access scope is to allow the fifth network to access the first network, the fifth network is located in the second VPC, and the second VPC is located in the first public cloud; the target network includes the target VPC and the fifth network.

[0286] Optionally, the target network may be determined based on the private access-only relationship, and the target network is a network in the first VPC, which is equivalent to allowing the network in the first VPC to access the first network.

[0287] In another possible implementation, the access relationship of the first network is the private access relationship; the sub-access scope is to not allow the sixth network to access the first network, and the sixth network is located in the first VPC; and the target network is a network in the first VPC other than the sixth network.

[0288] In yet another possible implementation manner, the public network access relationship is further used to indicate that the first network is allowed to access a network in the public network.

[0289] Optionally, when the public network access relationship is used to indicate that the first network is allowed to access a network in the public network, the sub-access range may also be that the first network is not allowed to access the second network.

[0290] In yet another possible implementation manner, the specific access relationship is further used to indicate that the first network is allowed to access a network in the first public cloud.

[0291] Optionally, in a case where the specific access relationship is used to indicate that the first network is allowed to access the network in the first public cloud, the sub-access scope may also be to allow the first network to access the third network.

[0292] Optionally, in a case where the specific access relationship is used to indicate that the first network is allowed to access the network in the first public cloud, the sub-access range may also be that the first network is not allowed to access the fourth network.

[0293] In yet another possible implementation, the private access relationship is further used to indicate that the first network is allowed to access a network in the first VPC.

[0294] Optionally, when the private access relationship is used to indicate that the first network is allowed to access the network in the first VPC, the sub-access scope may also be to allow the first network to access the fifth network.

[0295] Optionally, when the private access relationship is used to indicate that the first network is allowed to access the network in the first VPC, the sub-access scope may also be that the first network is not allowed to access the sixth network.

[0296] In yet another possible implementation, the first network is allowed to access the target network.

[0297] The method executed by the processing unit 901 and the acquisition unit 902 can be referred to in the above Figure 5 The corresponding methods will not be described here.

[0298] For the technical effects of any of the above designs and any possible implementation methods, please refer to the above Figure 5 The introduction of the technical effects of the corresponding methods will not be repeated here.

[0299] Optionally, in the configuration device described in any of the above designs and any of the possible implementation modes:

[0300] In one implementation, the configuration device is a communication device. When the configuration device is a communication device, the receiving unit may be a transceiver, or an input / output interface; the processing unit may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0301] In another implementation, the configuration device is a chip (system) or circuit used in a communication device. When the configuration device is a chip (system) or circuit used in a communication device, the receiving unit may be a communication interface (input / output interface), interface circuit, output circuit, input circuit, pin or related circuit on the chip (system) or circuit; the processing unit may be at least one processor, processing circuit or logic circuit.

[0302] According to the embodiment of the present application, Figure 5 The various units in the device shown can be separately or all combined into one or several other units to constitute, or some of the units (some) can also be split into multiple smaller units in function to constitute, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above-mentioned units are divided based on logical functions. In practical applications, the functions of one unit can also be implemented by multiple units, or the functions of multiple units can be implemented by one unit. In other embodiments of the present application, other units can also be included based on the electronic device. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by the collaboration of multiple units.

[0303] It should be noted that the implementation of each unit can also refer to the above Figure 5 The corresponding description of the method embodiment shown.

[0304] For the case where the configuration device can be a chip or a chip system, see Fig.10 Schematic diagram of the chip structure shown.

[0305] like Fig.10As shown, the chip 100 includes a processor 1001 and an interface 1002. The number of the processors 1001 may be one or more, and the number of the interfaces 1002 may be multiple. It should be noted that the functions corresponding to the processor 1001 and the interface 1002 may be implemented by hardware design, software design, or a combination of hardware and software, which is not limited here.

[0306] Optionally, the chip 100 may further include a memory 1003, and the memory 1003 is used to store necessary program instructions and data.

[0307] In the present application, the processor 1001 may be used to call the implementation program of the access method provided by one or more embodiments of the present application in the VCL gateway from the memory 1003, and execute the instructions contained in the program. The interface 1002 may be used to output the execution result of the processor 1001. In the present application, the interface 1002 may be specifically used to output various messages or information of the processor 1001.

[0308] For the access method provided by one or more embodiments of the present application, please refer to the aforementioned Figure 5 The various embodiments shown will not be described in detail here.

[0309] The processor in the embodiment of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0310] The memory in the embodiment of the present application is used to provide storage space, and the storage space can store data such as operating system and computer program. The memory includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or portable read only memory (compact disc read-only memory, CD-ROM).

[0311] According to the method provided in the embodiment of the present application, the embodiment of the present application provides a configuration system, including: the above-mentioned configuration device and a first VPC, the configuration device is for example the above-mentioned Fig. 9 The configuration device shown is used to configure a first VPC, the first VPC belongs to a first public cloud, and a first network bound to an IPv6 address is set in the first VPC.

[0312] The configuration device performs the above Figure 5 The method shown, the first VPC identifies the source address of the service message accessing the first network, and allows the service message to access the first network when the source address belongs to the target network;

[0313] The target network depends on the access relationship of the first network and the sub-access relationship, wherein the access relationship of the first network is one of the network configuration rules, and the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network;

[0314] The above-mentioned network configuration rules include public network access relations, specific access relations, and private access relations, wherein the above-mentioned public network access relations are used to indicate that the scope of access to the above-mentioned first network is the public network, the above-mentioned specific access relations are used to indicate that the scope of access to the above-mentioned first network is the above-mentioned first public cloud, and the above-mentioned private access relations are used to indicate that the scope of access to the above-mentioned first network is the above-mentioned first VPC.

[0315] According to the method provided in the embodiment of the present application, the embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed on one or more processors, the above-mentioned Figure 5 The method shown.

[0316] According to the method provided in the embodiment of the present application, the embodiment of the present application also provides a computer program product, the above-mentioned computer program product includes a computer program, when the above-mentioned computer program is run on a processor, it can implement the above-mentioned Figure 5 The method shown.

[0317] An embodiment of the present application also provides a processing device, including a processor and an interface; the processor is used to execute the method in any of the above method embodiments.

[0318] It should be understood that the above-mentioned processing device can be a chip. For example, the processing device can be a field programmable gate array (FPGA), a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor are combined to be executed. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0319] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0320] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disc (SSD)).

[0321] The units in the above-mentioned various device embodiments completely correspond to the electronic devices in the method embodiments, and the corresponding modules or units perform the corresponding steps. For example, the communication unit (transceiver) performs the steps of receiving or sending in the method embodiment, and other steps except sending and receiving can be performed by the processing unit (processor). The functions of the specific units can refer to the corresponding method embodiments. Among them, the processor can be one or more.

[0322] It is understandable that in the embodiments of the present application, the electronic device can perform some or all of the steps in the embodiments of the present application, and these steps or operations are only examples. The embodiments of the present application can also perform other operations or variations of various operations. In addition, the various steps can be performed in different orders presented in the embodiments of the present application, and it is possible that not all operations in the embodiments of the present application need to be performed.

[0323] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0324] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0325] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0326] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0327] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0328] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or the contributing part or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories ROM, random access memories RAM, magnetic disks or optical disks.

[0329] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A network access configuration method based on IPv6 address, characterized in that: The method is applied to a cloud management platform, the cloud management platform is used to manage infrastructure, the infrastructure runs a first public cloud, the first public cloud includes a first virtual private network VPC, and the first VPC is provided with a first network bound to an IPv6 address, the method includes: Providing a network configuration rule, the network configuration rule comprising a public network access relationship, a specific access relationship, and a private access relationship, wherein the public network access relationship is used to indicate that the scope of access to the first network is the public network, the specific access relationship is used to indicate that the scope of access to the first network is the first public cloud, and the private access relationship is used to indicate that the scope of access to the first network is the first VPC; Acquire an access relationship of the first network, where the access relationship of the first network is one of the network configuration rules; Acquire a sub-access relationship of the first network, where the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network; The first VPC is configured so that the first VPC determines a network that is allowed to access the first network according to the access relationship of the first network and the sub-access relationship.

2. The method according to claim 1, characterized in that The access relationship of the first network is the public network access relationship; the sub-access relationship is to deny the second network access to the first network; The network allowed to access the first network is a network in the public network except the second network.

3. The method according to claim 1, characterized in that The access relationship of the first network is the specific access relationship; the sub-access relationship is to allow a third network to access the first network, and the third network is located in the second public cloud; The networks allowed to access the first network include the first public cloud and the third network.

4. The method according to claim 1, characterized in that: The access relationship of the first network is the specific access relationship; the sub-access relationship is that the fourth network is not allowed to access the first network, and the fourth network is located in the first public cloud; The network allowed to access the first network is a network in the first public cloud except the fourth network.

5. The method according to claim 1, characterized in that: The access relationship of the first network is the private access relationship; the sub-access relationship is to allow a fifth network to access the first network, the fifth network is located in a second VPC, and the second VPC is located in the first public cloud; The networks allowed to access the first network include the first VPC and the fifth network.

6. The method according to claim 1, characterized in that The access relationship of the first network is the private access relationship; the sub-access relationship is that the sixth network is not allowed to access the first network, and the sixth network is located in the first VPC; The networks allowed to access the first network are networks in the first VPC except the sixth network.

7. The method according to any one of claims 1 to 6, characterized in that: The first network is allowed to access a target network, where the target network is the network allowed to access the first network.

8. A configuration device, characterized in that: The configuration device is used to manage an infrastructure, wherein the infrastructure runs a first public cloud, the first public cloud includes a first virtual private network VPC, and a first network bound to an IPv6 address is set in the first VPC; the device includes a processing unit and an acquisition unit, wherein: The processing unit is used to provide a network configuration rule, wherein the network configuration rule includes a public network access relationship, a specific access relationship, and a private access relationship, wherein the public network access relationship is used to indicate that a scope of access to the first network is a public network, the specific access relationship is used to indicate that a scope of access to the first network is the first public cloud, and the private access relationship is used to indicate that a scope of access to the first network is the first VPC; The acquiring unit is configured to acquire an access relationship of the first network, where the access relationship of the first network is one of the network configuration rules; The acquisition unit is further used to acquire a sub-access relationship of the first network, where the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network; The processing unit is further used to configure the first VPC so that the first VPC determines a network that is allowed to access the first network according to the access relationship of the first network and the sub-access relationship.

9. The device according to claim 8, characterized in that The access relationship of the first network is the public network access relationship; the sub-access relationship is to deny the second network access to the first network; The network allowed to access the first network is a network in the public network except the second network.

10. The device according to claim 8, characterized in that The access relationship of the first network is the specific access relationship; the sub-access relationship is to allow a third network to access the first network, and the third network is located in the second public cloud; The networks allowed to access the first network include the first public cloud and the third network.

11. The device according to claim 8, characterized in that The access relationship of the first network is the specific access relationship; the sub-access relationship is that the fourth network is not allowed to access the first network, and the fourth network is located in the first public cloud; The network allowed to access the first network is a network in the first public cloud except the fourth network.

12. The device according to claim 8, characterized in that The access relationship of the first network is the private access relationship; the sub-access relationship is to allow a fifth network to access the first network, the fifth network is located in a second VPC, and the second VPC is located in the first public cloud; The networks allowed to access the first network include the first VPC and the fifth network.

13. The device according to claim 8, characterized in that The access relationship of the first network is the private access relationship; the sub-access relationship is that the sixth network is not allowed to access the first network, and the sixth network is located in the first VPC; The networks allowed to access the first network are networks in the first VPC except the sixth network.

14. The device according to any one of claims 8 to 13, characterized in that: The processing unit is further used to configure the first VPC so that the first VPC determines to allow the first network to access a target network according to the access relationship of the first network and the sub-access relationship, and the target network is the network allowed to access the first network.

15. A configuration device, characterized in that: The configuration device includes a processor and a storage medium, wherein the storage medium stores instructions, and when the instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

16. A configuration system, characterized in that: The configuration system includes a configuration device and a first VPC, the configuration device is a device according to any one of claims 8 to 15, the configuration device is used to configure the first VPC, the first VPC belongs to a first public cloud, and a first network bound to an IPv6 address is set in the first VPC; The configuration device executes the method according to any one of claims 1 to 7, wherein the first VPC identifies a source address of a service packet accessing the first network, and allows the service packet to access the first network if the source address belongs to a target network; The target network depends on the access relationship of the first network and the sub-access relationship, wherein the access relationship of the first network is one of the network configuration rules, and the sub-access relationship is used to indicate a sub-access range based on the access relationship of the first network; The network configuration rules include a public network access relationship, a specific access relationship, and a private access relationship, wherein the public network access relationship is used to indicate that the scope of access to the first network is the public network, the specific access relationship is used to indicate that the scope of access to the first network is the first public cloud, and the private access relationship is used to indicate that the scope of access to the first network is the first VPC.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, and when the instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images