Security protection method, cloud access method, network architecture, device and equipment

Abstract

The invention provides a security protection method, a cloud access method, a network architecture, a device and equipment, and relates to the technical field of cloud computing. The method comprises the steps that under the condition that a first condition is met, a port unblocking request is sent to a second controller, and the port unblocking request is used for requesting to unblock a port of a target virtual public network IP address corresponding to a user instance by a public network gateway in a first available area; the first available area and the second available area adopt different SDN structures, and share one exit router and one NAT gateway with the second available area; the first controller is used for controlling the second controller and the third controller, the second controller is used for controlling the public network gateway, the third controller is used for controlling the NAT gateway, and the public network gateway is provided with a port blocking strategy aiming at a virtual public network IP address corresponding to a public network IP address bound with the virtual machine in the first available area. According to the scheme, the problem that the public network access strategy in the heterogeneous available area is invalid is solved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a security protection method, a cloud access method, a network architecture, a device and equipment. Background Art

[0002] Based on the requirements of national computing power interconnection and interoperability, combined with the current situation of growing domestic computing power and low utilization rate, how to achieve unified orchestration and intelligent scheduling of computing power is a major pain point in the development of computing power in various countries. Leading domestic operators have proposed a computing power networking solution, which integrates and orchestrates computing power resources and network resources through the computing network brain, realizes intelligent scheduling and real-time response of computing power resources, and maximizes the computing power supply capacity, data processing capacity, network connectivity capacity, and business supply capacity of the computing network.

[0003] like Figure 1 As shown, computing power networking involves multi-vendor cloud platforms. Different vendors use different Software Defined Network (SDN) solutions, and the east-west traffic within the cloud between different SDN vendors is naturally isolated.

[0004] From the perspective of cost and convenience, there are scenarios where different SDN vendors share the same public network exit. Port access from outside the cloud based on the public Internet Protocol (IP) is mainly achieved through a two-level mapping mechanism between the private network (Virtual Private Cloud, VPC) address in the cloud and the public network address, that is: first from the intranet address to the intermediate address, and then from the intermediate address to the public network address. In order to ensure the security of user service ports, SDN vendors will block ports on their respective gateways, and users can unblock ports as needed to provide external services based on specific ports.

[0005] However, in the scenario of heterogeneous SDN vendors sharing the same egress, different SDN vendors adopt different port blocking solutions, resulting in the expansion of SDN vendors (such as Figure 2 The port where the manufacturer 2) is located is difficult to unblock according to user needs, resulting in user service access failure. Summary of the invention

[0006] The purpose of the present invention is to provide a security protection method, a cloud access method, a network architecture, a device and equipment, which solve the problem of failure of public network access strategy in heterogeneous availability zones.

[0007] To achieve the above object, an embodiment of the present invention provides a security protection method, which is applied to a first controller and includes:

[0008] When the first condition is met, a port unblocking request is sent to the second controller, where the port unblocking request is used to request to unblock the port of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone;

[0009] The first condition includes at least one of the following:

[0010] The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone;

[0011] The target public IP address of the user instance is successfully registered, and in the target destination address translation (DNAT) rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone;

[0012] The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet;

[0013] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0014] To achieve the above object, an embodiment of the present invention provides a security protection method, which is applied to a second controller and includes:

[0015] receiving a port unblocking request sent by the first controller;

[0016] According to the port unblocking request, control the public network gateway in the first available zone to perform a port unblocking operation, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance;

[0017] Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0018] To achieve the above object, an embodiment of the present invention provides a security protection method, which is applied to a public network gateway, comprising:

[0019] Upon receiving the port unblocking indication sent by the second controller, unblocking the port of the target virtual public IP address or unblocking the port of the target port, wherein the port unblocking indication is used to instruct the public network gateway in the first availability zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a port that has been successfully registered, and the mapping relationship between the target virtual public IP address and the target intermediate address is stored on the public network gateway;

[0020] The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

[0021] Optionally, the method further comprises:

[0022] Receive second configuration information sent by the first controller, where the second configuration information includes a target intermediate address corresponding to the target virtual public IP address;

[0023] The mapping relationship between the target virtual public IP address and the target intermediate address is stored.

[0024] To achieve the above object, an embodiment of the present invention provides a security protection method, which is applied to a third controller and includes:

[0025] Upon receiving the first configuration information sent by the first controller, sending third configuration information to the NAT gateway, wherein the first configuration information is used to indicate a mapping relationship between a target public IP address of the user instance and a target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure a mapping relationship between the target public IP address and the target virtual public IP address;

[0026] The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

[0027] To achieve the above object, an embodiment of the present invention provides a cloud access method, which is applied to a NAT gateway, including:

[0028] When receiving a first access request, replacing the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtaining first target information, and transmitting the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address;

[0029] The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet;

[0030] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0031] To achieve the above object, an embodiment of the present invention provides a cloud access method, which is applied to a public network gateway, including:

[0032] When the first target information is received, the destination address of the first target information is replaced by the target virtual public network IP address with the target intermediate address to obtain the second target information;

[0033] The second target information is forwarded to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

[0034] To achieve the above object, an embodiment of the present invention provides a network architecture, including:

[0035] The first availability zone includes the second SDN gateway and the public network gateway;

[0036] A second availability zone adopts a different SDN structure from the first availability zone, and the second availability zone includes a first SDN gateway;

[0037] A first switch, a NAT gateway and an egress router, wherein the first switch is respectively connected to the first SDN gateway, the second SDN gateway, the public network gateway, the NAT gateway and the egress router, the egress router is connected to the Internet, and the second availability zone and the first availability zone both communicate with the Internet via the egress router;

[0038] A first controller, a second controller and a third controller, wherein the first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway and the second SDN gateway, and the third controller is used to control the NAT gateway and the first SDN gateway.

[0039] Optionally, the first available zone is configured with a virtual public IP address segment and a preset intermediate address segment.

[0040] To achieve the above object, an embodiment of the present invention provides a safety protection device, which is applied to a first controller and includes:

[0041] A first blocking module, configured to send a port unblocking request to the second controller when a first condition is met, wherein the port unblocking request is used to request to release the port blocking of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone;

[0042] The first condition includes at least one of the following:

[0043] The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone;

[0044] The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone;

[0045] The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet;

[0046] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0047] To achieve the above object, an embodiment of the present invention provides a safety protection device, which is applied to a second controller and includes:

[0048] A third receiving module, configured to receive a port unblocking request sent by the first controller;

[0049] A first control module, configured to control the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance;

[0050] Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0051] To achieve the above object, an embodiment of the present invention provides a security protection device, which is applied to a public network gateway, including:

[0052] an unblocking module, configured to unblock the port of the target virtual public IP address or the target port upon receiving a port unblocking indication sent by the second controller, wherein the port unblocking indication is used to instruct the public network gateway in the first available zone to unblock the port of the target virtual public IP address or the target port, the target port being a port that has been successfully filed, and the public network gateway storing a mapping relationship between the target virtual public IP address and the target intermediate address;

[0053] The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

[0054] To achieve the above object, an embodiment of the present invention provides a safety protection device, which is applied to a third controller, comprising:

[0055] A first sending module is used to send third configuration information to the NAT gateway when receiving the first configuration information sent by the first controller, wherein the first configuration information is used to indicate a mapping relationship between a target public IP address of the user instance and a target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure a mapping relationship between the target public IP address and the target virtual public IP address;

[0056] The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

[0057] To achieve the above object, an embodiment of the present invention provides a cloud access device, which is applied to a NAT gateway, including:

[0058] A first processing module is used to, upon receiving a first access request, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain first target information, and transmit the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address;

[0059] The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet;

[0060] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0061] To achieve the above object, an embodiment of the present invention provides a cloud access device, which is applied to a public network gateway, including:

[0062] A second processing module is used to replace the destination address of the first target information from the target virtual public network IP address to the target intermediate address when receiving the first target information, so as to obtain the second target information;

[0063] The third processing module is used to forward the second target information to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

[0064] To achieve the above object, an embodiment of the present invention provides a device, which is a first controller, including a processor and a transceiver, wherein the transceiver is used to:

[0065] When the first condition is met, a port unblocking request is sent to the second controller, where the port unblocking request is used to request to unblock the port of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone;

[0066] The first condition includes at least one of the following:

[0067] The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone;

[0068] The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone;

[0069] The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet;

[0070] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0071] To achieve the above object, an embodiment of the present invention provides a device, which is a second controller, comprising a processor and a transceiver, wherein the transceiver is used to receive a port unblocking request sent by the first controller;

[0072] The processor is used to control the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance;

[0073] Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0074] To achieve the above object, an embodiment of the present invention provides a device, wherein the device is a public network gateway, and the device is a second controller, including a processor and a transceiver, wherein the processor is used to:

[0075] Upon receiving the port unblocking indication sent by the second controller, unblocking the port of the target virtual public IP address or unblocking the port of the target port, wherein the port unblocking indication is used to instruct the public network gateway in the first availability zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a port that has been successfully registered, and the mapping relationship between the target virtual public IP address and the target intermediate address is stored on the public network gateway;

[0076] The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

[0077] To achieve the above-mentioned purpose, an embodiment of the present invention provides a device, which is a third controller, including a processor and a transceiver, wherein the transceiver is used to send third configuration information to the NAT gateway when receiving first configuration information sent by the first controller, the first configuration information is used to indicate the mapping relationship between the target public IP address of the user instance and the target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure the mapping relationship between the target public IP address and the target virtual public IP address;

[0078] The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

[0079] To achieve the above-mentioned purpose, an embodiment of the present invention provides a device, which is a NAT gateway, including a processor and a transceiver, wherein the processor is used to, when receiving a first access request, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain first target information, and transmit the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address;

[0080] The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet;

[0081] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0082] To achieve the above object, an embodiment of the present invention provides a device, which is a public network gateway, including a processor and a transceiver, wherein the processor is used to:

[0083] When the first target information is received, the destination address of the first target information is replaced by the target virtual public network IP address with the target intermediate address to obtain the second target information;

[0084] The second target information is forwarded to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

[0085] To achieve the above-mentioned purpose, an embodiment of the present invention provides a device, including a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; when the processor executes the program or instruction, it implements the security protection method applied to the first controller as above, or implements the security protection method applied to the second controller as above, or implements the security protection method applied to the public network gateway as above, or implements the security protection method applied to the third controller as above, or implements the cloud access method applied to the NAT gateway as above, or implements the cloud access method applied to the public network gateway as above.

[0086] To achieve the above-mentioned purpose, a computer program product is provided, including computer instructions. When the computer instructions are executed by a processor, the steps of the security protection method applied to the first controller as above are implemented, or the steps of the security protection method applied to the second controller as above are implemented, or the steps of the security protection method applied to the public network gateway as above are implemented, or the steps of the security protection method applied to the third controller as above are implemented, or the steps of the cloud access method applied to the NAT gateway as above are implemented, or the steps of the cloud access method applied to the public network gateway as above are implemented.

[0087] To achieve the above-mentioned purpose, an embodiment of the present invention provides a readable storage medium having a program or instruction stored thereon. When the program or instruction is executed by a processor, the steps of the security protection method applied to the first controller as above, or the steps of the security protection method applied to the second controller as above, or the steps of the security protection method applied to the public network gateway as above, or the steps of the security protection method applied to the third controller as above, or the steps of the cloud access method applied to the NAT gateway as above, or the steps of the cloud access method applied to the public network gateway as above.

[0088] The beneficial effects of the above technical solution of the present invention are as follows:

[0089] According to the method of the embodiment of the present invention, the heterogeneous first availability zone and second availability zone share an export router and a NAT gateway to achieve communication with the international Internet. For this scenario, a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone is set on the public network gateway in the first availability zone. In this way, a port unblocking request can be sent to the second controller through the first controller, so that the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation, thereby unblocking the port of the target virtual IP address corresponding to the user instance by the public network gateway in the first availability zone, thereby solving the problem of failure of the public network access policy in the heterogeneous availability zones. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 This is a diagram of the heterogeneous SDN architecture of multiple cloud vendors in the prior art;

[0091] Figure 2 A schematic diagram of a model in which two different availability zones (AZs) are heterogeneous SDNs and share one egress traffic in the prior art;

[0092] Figure 3 This is one of the flow charts of the security protection method according to an embodiment of the present invention;

[0093] Figure 4 This is a schematic diagram of a model in which heterogeneous SDNs in the same AZ share one egress traffic according to an embodiment of the present invention;

[0094] Figure 5 This is a diagram of the public IP address blocking arrangement architecture of an embodiment of the present invention;

[0095] Figure 6 This is one of the timing diagrams for arranging the blocking of the public network IP of the heterogeneous controller according to an embodiment of the present invention;

[0096] Figure 7 This is the second sequence diagram of the arrangement of the public network IP blocking of the heterogeneous controller according to the embodiment of the present invention;

[0097] Figure 8 This is a flowchart of public network IP blocking in the DNAT rule application scenario of an embodiment of the present invention;

[0098] Fig. 9 This is the second flowchart of the security protection method according to the embodiment of the present invention;

[0099] Fig.10 This is a third flowchart of the security protection method according to an embodiment of the present invention;

[0100] Fig.11 This is a fourth flowchart of the security protection method according to an embodiment of the present invention;

[0101] Fig.12 A flowchart of a cloud access method according to an embodiment of the present invention;

[0102] Fig.13 A flowchart of a cloud access method according to another embodiment of the present invention;

[0103] Fig.14 This is one of the structural diagrams of the safety protection device according to an embodiment of the present invention;

[0104] Fig.15 This is the second structural diagram of the safety protection device according to an embodiment of the present invention;

[0105] Fig.16 This is the third structural diagram of the safety protection device of an embodiment of the present invention;

[0106] Fig.17 This is the fourth structural diagram of the safety protection device according to the embodiment of the present invention;

[0107] Fig.18 A structural diagram of a cloud access device according to an embodiment of the present invention;

[0108] Fig.19 A structural diagram of a cloud access device according to another embodiment of the present invention;

[0109] Fig. 20 is a structural diagram of a device according to an embodiment of the present invention;

[0110] Fig.21 This is a structural diagram of a device according to another embodiment of the present invention. DETAILED DESCRIPTION

[0111] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0112] It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present invention. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0113] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0114] Additionally, the terms "system" and "network" are often used interchangeably herein.

[0115] In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that determining B according to A does not mean determining B only according to A, and B can also be determined according to A and / or other information.

[0116] like Figure 3 As shown, a security protection method according to an embodiment of the present invention is applied to a first controller, comprising:

[0117] Step 301, when the first condition is met, a port unblocking request is sent to the second controller, the port unblocking request is used to request the public network gateway in the first availability zone to unblock the port of the target virtual public Internet Protocol IP address corresponding to the user instance; wherein the first condition includes at least one of the following: (1) the target public network IP address of the user instance is successfully registered and the target public network IP address corresponds to the target virtual machine in the first availability zone; (2) the target public network IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public network IP address, the intranet IP address points to the target virtual machine in the first availability zone. wherein the first availability zone and the second availability zone adopt different software defined network SDN structures, and share an egress router and a network address translation NAT gateway with the second availability zone to realize communication with the Internet; the first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, the third controller is used to control the NAT gateway, and the public network gateway is provided with a port blocking policy for the virtual public network IP address corresponding to the public network IP address bound to the virtual machine in the first availability zone.

[0118] Here, combined Figure 4 and Figure 5 A specific embodiment of the present invention is described:

[0119] like Figure 4 As shown, the first availability zone (the availability zone corresponding to manufacturer 2) and the second availability zone (the availability zone corresponding to manufacturer 1, and manufacturer 1 and manufacturer 2 use different SDN solutions) share the same egress router and NAT gateway. In the embodiment of the present invention, a public network gateway is added in the first availability zone, and the public network gateway is provided with a port blocking policy for the virtual public network IP address corresponding to the public network IP address bound to the virtual machine in the first availability zone.

[0120] like Figure 5 As shown, the first controller mentioned above can be a heterogeneous controller. The first controller can control the second controller and the third controller. The second controller can control the public network gateway (i.e., manufacturer 2-public network gateway) and manufacturer 2-SDN gateway (i.e., the second SDN gateway) in the first availability zone, and the third controller can control the NAT gateway and manufacturer 1-SDN gateway (i.e., the first SDN gateway). It should be noted that since two heterogeneous availability zones share one NAT gateway, in order to reduce the load of the NAT gateway and ensure the forwarding performance of the NAT gateway, it is necessary to distribute the cloud access security protection to each SDN gateway for implementation.

[0121] It should also be noted that a public network gateway (not shown in the accompanying drawings) can also be set up in the second availability zone. The public network gateway in the second availability zone can be managed by a third controller. The public network gateway in the second availability zone is provided with a port blocking policy corresponding to the public IP bound to the virtual machine in the second availability zone.

[0122] It should be noted that users can order public IP services through the console, and the heterogeneous controller can allocate public IP addresses to users and persist public IP information. After that, users can order instances (i.e. user instances, such as cloud host instances) through the console. After the order is successful, the public IP address is bound to the cloud host, so that the cloud host can provide services to the outside through the public IP address to which it is bound. Alternatively, the DNAT rules corresponding to the public IP address can be configured to provide services to the outside. Among them, the embodiment of the present invention mainly describes the security protection method (including blocking and unblocking methods) for the first available zone, that is, the target public IP address corresponds to the target virtual machine in the first available zone, or the target destination address corresponding to the target public IP address converts the intranet IP address in the DNAT rule to point to the target virtual machine in the first available zone. In these cases, if the target public IP address of the user instance is successfully registered, the first controller sends a port unblocking request to the second controller, so that the second controller controls the public gateway in the first available zone to unblock the port of the target virtual public IP address corresponding to the user instance.

[0123] In this embodiment, the heterogeneous first availability zone and second availability zone share an export router and a NAT gateway to achieve communication with the international Internet. For this scenario, a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone is set on the public network gateway in the first availability zone. In this way, a port unblocking request can be sent to the second controller through the first controller, so that the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation, thereby unblocking the port of the target virtual IP address corresponding to the user instance by the public network gateway in the first availability zone, thereby solving the problem of failure of the public network access policy in the heterogeneous availability zones.

[0124] In some embodiments, the method further includes: upon obtaining the first creation request and the target virtual public IP address corresponding to the target public IP address, sending a second creation request to the second controller; wherein the first creation request is used to request the creation of a DNAT rule corresponding to the target public IP address; and the second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

[0125] It should be noted that if this is not the first time that a DNAT rule is created for a public IP address, then when the DNAT rule corresponding to the public IP address was created previously, a corresponding virtual public IP address should have been allocated to the public IP address. Therefore, when the first creation request and the target virtual public IP address corresponding to the target public IP address are obtained, the first controller can send a second creation request to the second controller so that the second controller creates a DNAT rule corresponding to the target public IP address.

[0126] In some embodiments, the method further includes: when the second condition is met, sending a third creation request to the second controller, the third creation request being used to request the second controller to create a virtual public IP address corresponding to the target public IP address; receiving a target virtual public IP address corresponding to the target public IP address fed back by the second controller; and storing a mapping relationship between the target public IP address and the target virtual public IP address; wherein the second condition includes at least one of the following:

[0127] (1) A first creation request is received and a target virtual public IP address corresponding to the target public IP address is not obtained.

[0128] Here, the first creation request is used to request the creation of a DNAT rule corresponding to the target public IP address, and the request can be sent by the user to the first controller through the console. That is, when the user requests to create a DNAT rule, if the target virtual public IP address corresponding to the target public IP address is not obtained, it indicates that this is the first time to create a DNAT rule for the target public IP address, and the first controller needs to first request the second controller to create a virtual public IP address corresponding to the target public IP address.

[0129] (2) Binding indication information is received, where the binding indication information is used to indicate that the target public IP address has been bound to the target virtual machine in the first availability zone.

[0130] It should be noted that after the user successfully orders an instance through the console, the public IP address is bound to the target virtual machine (such as a cloud host) in the first availability zone, and the first controller can receive the binding indication information. After that, the first controller needs to request the second controller to create a virtual public IP address corresponding to the target public IP address.

[0131] (3) First migration indication information is received, where the first migration indication information is used to indicate that the user instance is to be migrated from the second availability zone to the first availability zone.

[0132] It should be noted that when the user instance is migrated from the second availability zone to the first availability zone, it is necessary to allocate a virtual public IP address corresponding to the target public IP address to establish a mapping relationship between the target public IP address and the virtual public IP address to achieve security protection for the target public IP address.

[0133] It should be noted that two segments of private network addresses can be reserved (pre-configured) for the first available zone, namely: a virtual public IP address segment (assuming address segment B) and a preset intermediate address segment (assuming address segment C). It is understandable that both address segment B and address segment C cannot conflict with the private network address reserved for the second available zone (assuming address segment A).

[0134] In this embodiment, the first controller may send a third creation request to the second controller, so that the second controller may create a virtual public IP address corresponding to the target public IP address.

[0135] Optionally, before storing the mapping relationship between the target public IP address and the target virtual public IP address, the method further includes: sending first configuration information to a third controller, wherein the first configuration information is used to indicate the mapping relationship between the target public IP address and the target virtual public IP address.

[0136] Optionally, the method further includes: after the user instance is migrated from the second availability zone to the first availability zone, sending second migration indication information to a third controller, wherein the second migration indication information is used to indicate that the user instance has been migrated out of the second availability zone.

[0137] That is to say, after the migration of the user instance (such as a cloud host instance) is completed, the first controller can notify the third controller through the second migration indication information: the user instance has migrated out of the second availability zone, so that the third controller can control the manufacturer 1-SDN gateway (i.e., the first SDN gateway) to restore the port blocking configuration (i.e., restore the port blocking of the target public IP address).

[0138] Optionally, the target virtual public IP address corresponds one-to-one to the target intermediate address, and the target intermediate address is created by the second controller.

[0139] The application of the embodiment of the present invention is described below in conjunction with specific scenarios.

[0140] Application scenario 1:

[0141] The user can order an instance (i.e., a user instance, such as a cloud host instance) through the console, and the first controller assigns a target public IP address to the user instance. After the order is successful, the target public IP address is bound to the cloud host, so that the cloud host can provide services to the outside world through the public IP address to which it is bound. In the following embodiments, the first controller is a heterogeneous controller and the user instance is a cloud host instance.

[0142] Specifically, after the target public IP address is bound to the cloud host, the heterogeneous controller can perform corresponding orchestration based on the availability zone where the cloud host instance is located (that is, the availability zone where the subnet corresponding to the cloud host is located). This application scenario 1 is mainly divided into the following two situations:

[0143] Case 1:

[0144] If the cloud host instance (bound to the target public IP address) falls in the second availability zone, that is, the target public IP address corresponds to the target virtual machine in the second availability zone, the heterogeneous controller issues (sends) a request to the third controller. After receiving the request issued by the first controller, the third controller performs the following configuration: allocates an intermediate address within the address segment A to the cloud host instance; notifies the NAT gateway of the mapping relationship between the intermediate address and the target public IP address; and sets the port blocking configuration (i.e., the port blocking policy) of the intermediate address on the vendor 1-SDN gateway.

[0145] The user will file the target public IP address as needed, such as filing with an Internet Content Provider (ICP). When the filing (such as ICP filing) is successful, the console calls the first controller, and the first controller sends a port unblocking request to the third controller. After receiving the request, the third controller unblocks the port corresponding to the target public IP address on the vendor 1-SDN gateway. After that, the cloud host instance can provide external services based on the unblocked port.

[0146] Case 2:

[0147] If the cloud host instance (bound to the target public IP address) is in the first availability zone, that is, the target public IP address corresponds to the target virtual machine in the first availability zone, such as Figure 6 As shown, the heterogeneous controller performs the following processing:

[0148] The heterogeneous controller sends a third creation request (requesting the creation of a virtual public IP address corresponding to the target public IP address) to the second controller, so that the second controller creates a virtual public IP address within address segment B; after the heterogeneous controller receives the target virtual public IP address corresponding to the target public IP address fed back by the second controller, it records the mapping relationship between the target public IP address (that is, the real public IP address) and the target virtual public IP address; thereafter, the heterogeneous controller can control the third controller to establish the mapping relationship between the target public IP address and the target virtual public IP address.

[0149] After receiving the third creation request, the second controller performs the following configuration: creates a new target virtual public IP address in address segment B, and feeds the target virtual public IP address back to the first controller; when the target public IP address has been bound to the target virtual machine in the first availability zone, the first controller sends a binding request to the second controller, and after receiving the binding request, the second controller assigns a target intermediate address in address segment C to the instance, and the target intermediate address has a one-to-one correspondence with the target virtual public IP address; thereafter, the second controller sends second configuration information to the public network gateway to record the mapping relationship between the target intermediate address and the target virtual public IP address on the public network gateway; and sets the port blocking configuration for the target virtual public IP address based on the target virtual public IP address on the public network gateway (the port corresponding to the target virtual public IP address is set to a blocked state by default).

[0150] like Figure 7As shown, when the user successfully files the target public IP address, the console calls the heterogeneous controller, which queries the virtual public IP address corresponding to the target public IP and sends a port unblocking request to the second controller; the second controller unblocks the port corresponding to the target intermediate address corresponding to the registered target virtual public IP address on the public gateway of the first available zone. At this point, the user instance can provide external services based on the unblocked port.

[0151] In the above application scenario 1, regardless of whether the user instance is in the first availability zone or the second availability zone, port blocking and unblocking can be performed based on their corresponding intermediate addresses, thereby realizing a unified security protection solution in heterogeneous scenarios.

[0152] Application scenario 2:

[0153] Public IP addresses can not only be bound to cloud hosts, but can also be used in NAT rules of NAT gateways, that is, to provide external services by configuring DNAT rules. It should be noted that in the scenario of heterogeneous availability zones, multiple DNAT rules can be configured for the same public IP address, but the backend only supports one availability zone.

[0154] Specifically, Figure 8 As shown in the figure, if the user has registered the target public IP address, then set the DNAT rule. When the corresponding port is in the first available zone, the port unblocking process is as follows:

[0155] S801: Determine whether the FIP (ie, the public IP address) is creating a DNAT rule for the first time; if so, execute S802; otherwise, execute S804.

[0156] It should be noted that if this is not the first time a DNAT rule is created for a public IP address, then when the DNAT rule corresponding to the public IP address was previously created, a corresponding virtual public IP address should have been allocated to the public IP address. Therefore, it is possible to determine whether this is the first time a DNAT rule is created for the target public IP address by determining whether there is a target virtual public IP address corresponding to the target public IP address.

[0157] S802: That is, if it is determined that the target public IP address is creating a DNAT rule for the first time, the first controller (heterogeneous controller) sends a third creation request to the second controller to control the second controller to create a virtual public IP address corresponding to the target public IP address.

[0158] S803: The heterogeneous controller receives the target virtual public IP address corresponding to the target public IP address fed back by the second controller, and saves mapping information between the actual public IP address (ie, the target public IP address) and the target virtual public IP address.

[0159] In addition, the heterogeneous controller will also send the configuration to the third controller to configure the NAT gateway. Specifically, the heterogeneous controller sends the first configuration information to the third controller to indicate the mapping relationship between the target public IP address and the target virtual public IP address. In this way, after the third controller receives the first configuration information, the third controller can send the third configuration information to the NAT gateway to instruct the NAT gateway to configure the mapping relationship between the target public IP address and the target virtual public IP address.

[0160] S804: That is, if it is determined that the target public IP address is not the first time to create a DNAT rule, or the DNAT rule is created for the first time and the target virtual public IP address corresponding to the target public IP address fed back by the second controller has been received, the first controller (heterogeneous controller) sends a second creation request to the second controller to control the second controller to create a DNAT rule corresponding to the target virtual public IP address. In this way, after receiving the second creation request sent by the first controller, the second controller can use the target public IP address to create a target DNAT rule.

[0161] Specifically, after the first controller obtains the first creation request, it modifies the value corresponding to the public IP attribute in the first creation request to the target virtual public IP address, obtains the second creation request, and sends the second creation request to the second controller, which completes the creation of the DNAT rule.

[0162] When the user has registered the target public IP address, the first controller will perform different port unblocking request data encapsulation according to the AZ where the resource (for example, the cloud host) is located. For example, if the resource is in the first available zone, the first controller uses the target virtual public IP address and carries the external port (i.e., the target port) in the DNAT rule to send a port unblocking request to the second controller, so that the second controller notifies the corresponding public gateway to complete the unblocking configuration.

[0163] Application scenario three:

[0164] That is, in the scenario of cloud host migration across AZ or across POD, when the user binds a public IP address to the cloud host and provides specific port services to the outside world, if the user instance needs to be migrated from the second availability zone to the first availability zone, the corresponding unblocking information also needs to be migrated to the first availability zone simultaneously. The heterogeneous controller encapsulates the target virtual public IP address and the registered port information (i.e. the target port information) and sends them to the second controller, completes the unblocking pre-configuration at the public gateway, and saves the unblocking information of the first availability zone (including the target virtual public IP address and the target port information). In addition, the third controller can also control the first SDN gateway in the second availability zone to restore the port blocking of the target public IP address.

[0165] In the security protection method of this embodiment, the heterogeneous first availability zone and the second availability zone share an export router and a NAT gateway to achieve communication with the international Internet. For this scenario, a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone is set on the public network gateway in the first availability zone. In this way, a port unblocking request can be sent to the second controller through the first controller, so that the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation, thereby unblocking the port of the target virtual IP address corresponding to the user instance by the public network gateway in the first availability zone, thereby solving the problem of failure of the public network access policy in the heterogeneous availability zones.

[0166] like Fig. 9 As shown, a security protection method according to an embodiment of the present invention is applied to a second controller, comprising:

[0167] Step 901: receiving a port unblocking request sent by a first controller.

[0168] Step 902: According to the port unblocking request, control the public network gateway in the first availability zone to perform a port unblocking operation, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance; wherein the first controller is used to control the second controller, and the second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0169] Here, combined Figure 4 and Figure 5 A specific embodiment of the present invention is described:

[0170] like Figure 4 As shown, the first availability zone (the availability zone corresponding to manufacturer 2) and the second availability zone (the availability zone corresponding to manufacturer 1, and manufacturer 1 and manufacturer 2 use different SDN solutions) share the same egress router and NAT gateway.

[0171] like Figure 5 As shown, the above-mentioned first controller can specifically be a heterogeneous controller. The first controller can control the second controller and the third controller. The second controller can control the public network gateway (that is, manufacturer 2-public network gateway) and manufacturer 2-SDN gateway (that is, the second SDN gateway) in the first availability zone, and the third controller can control the NAT gateway and manufacturer 1-SDN gateway (that is, the first SDN gateway).

[0172] In this embodiment, after receiving the port unblocking request sent by the first controller, the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation to unblock the port of the target virtual public IP address corresponding to the user instance. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of public network access policies in heterogeneous availability zones.

[0173] In some embodiments, according to the port unblocking request, controlling the public network gateway in the first availability zone to perform a port unblocking operation includes: sending a port unblocking indication to the public network gateway, wherein the port unblocking indication is used to instruct the public network gateway to unblock the port of the target virtual public IP address, or to unblock the port of the target port, wherein the target port is a port that has been successfully registered.

[0174] It should be noted that, when the target public IP address corresponds to the target virtual machine in the first availability zone, the public network gateway unblocks the port of the target virtual public IP address according to the port unblocking indication; when the intranet IP address in the target DNAT rule corresponding to the target public IP address points to the target virtual machine in the first availability zone, the public network gateway unblocks the port of the target port according to the port unblocking indication.

[0175] In some embodiments, the method further includes: receiving a third creation request sent by the first controller, the third creation request being used to request the second controller to create a virtual public IP address corresponding to the target public IP address; based on the third creation request, creating a new target virtual public IP address within a virtual public IP address segment, wherein the virtual public IP address segment is pre-configured for the first availability zone; and sending the target virtual public IP address to the first controller.

[0176] It should be noted that two segments of private network addresses can be preconfigured for the first available zone, namely: a virtual public IP address segment (assuming address segment B) and a preset intermediate address segment (assuming address segment C). It is understandable that both address segment B and address segment C cannot conflict with the private network address reserved for the second available zone (assuming address segment A).

[0177] In this embodiment, after receiving the third creation request sent by the first controller, the second controller can allocate a target virtual public IP address within address segment B so that the first controller can configure the mapping relationship between the target public IP address and the target virtual public IP address on the public gateway in the first availability zone.

[0178] In some embodiments, when the target public IP address is bound to the target virtual machine in the first availability zone, after creating a new target virtual public IP address within the virtual public IP address segment according to the third creation request, the method further includes: creating a new target intermediate address within a preset intermediate address segment, the target intermediate address corresponding one-to-one to the target virtual public IP address, and the preset intermediate address segment is preconfigured for the first availability zone.

[0179] In this embodiment, after allocating the target virtual public IP address, the second controller may also allocate a target intermediate address within address segment C so that the first controller can configure a mapping relationship between the target virtual public IP address and the target intermediate address on the public gateway in the first availability zone.

[0180] In some embodiments, after creating a target intermediate address within the preset intermediate address segment, the method further includes:

[0181] Send second configuration information to the public network gateway, where the second configuration information includes a target intermediate address corresponding to the target virtual public network IP address.

[0182] In this embodiment, the second controller can configure the mapping relationship between the target virtual public IP address and the target intermediate address on the public network gateway of the first availability zone through the second configuration information. After the user records the target public IP address, the first controller sends a port unblocking request to the second controller, requesting the public network gateway to unblock the port of the target virtual public IP address. After receiving the port unblocking request, the second controller will control the public network gateway to perform the port unblocking operation, thereby unblocking the target virtual public IP address on the public network gateway. In this way, on the basis of heterogeneous intercommunication, port blocking and unblocking are implemented on different SDN gateways based on the intermediate address after the public IP address is mapped, thereby realizing unified access protection in heterogeneous scenarios.

[0183] In some embodiments, the method further includes: receiving a second creation request sent by the first controller; creating a target DNAT rule using the target public IP address based on the second creation request, wherein the second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

[0184] It should be noted that when creating the DNAT rule corresponding to the target virtual public IP address, the DNAT rule includes parameters such as the intranet IP and the public IP, wherein the intranet IP points to the target virtual machine in the first availability zone, and the public IP is the target public IP address.

[0185] In the security protection method of this embodiment, the second controller is controlled by the first controller, and can create a virtual public IP address and a target intermediate address corresponding to the target public IP address to realize the three-level mapping of the public IP and realize the blocking of the target virtual public IP address on the public gateway. The second controller can also create a target DNAT rule corresponding to the target virtual public IP address. In this way, after receiving the port unblocking request sent by the first controller, the second controller can control the public gateway in the first availability zone to perform a port unblocking operation to unblock the port of the target virtual public IP address corresponding to the user instance by the public gateway. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of the public access policy in heterogeneous availability zones.

[0186] like Fig.10 As shown, a security protection method is applied to a public network gateway, comprising:

[0187] Step 1001, upon receiving a port unblocking indication sent by the second controller, unblocking the port of the target virtual public IP address or unblocking the port of the target port, wherein the port unblocking indication is used to instruct the public network gateway in the first availability zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a successfully registered port, and the public network gateway stores a mapping relationship between the target virtual public IP address and the target intermediate address; wherein the second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0188] Here, combined Figure 4 and Figure 5 A specific embodiment of the present invention is described:

[0189] like Figure 4 As shown, the first availability zone (the availability zone corresponding to manufacturer 2) and the second availability zone (the availability zone corresponding to manufacturer 1, and manufacturer 1 and manufacturer 2 use different SDN solutions) share the same egress router and NAT gateway.

[0190] like Figure 5 As shown, the above-mentioned first controller can specifically be a heterogeneous controller. The first controller can control the second controller and the third controller. The second controller can control the public network gateway (that is, manufacturer 2-public network gateway) and manufacturer 2-SDN gateway (that is, the second SDN gateway) in the first availability zone, and the third controller can control the NAT gateway and manufacturer 1-SDN gateway (that is, the first SDN gateway).

[0191] In this embodiment, after receiving the port unblocking indication sent by the second controller, the public network gateway can unblock the port according to the port unblocking indication. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of public network access policies in heterogeneous availability zones.

[0192] Optionally, the method further includes: receiving second configuration information sent by the first controller, the second configuration information including a target intermediate address corresponding to the target virtual public IP address; and storing a mapping relationship between the target virtual public IP address and the target intermediate address.

[0193] In this embodiment, after receiving the second configuration information sent by the first controller, the public network gateway can store the mapping relationship between the target virtual public network IP address and the target intermediate address, and then realize the blocking and unblocking of the target virtual public network IP address on the public network gateway through the three-level mapping of the public network IP. In this way, on the basis of heterogeneous intercommunication, based on the intermediate address after the mapping of the public network IP address, port blocking and unblocking are realized on different SDN gateways, realizing unified access protection in heterogeneous scenarios.

[0194] In the security protection method of this embodiment, the mapping relationship between the target virtual public IP address and the target intermediate address is configured on the public network gateway, which can achieve blocking and unblocking of the target virtual public IP address. In this way, the user instance in the first availability zone can provide services to the outside world through the public IP address to which it is bound, solving the problem of invalidation of public network access policies in heterogeneous availability zones.

[0195] like Fig.11 As shown, a security protection method according to an embodiment of the present invention is applied to a third controller, including:

[0196] Step 1101, upon receiving the first configuration information sent by the first controller, sending the third configuration information to the NAT gateway, wherein the first configuration information is used to indicate the mapping relationship between the target public IP address of the user instance and the target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure the mapping relationship between the target public IP address and the target virtual public IP address; wherein the first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

[0197] Here, combined Figure 4 and Figure 5 A specific embodiment of the present invention is described:

[0198] like Figure 4As shown, the first availability zone (the availability zone corresponding to manufacturer 2) and the second availability zone (the availability zone corresponding to manufacturer 1, and manufacturer 1 and manufacturer 2 use different SDN solutions) share the same egress router and NAT gateway. Figure 5 As shown, the above-mentioned first controller can specifically be a heterogeneous controller. The first controller can control the second controller and the third controller. The second controller can control the public network gateway (that is, manufacturer 2-public network gateway) and manufacturer 2-SDN gateway (that is, the second SDN gateway) in the first availability zone, and the third controller can control the NAT gateway and manufacturer 1-SDN gateway (that is, the first SDN gateway).

[0199] In this embodiment, after receiving the first configuration information sent by the first controller, the third controller can configure the mapping relationship between the target public IP address and the target virtual public IP address on the NAT gateway. In this way, the NAT gateway can perform a first-level mapping after the external access traffic (i.e., the first access request) enters, and map the public IP address into a virtual public IP address, that is, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain the first target information, and then the NAT gateway transmits the first target information to the public gateway in the first available zone.

[0200] In some embodiments, the method also includes: receiving second migration indication information sent by the first controller, the second migration indication information is used to indicate that the user instance has migrated out of the second availability zone; controlling the first SDN gateway in the second availability zone to restore port blocking of the target public IP address.

[0201] It should be noted that after the migration of the user instance (such as a cloud host instance) is completed, the third controller will receive the second migration indication information sent by the first controller, thereby knowing that the user instance has migrated out of the second availability zone. At this time, the third controller can control the manufacturer 1-SDN gateway (that is, the first SDN gateway) to restore the port blocking configuration (that is, restore the port blocking of the target public IP address).

[0202] In the security protection method of this embodiment, the third controller can configure the mapping relationship between the target public IP address and the target virtual public IP address in the NAT gateway, so that the NAT gateway can map the public IP address into the virtual public IP address after the external access traffic (i.e., the first access request) enters, and obtain the first target information. Then, the NAT gateway transmits the first target information to the public gateway in the first availability zone to solve the problem of failure of the public access policy in heterogeneous availability zones.

[0203] like Fig.12 As shown, a cloud access method according to an embodiment of the present invention is applied to a NAT gateway, including:

[0204] Step 1201, when a first access request is received, the destination address of the first access request is replaced from the target public IP address to the target virtual public IP address corresponding to the target public IP address, first target information is obtained, and the first target information is transmitted to the public gateway in the first availability zone, the first access request is used to request access to the target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address; wherein the first availability zone and the second availability zone adopt different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet; the first controller is used to control the second controller and the third controller, the second controller is used to control the public gateway, and the third controller is used to control the NAT gateway, and the public gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0205] It should be noted that if Figure 4 As shown, after the cloud access traffic (i.e., the first access request) enters from the egress router, it will be forwarded to the NAT gateway. If the first access request requests access to the target virtual machine in the first availability zone, the NAT gateway performs the first-level mapping, mapping the public IP address to the virtual public IP address, that is, the destination address of the first access request is replaced from the target public IP address to the target virtual public IP address corresponding to the target public IP address, and the information obtained after the replacement is the first target information. Afterwards, the traffic (here refers to the first target information) is directed to the public network gateway in the first availability zone (that is, manufacturer 2-public network gateway) through the underlying routing; manufacturer 2-public network gateway performs a second mapping to map the virtual public network IP address to the intermediate address, that is, the destination address of the first target information is replaced by the target virtual public network IP address to the target intermediate address, and the information obtained after the replacement is the second target information, and then the second target information is directed to the second SDN gateway (that is, manufacturer 2-SDN gateway); after the manufacturer 2-SDN gateway forwards the second target information to the relevant computing node (that is, the computing node corresponding to the target intermediate address), it completes the mapping of the intermediate address to the cloud address on the computing node.

[0206] In addition, here is a brief description of the situation where the cloud access traffic requests to access the target virtual machine in the second availability zone: the cloud access traffic passes through the NAT gateway, and the first-level mapping is completed on the NAT gateway, mapping the public IP address to the intermediate address (that is, the pre-assigned private network address); forwarded from the NAT gateway to the first SDN gateway (that is, the manufacturer 1-SDN gateway, by default, all ports will be blocked based on the intermediate address on the manufacturer 1-SDN gateway); after the user successfully registers the public IP address, the specific port is unblocked on the manufacturer 1-SDN gateway, so that the cloud can access the user's specific services; then, the manufacturer 1-SDN gateway diverts the traffic to the computing node, and completes the conversion of the intermediate address to the VPC in the cloud on the distributed virtual router on the computing node. In this way, the second availability zone realizes access to the cloud through two-level mapping of public IP addresses.

[0207] In the cloud access method of this embodiment, the NAT gateway can perform the first-level mapping after the external access traffic (i.e., the first access request) enters, and maps the public IP address to the virtual public IP address, that is, replaces the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, and obtains the first target information, and then the NAT gateway transmits the first target information to the public gateway in the first available zone. In this way, the public gateway performs the second mapping, mapping the virtual public IP address to the intermediate address, that is, replacing the destination address of the first target information from the target virtual public IP address to the target intermediate address, and the information obtained after the replacement is the second target information, and then the second target information is directed to the second SDN gateway (i.e., the manufacturer 2-SDN gateway); after the manufacturer 2-SDN gateway forwards the second target information to the relevant computing node (i.e., the computing node corresponding to the target intermediate address), it completes the mapping of the intermediate address to the cloud address on the computing node, and finally realizes cloud access.

[0208] like Fig.13 As shown, a cloud access method according to an embodiment of the present invention is applied to a public network gateway, including:

[0209] Step 1301, when first target information is received, the destination address of the first target information is replaced by the target virtual public network IP address with the target intermediate address to obtain second target information;

[0210] Step 1302: forward the second target information to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

[0211] In the cloud access method of this embodiment, when the public network gateway in the first availability zone (that is, manufacturer 2-public network gateway) receives the first target information, it maps the virtual public network IP address to the intermediate address, that is, the destination address of the first target information is replaced by the target virtual public network IP address to the target intermediate address, and the information obtained after the replacement is the second target information, and then the second target information is forwarded to the second SDN gateway (that is, manufacturer 2-SDN gateway); after the manufacturer 2-SDN gateway forwards the second target information to the relevant computing node (that is, the computing node corresponding to the target intermediate address), the mapping of the intermediate address to the cloud address is completed on the computing node.

[0212] like Figure 4 As shown, a network architecture of an embodiment of the present invention includes:

[0213] The first availability zone (the availability zone corresponding to manufacturer 2) includes the second SDN gateway and the public network gateway;

[0214] The second availability zone (the availability zone corresponding to manufacturer 1, and manufacturer 1 and manufacturer 2 use different SDN solutions) adopts a different SDN structure from the first availability zone, and the second availability zone includes a first SDN gateway;

[0215] A first switch, a NAT gateway and an egress router, wherein the first switch is respectively connected to the first SDN gateway, the second SDN gateway, the public network gateway, the NAT gateway and the egress router, the egress router is connected to the Internet, and the second availability zone and the first availability zone both communicate with the Internet via the egress router;

[0216] A first controller, a second controller and a third controller, wherein the first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway and the second SDN gateway, and the third controller is used to control the NAT gateway and the first SDN gateway.

[0217] It should be noted that a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone is set on the public network gateway in the first availability zone.

[0218] like Figure 4 As shown, the first switch mentioned above may specifically be a north-south convergence switch. Figure 5 As shown, the first controller can specifically be a heterogeneous controller. The first controller can control the second controller and the third controller. The second controller can control the public network gateway (that is, manufacturer 2-public network gateway) and manufacturer 2-SDN gateway (that is, the second SDN gateway) in the first availability zone, and the third controller can control the NAT gateway and manufacturer 1-SDN gateway (that is, the first SDN gateway).

[0219] In some embodiments, the first availability zone is configured with a virtual public IP address segment and a preset intermediate address segment.

[0220] It should be noted that two segments of private network addresses can be preconfigured for the first available zone, namely: a virtual public IP address segment (assuming address segment B) and a preset intermediate address segment (assuming address segment C). It is understandable that both address segment B and address segment C cannot conflict with the private network address reserved for the second available zone (assuming address segment A).

[0221] In the network architecture of this embodiment, the heterogeneous first availability zone and the second availability zone share an egress router and a NAT gateway to achieve communication with the Internet. For this scenario, a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone can be set on the public network gateway in the first availability zone. In this way, the problem of failure of public network access policy in heterogeneous availability zones can be solved on the basis of heterogeneous intercommunication.

[0222] like Fig.14 As shown, a safety protection device according to an embodiment of the present invention is applied to a first controller, comprising:

[0223] A first blocking module 1410 is used to send a port unblocking request to the second controller when the first condition is met, wherein the port unblocking request is used to request to release the port blocking of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone;

[0224] The first condition includes at least one of the following:

[0225] The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone;

[0226] The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone;

[0227] The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet;

[0228] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0229] In this embodiment, the heterogeneous first availability zone and second availability zone share an export router and a NAT gateway to achieve communication with the international Internet. For this scenario, a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone is set on the public network gateway in the first availability zone. In this way, a port unblocking request can be sent to the second controller through the first controller, so that the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation, thereby unblocking the port of the target virtual IP address corresponding to the user instance by the public network gateway in the first availability zone, thereby solving the problem of failure of the public network access policy in the heterogeneous availability zones.

[0230] Optionally, the device further comprises:

[0231] A first acquisition module is used to send a second creation request to the second controller when the first creation request and the target virtual public IP address corresponding to the target public IP address are acquired;

[0232] The first creation request is used to request the creation of a DNAT rule corresponding to the target public IP address;

[0233] The second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

[0234] Optionally, the device further comprises:

[0235] A second sending module, configured to send a third creation request to the second controller when the second condition is met, wherein the third creation request is used to request the second controller to create a virtual public IP address corresponding to the target public IP address;

[0236] A first receiving module, configured to receive a target virtual public IP address corresponding to the target public IP address fed back by the second controller;

[0237] A first storage module, used to store the mapping relationship between the target public IP address and the target virtual public IP address;

[0238] The second condition includes at least one of the following:

[0239] A first creation request is received and a target virtual public IP address corresponding to the target public IP address is not obtained;

[0240] Receiving binding indication information, where the binding indication information is used to indicate that the target public network IP address has been bound to the target virtual machine in the first availability zone;

[0241] First migration indication information is received, where the first migration indication information is used to indicate that the user instance will be migrated from the second availability zone to the first availability zone.

[0242] Optionally, the device further comprises:

[0243] The third sending module is used to send first configuration information to the third controller, where the first configuration information is used to indicate a mapping relationship between the target public IP address and the target virtual public IP address.

[0244] Optionally, the device further comprises:

[0245] The fourth sending module is used to send second migration indication information to the third controller after the user instance is migrated from the second availability zone to the first availability zone, where the second migration indication information is used to indicate that the user instance has been migrated out of the second availability zone.

[0246] Optionally, the target virtual public IP address corresponds one-to-one to the target intermediate address, and the target intermediate address is created by the second controller.

[0247] It should be noted here that the above-mentioned security protection device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the first controller, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0248] like Fig.15 As shown, a safety protection device according to an embodiment of the present invention is applied to a second controller, comprising:

[0249] The third receiving module 1510 is used to receive a port unblocking request sent by the first controller;

[0250] A first control module 1520 is used to control the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance;

[0251] Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0252] In this embodiment, after receiving the port unblocking request sent by the first controller, the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation to unblock the port of the target virtual public IP address corresponding to the user instance. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of public network access policies in heterogeneous availability zones.

[0253] Optionally, the first control module 1520 includes:

[0254] The first sending submodule is used to send a port unblocking indication to the public network gateway, and the port unblocking indication is used to instruct the public network gateway to unblock the port of the target virtual public IP address, or to unblock the port of the target port, and the target port is a port that has been successfully registered.

[0255] Optionally, the device further comprises:

[0256] a fourth receiving module, configured to receive a third creation request sent by the first controller, wherein the third creation request is used to request the second controller to create a virtual public IP address corresponding to the target public IP address;

[0257] A first creation module, configured to create, according to the third creation request, a target virtual public IP address within a virtual public IP address segment, wherein the virtual public IP address segment is preconfigured for the first availability zone;

[0258] A fifth sending module is used to send the target virtual public IP address to the first controller.

[0259] Optionally, the device further comprises:

[0260] The first allocation module is used to create a new target intermediate address located in a preset intermediate address segment, the target intermediate address corresponds to the target virtual public IP address one by one, and the preset intermediate address segment is preconfigured for the first available zone.

[0261] Optionally, after creating a new target intermediate address within the preset intermediate address segment, the device further includes:

[0262] The seventh sending module is used to send second configuration information to the public network gateway, where the second configuration information includes a target intermediate address corresponding to the target virtual public network IP address.

[0263] Optionally, the device further comprises:

[0264] A fifth receiving module, configured to receive a second creation request sent by the first controller;

[0265] The second creation module is used to create a target DNAT rule using the target public IP address according to the second creation request, and the second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

[0266] It should be noted here that the above-mentioned security protection device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the second controller, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0267] like Fig.16 As shown, a security protection device according to an embodiment of the present invention is applied to a public network gateway, including:

[0268] The unblocking module 1610 is used to unblock the port of the target virtual public IP address or unblock the port of the target port when receiving the port unblocking instruction sent by the second controller, wherein the port unblocking instruction is used to instruct the public network gateway in the first available zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a port that has been successfully registered, and the mapping relationship between the target virtual public IP address and the target intermediate address is stored on the public network gateway;

[0269] The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

[0270] In this embodiment, after receiving the port unblocking indication sent by the second controller, the public network gateway can unblock the port according to the port unblocking indication. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of public network access policies in heterogeneous availability zones.

[0271] Optionally, the device further comprises:

[0272] a sixth receiving module, configured to receive second configuration information sent by the first controller, wherein the second configuration information includes a target intermediate address corresponding to the target virtual public IP address;

[0273] The second storage module is used to store the mapping relationship between the target virtual public IP address and the target intermediate address.

[0274] It should be noted here that the above-mentioned security protection device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the public network gateway, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0275] like Fig.17 As shown, a safety protection device according to an embodiment of the present invention is applied to a third controller, comprising:

[0276] The first sending module 1710 is used to send third configuration information to the NAT gateway when receiving the first configuration information sent by the first controller, wherein the first configuration information is used to indicate the mapping relationship between the target public IP address of the user instance and the target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure the mapping relationship between the target public IP address and the target virtual public IP address;

[0277] The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

[0278] In this embodiment, after receiving the first configuration information sent by the first controller, the third controller can configure the mapping relationship between the target public IP address and the target virtual public IP address on the NAT gateway. In this way, the NAT gateway can perform a first-level mapping after the external access traffic (i.e., the first access request) enters, and map the public IP address into a virtual public IP address, that is, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain the first target information, and then the NAT gateway transmits the first target information to the public gateway in the first available zone.

[0279] Optionally, the device further comprises:

[0280] a seventh receiving module, configured to receive second migration indication information sent by the first controller, where the second migration indication information is used to indicate that the user instance has been migrated out of the second availability zone;

[0281] The second control module is used to control the first SDN gateway in the second available zone to resume port blocking of the target public IP address.

[0282] It should be noted here that the above-mentioned security protection device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the third controller, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0283] like Fig.18 As shown, a cloud access device according to an embodiment of the present invention is applied to a NAT gateway, including:

[0284] The first processing module 1810 is used to, when receiving a first access request, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain first target information, and transmit the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address;

[0285] The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet;

[0286] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0287] It should be noted here that the above-mentioned cloud access device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned cloud access method embodiment applied to the NAT gateway, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0288] like Fig.19 As shown, a cloud access device according to an embodiment of the present invention is applied to a public network gateway, including:

[0289] The second processing module 1910 is used to replace the destination address of the first target information from the target virtual public network IP address to the target intermediate address to obtain the second target information when the first target information is received;

[0290] The third processing module 1920 is used to forward the second target information to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

[0291] It should be noted here that the above-mentioned cloud access device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned cloud access method embodiment applied to the public network gateway, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0292] like Fig. 20 As shown, a device 2000 according to an embodiment of the present invention is a first controller, including a processor 2010 and a transceiver 2020, wherein the transceiver 2020 is used to:

[0293] When the first condition is met, a port unblocking request is sent to the second controller, where the port unblocking request is used to request to unblock the port of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone;

[0294] The first condition includes at least one of the following:

[0295] The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone;

[0296] The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone;

[0297] The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet;

[0298] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0299] In this embodiment, the heterogeneous first availability zone and second availability zone share an export router and a NAT gateway to achieve communication with the international Internet. For this scenario, a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone is set on the public network gateway in the first availability zone. In this way, a port unblocking request can be sent to the second controller through the first controller, so that the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation, thereby unblocking the port of the target virtual IP address corresponding to the user instance by the public network gateway in the first availability zone, thereby solving the problem of failure of the public network access policy in the heterogeneous availability zones.

[0300] Optionally, the transceiver 2020 is further used for:

[0301] When the first creation request and the target virtual public IP address corresponding to the target public IP address are obtained, sending a second creation request to the second controller;

[0302] The first creation request is used to request the creation of a DNAT rule corresponding to the target public IP address;

[0303] The second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

[0304] Optionally, the transceiver 2020 is further used to: send a third creation request to the second controller when the second condition is met, wherein the third creation request is used to request the second controller to create a virtual public IP address corresponding to the target public IP address; and receive a target virtual public IP address corresponding to the target public IP address fed back by the second controller;

[0305] The processor 2010 is further configured to store a mapping relationship between the target public IP address and the target virtual public IP address;

[0306] The second condition includes at least one of the following:

[0307] A first creation request is received and a target virtual public IP address corresponding to the target public IP address is not obtained;

[0308] Receiving binding indication information, where the binding indication information is used to indicate that the target public network IP address has been bound to the target virtual machine in the first availability zone;

[0309] First migration indication information is received, where the first migration indication information is used to indicate that the user instance will be migrated from the second availability zone to the first availability zone.

[0310] Optionally, before storing the mapping relationship between the target public IP address and the target virtual public IP address, the transceiver 2020 is further used to:

[0311] Sending first configuration information to the third controller, where the first configuration information is used to indicate a mapping relationship between the target public IP address and the target virtual public IP address.

[0312] Optionally, the transceiver 2020 is further used for:

[0313] After the user instance is migrated from the second availability zone to the first availability zone, second migration indication information is sent to a third controller, where the second migration indication information is used to indicate that the user instance has been migrated out of the second availability zone.

[0314] Optionally, the target virtual public IP address corresponds one-to-one to the target intermediate address, and the target intermediate address is created by the second controller.

[0315] It should be noted here that the above-mentioned device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the first controller, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0316] A device according to an embodiment of the present invention is a second controller, and its structure can be as follows: Fig. 20 The structure shown is the same as that of the first controller, including a processor and a transceiver, wherein the transceiver is used to receive a port unblocking request sent by the first controller;

[0317] The processor is used to control the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance;

[0318] Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0319] In this embodiment, after receiving the port unblocking request sent by the first controller, the second controller can control the public network gateway in the first availability zone to perform a port unblocking operation to unblock the port of the target virtual public IP address corresponding to the user instance. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of public network access policies in heterogeneous availability zones.

[0320] Optionally, when the processor controls the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, the processor is specifically configured to:

[0321] A port unblocking indication is sent to the public network gateway, where the port unblocking indication is used to instruct the public network gateway to unblock the port of the target virtual public IP address, or to unblock the port of the target port, where the target port is a port that has been successfully registered.

[0322] Optionally, the transceiver is further used to receive a third creation request sent by the first controller, where the third creation request is used to request the second controller to create a virtual public IP address corresponding to the target public IP address;

[0323] The processor is further configured to create, according to the third creation request, a target virtual public IP address within a virtual public IP address segment, wherein the virtual public IP address segment is preconfigured for the first availability zone;

[0324] The transceiver is also used to send the target virtual public network IP address to the first controller.

[0325] Optionally, when the target public IP address has been bound to the target virtual machine in the first availability zone, after creating a new target virtual public IP address within the virtual public IP address segment according to the third creation request, the processor is further used to create a new target intermediate address within a preset intermediate address segment, the target intermediate address corresponding one-to-one to the target virtual public IP address, and the preset intermediate address segment is preconfigured for the first availability zone.

[0326] Optionally, after creating a new target intermediate address within a preset intermediate address segment, the processor is further configured to:

[0327] Send second configuration information to the public network gateway, where the second configuration information includes a target intermediate address corresponding to the target virtual public network IP address.

[0328] Optionally, the transceiver is further used to receive a second creation request sent by the first controller;

[0329] The processor is further configured to create a target DNAT rule using the target public IP address according to the second creation request, wherein the second creation request is configured to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

[0330] It should be noted here that the above-mentioned device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the second controller, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0331] A device in an embodiment of the present invention is a public network gateway, and its structure can be as follows: Fig. 20 The structure shown is the same as the first controller, including a processor and a transceiver, wherein the processor is used to:

[0332] Upon receiving the port unblocking indication sent by the second controller, unblocking the port of the target virtual public IP address or unblocking the port of the target port, wherein the port unblocking indication is used to instruct the public network gateway in the first availability zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a port that has been successfully registered, and the mapping relationship between the target virtual public IP address and the target intermediate address is stored on the public network gateway;

[0333] The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

[0334] In this embodiment, after receiving the port unblocking indication sent by the second controller, the public network gateway can unblock the port according to the port unblocking indication. In this way, the user instance in the first availability zone can provide services to the outside through the public IP address to which it is bound, thereby solving the problem of failure of public network access policies in heterogeneous availability zones.

[0335] Optionally, the transceiver is used to receive second configuration information sent by the first controller, where the second configuration information includes a target intermediate address corresponding to the target virtual public network IP address;

[0336] The processor is further configured to store a mapping relationship between the target virtual public IP address and the target intermediate address.

[0337] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned security protection method embodiment applied to the public network gateway, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0338] A device according to an embodiment of the present invention is a third controller, and its structure can be as follows: Fig. 20 The structure shown is the same as the first controller, including a processor and a transceiver, wherein the transceiver is used to send third configuration information to the NAT gateway when receiving the first configuration information sent by the first controller, the first configuration information is used to indicate the mapping relationship between the target public IP address of the user instance and the target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure the mapping relationship between the target public IP address and the target virtual public IP address;

[0339] The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

[0340] In this embodiment, after receiving the first configuration information sent by the first controller, the third controller can configure the mapping relationship between the target public IP address and the target virtual public IP address on the NAT gateway. In this way, the NAT gateway can perform a first-level mapping after the external access traffic (i.e., the first access request) enters, and map the public IP address into a virtual public IP address, that is, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain the first target information, and then the NAT gateway transmits the first target information to the public gateway in the first available zone.

[0341] Optionally, the transceiver is further used to receive second migration indication information sent by the first controller, where the second migration indication information is used to indicate that the user instance has been migrated out of the second available zone;

[0342] The processor is used to control the first SDN gateway in the second available zone to resume port blocking of the target public network IP address.

[0343] It should be noted here that the above-mentioned device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned security protection method embodiment applied to the third controller, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0344] A device according to an embodiment of the present invention is a NAT gateway, and its structure can be as follows: Fig. 20The structure shown is the same as the first controller, including a processor and a transceiver, wherein the processor is used to replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain first target information, and transmit the first target information to the public gateway in the first availability zone, the first access request is used to request access to the target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address;

[0345] The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet;

[0346] The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

[0347] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned cloud access method embodiment applied to the NAT gateway, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0348] A device in an embodiment of the present invention is a public network gateway, and its structure can be as follows: Fig. 20 The structure shown is the same as the first controller, including a processor and a transceiver, wherein the processor is used to:

[0349] When the first target information is received, the destination address of the first target information is replaced by the target virtual public network IP address with the target intermediate address to obtain the second target information;

[0350] The second target information is forwarded to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

[0351] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned cloud access method embodiment applied to the public network gateway, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be specifically repeated here.

[0352] A device according to another embodiment of the present invention, such as Fig.21 As shown, it includes a transceiver 2110, a processor 2100, a memory 2120, and a program or instruction stored in the memory 2120 and executable on the processor 2100; when the processor 2100 executes the program or instruction, it implements the above-mentioned security protection method applied to the first controller, or implements the above-mentioned security protection method applied to the second controller, or implements the above-mentioned security protection method applied to the public network gateway, or implements the above-mentioned security protection method applied to the third controller, or implements the above-mentioned cloud access method applied to the NAT gateway, or implements the above-mentioned cloud access method applied to the public network gateway.

[0353] The transceiver 2110 is used to receive and send data under the control of the processor 2100.

[0354] Among them, Fig.21 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 2100 and various circuits of memory represented by memory 2120 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 2110 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 2100 is responsible for managing the bus architecture and general processing, and the memory 2120 may store data used by the processor 2100 when performing operations.

[0355] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above Figure 3 or Figure 9-13 The various processes of any of the method embodiments shown in the drawings can achieve the same technical effect, and to avoid repetition, they will not be described again here.

[0356] A computer-readable storage medium according to an embodiment of the present invention stores a program or instruction thereon, and when the program or instruction is executed by a processor, the steps in the above-mentioned method XX are implemented, and the same technical effect can be achieved. To avoid repetition, it is not described here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0357] It should be further explained that the terminals described in this specification include but are not limited to smart phones, tablet computers, etc., and many of the functional components described are called modules in order to more particularly emphasize the independence of their implementation methods.

[0358] In the embodiment of the present invention, module can be implemented with software so that it can be executed by various types of processors. For example, an executable code module of an identification can include one or more physical or logical blocks of computer instructions, for example, it can be constructed as an object, process or function. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different positions, and when these instructions are logically combined together, it constitutes a module and realizes the specified purpose of the module.

[0359] In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed among different programs, and distributed across a plurality of memory devices. Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form. The operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

[0360] When a module can be implemented by software, considering the level of existing hardware technology, a person skilled in the art can build a corresponding hardware circuit to implement the corresponding function of the module that can be implemented by software without considering the cost. The hardware circuit includes a conventional very large scale integration (VLSI) circuit or gate array and existing semiconductors such as logic chips, transistors, or other discrete components. The module can also be implemented by a programmable hardware device, such as a field programmable gate array, a programmable array logic, a programmable logic device, etc.

[0361] The above exemplary embodiments are described with reference to the accompanying drawings, and many different forms and embodiments are feasible without departing from the spirit and teachings of the present invention. Therefore, the present invention should not be constructed as a limitation of the exemplary embodiments proposed herein. More specifically, these exemplary embodiments are provided so that the present invention will be perfect and complete, and the scope of the present invention will be conveyed to those who are familiar with the technology. In these figures, the component sizes and relative sizes may be exaggerated for clarity. The terms used here are only based on the purpose of describing specific exemplary embodiments and are not intended to be limiting. As used herein, unless the text clearly indicates otherwise, the singular forms "one", "an" and "the" are intended to include these multiple forms. It will be further understood that the terms "including" and / or "comprising" when used in this specification indicate the presence of the features, integers, steps, operations, components and / or components, but do not exclude the presence or increase of one or more other features, integers, steps, operations, components, components and / or their groups. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of that range and any subranges therebetween.

[0362] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A safety protection method, characterized in that: Applied to the first controller, comprising: When the first condition is met, a port unblocking request is sent to the second controller, where the port unblocking request is used to request to unblock the port of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone; The first condition includes at least one of the following: The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone; The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone; The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet; The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

2. The method according to claim 1, characterized in that: The method further comprises: When the first creation request and the target virtual public IP address corresponding to the target public IP address are obtained, sending a second creation request to the second controller; The first creation request is used to request the creation of a DNAT rule corresponding to the target public IP address; The second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: If the second condition is met, sending a third creation request to the second controller, wherein the third creation request is used to request the second controller to create a virtual public IP address corresponding to the target public IP address; Receive a target virtual public IP address corresponding to the target public IP address fed back by the second controller; Storing the mapping relationship between the target public IP address and the target virtual public IP address; The second condition includes at least one of the following: A first creation request is received and a target virtual public IP address corresponding to the target public IP address is not obtained; Receiving binding indication information, where the binding indication information is used to indicate that the target public network IP address has been bound to the target virtual machine in the first availability zone; First migration indication information is received, where the first migration indication information is used to indicate that the user instance will be migrated from the second availability zone to the first availability zone.

4. The method according to claim 3, characterized in that Before storing the mapping relationship between the target public IP address and the target virtual public IP address, the method further includes: Sending first configuration information to the third controller, where the first configuration information is used to indicate a mapping relationship between the target public IP address and the target virtual public IP address.

5. The method according to claim 1, characterized in that The method further comprises: After the user instance is migrated from the second availability zone to the first availability zone, second migration indication information is sent to a third controller, where the second migration indication information is used to indicate that the user instance has been migrated out of the second availability zone.

6. The method according to claim 1, characterized in that The target virtual public IP address corresponds one-to-one to the target intermediate address, and the target intermediate address is created by the second controller.

7. A safety protection method, characterized in that: Applicable to the second controller, including: receiving a port unblocking request sent by the first controller; According to the port unblocking request, control the public network gateway in the first available zone to perform a port unblocking operation, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance; Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

8. The method according to claim 7, characterized in that According to the port unblocking request, controlling the public network gateway in the first available zone to perform a port unblocking operation includes: A port unblocking indication is sent to the public network gateway, where the port unblocking indication is used to instruct the public network gateway to unblock the port of the target virtual public network IP address, or to unblock the port of the target port, where the target port is a port that has been successfully registered.

9. The method according to claim 7 or 8, characterized in that: The method further comprises: Receive a third creation request sent by the first controller, where the third creation request is used to request the second controller to create a virtual public IP address corresponding to the target public IP address; Creating, according to the third creation request, a target virtual public IP address within a virtual public IP address segment that is preconfigured for the first availability zone; Send the target virtual public IP address to the first controller.

10. The method according to claim 9, characterized in that In a case where the target public IP address has been bound to the target virtual machine in the first available zone, after creating a new target virtual public IP address in the virtual public IP address segment according to the third creation request, the method further includes: A new target intermediate address is created within a preset intermediate address segment, the target intermediate address corresponds one-to-one with the target virtual public IP address, and the preset intermediate address segment is preconfigured for the first available zone.

11. The method according to claim 10, characterized in that After creating a target intermediate address within the preset intermediate address segment, the method further includes: Send second configuration information to the public network gateway, where the second configuration information includes a target intermediate address corresponding to the target virtual public network IP address.

12. The method according to claim 7, characterized in that The method further comprises: receiving a second creation request sent by the first controller; According to the second creation request, a target DNAT rule is created using the target public IP address, and the second creation request is used to request the second controller to create a DNAT rule corresponding to the target virtual public IP address.

13. A safety protection method, characterized in that: Applicable to public network gateways, including: Upon receiving the port unblocking indication sent by the second controller, unblocking the port of the target virtual public IP address or unblocking the port of the target port, wherein the port unblocking indication is used to instruct the public network gateway in the first availability zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a port that has been successfully registered, and the mapping relationship between the target virtual public IP address and the target intermediate address is stored on the public network gateway; The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

14. The method according to claim 13, characterized in that The method further comprises: Receive second configuration information sent by the first controller, where the second configuration information includes a target intermediate address corresponding to the target virtual public IP address; The mapping relationship between the target virtual public IP address and the target intermediate address is stored.

15. A safety protection method, characterized in that: Applicable to the third controller, including: Upon receiving the first configuration information sent by the first controller, sending third configuration information to the NAT gateway, wherein the first configuration information is used to indicate a mapping relationship between a target public IP address of the user instance and a target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure a mapping relationship between the target public IP address and the target virtual public IP address; The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

16. The method according to claim 15, characterized in that The method further comprises: receiving second migration indication information sent by the first controller, where the second migration indication information is used to indicate that the user instance has been migrated out of the second availability zone; Control the first SDN gateway in the second available zone to resume port blocking for the target public network IP address.

17. A cloud access method, characterized in that: Applicable to NAT gateway, including: When receiving a first access request, replacing the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtaining first target information, and transmitting the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address; The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet; The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

18. A cloud access method, characterized in that: Applicable to public network gateways, including: When the first target information is received, the destination address of the first target information is replaced by the target virtual public network IP address with the target intermediate address to obtain the second target information; The second target information is forwarded to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

19. A network architecture, characterized in that: include: The first availability zone includes the second SDN gateway and the public network gateway; A second availability zone adopts a different SDN structure from the first availability zone, and the second availability zone includes a first SDN gateway; A first switch, a NAT gateway and an egress router, wherein the first switch is respectively connected to the first SDN gateway, the second SDN gateway, the public network gateway, the NAT gateway and the egress router, the egress router is connected to the Internet, and the second availability zone and the first availability zone both communicate with the Internet via the egress router; A first controller, a second controller and a third controller, wherein the first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway and the second SDN gateway, and the third controller is used to control the NAT gateway and the first SDN gateway.

20. The network architecture according to claim 19, characterized in that: The first available zone is configured with a virtual public IP address segment and a preset intermediate address segment.

21. A safety protection device, characterized in that: Applied to the first controller, comprising: A first blocking module, configured to send a port unblocking request to the second controller when a first condition is met, wherein the port unblocking request is used to request to release the port blocking of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone; The first condition includes at least one of the following: The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone; The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone; The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet; The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

22. A safety protection device, characterized in that: Applicable to the second controller, including: A third receiving module, configured to receive a port unblocking request sent by the first controller; A first control module, configured to control the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance; Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

23. A safety protection device, characterized in that: Applicable to public network gateways, including: an unblocking module, configured to unblock the port of the target virtual public IP address or the target port upon receiving a port unblocking indication sent by the second controller, wherein the port unblocking indication is used to instruct the public network gateway in the first available zone to unblock the port of the target virtual public IP address or the target port, the target port being a port that has been successfully filed, and the public network gateway storing a mapping relationship between the target virtual public IP address and the target intermediate address; The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

24. A safety protection device, characterized in that: Applicable to the third controller, including: A first sending module is used to send third configuration information to the NAT gateway when receiving the first configuration information sent by the first controller, wherein the first configuration information is used to indicate a mapping relationship between a target public IP address of the user instance and a target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure a mapping relationship between the target public IP address and the target virtual public IP address; The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

25. A cloud access device, characterized in that: Applicable to NAT gateway, including: A first processing module is used to, upon receiving a first access request, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain first target information, and transmit the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address; The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet; The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

26. A cloud access device, characterized in that: Applicable to public network gateways, including: A second processing module is used to replace the destination address of the first target information from the target virtual public network IP address to the target intermediate address when receiving the first target information, so as to obtain the second target information; The third processing module is used to forward the second target information to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

27. A device, the device being a first controller, characterized in that: include: A transceiver and a processor; the transceiver is used to: When the first condition is met, a port unblocking request is sent to the second controller, where the port unblocking request is used to request to unblock the port of the target virtual public Internet Protocol IP address corresponding to the user instance by the public network gateway in the first availability zone; The first condition includes at least one of the following: The target public IP address of the user instance is successfully registered and corresponds to the target virtual machine in the first availability zone; The target public IP address of the user instance is successfully registered, and in the target destination address conversion DNAT rule corresponding to the target public IP address, the intranet IP address points to the target virtual machine in the first availability zone; The first availability zone and the second availability zone use different software defined network (SDN) structures, and share an egress router and a network address translation (NAT) gateway with the second availability zone to achieve communication with the Internet; The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

28. A device, the device being a second controller, characterized in that: include: transceivers and processors; The transceiver is used to receive a port unblocking request sent by the first controller; The processor is used to control the public network gateway in the first available zone to perform a port unblocking operation according to the port unblocking request, wherein the port unblocking request is used to request the public network gateway to unblock the port of the target virtual public IP address corresponding to the user instance; Among them, the first controller is used to control the second controller, and the second controller is used to control the public network gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

29. A device, the device being a public network gateway, characterized in that: include: transceivers and processors; The processor is used to: Upon receiving the port unblocking indication sent by the second controller, unblocking the port of the target virtual public IP address or unblocking the port of the target port, wherein the port unblocking indication is used to instruct the public network gateway in the first availability zone to unblock the port of the target virtual public IP address or unblock the port of the target port, the target port is a port that has been successfully registered, and the mapping relationship between the target virtual public IP address and the target intermediate address is stored on the public network gateway; The second controller is used to control the public network gateway, and the public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first available zone.

30. A device, the device being a third controller, characterized in that: include: transceivers and processors; The transceiver is used to send third configuration information to the NAT gateway when receiving the first configuration information sent by the first controller, wherein the first configuration information is used to indicate the mapping relationship between the target public IP address of the user instance and the target virtual public IP address, and the third configuration information is used to instruct the NAT gateway to configure the mapping relationship between the target public IP address and the target virtual public IP address; The first controller is used to control the third controller, and the third controller is used to control the NAT gateway.

31. A device, the device being a NAT gateway, characterized in that: include: transceivers and processors; The processor is used to, upon receiving a first access request, replace the destination address of the first access request from the target public IP address to the target virtual public IP address corresponding to the target public IP address, obtain first target information, and transmit the first target information to a public gateway in a first availability zone, wherein the first access request is used to request access to a target virtual machine in the first availability zone, and the NAT gateway is configured with a mapping relationship between the target public IP address and the target virtual public IP address; The first availability zone and the second availability zone use different SDN structures, and share an egress router and the NAT gateway with the second availability zone to achieve communication with the Internet; The first controller is used to control the second controller and the third controller, the second controller is used to control the public network gateway, and the third controller is used to control the NAT gateway. The public network gateway is provided with a port blocking policy for the virtual public IP address corresponding to the public IP address bound to the virtual machine in the first availability zone.

32. A device, the device being a public network gateway, characterized in that: include: transceivers and processors; The processor is used to: When the first target information is received, the destination address of the first target information is replaced by the target virtual public network IP address with the target intermediate address to obtain the second target information; The second target information is forwarded to the second SDN gateway in the first availability zone, so that the second SDN gateway forwards the second target information to the computing node corresponding to the target intermediate address, and the virtual router on the computing node replaces the destination address of the second target information from the target intermediate address to the private address corresponding to the target virtual machine, and the public network gateway is configured with a mapping relationship between the target virtual public IP address and the target intermediate address.

33. An apparatus comprising: A transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; characterized in that when the processor executes the program or instruction, it implements the security protection method as described in any one of claims 1 to 6, or implements the security protection method as described in any one of claims 7 to 12, or implements the security protection method as described in any one of claims 13 to 14, or implements the security protection method as described in any one of claims 15 to 16, or implements the cloud access method as described in claim 17, or implements the cloud access method as described in claim 18.

34. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the security protection method as described in any one of claims 1 to 6, or implement the steps of the security protection method as described in any one of claims 7 to 12, or implement the steps of the security protection method as described in any one of claims 13 to 14, or implement the steps of the security protection method as described in any one of claims 15 to 16, or implement the steps of the cloud access method as described in claim 17, or implement the steps of the cloud access method as described in claim 18.

35. A readable storage medium having a program or instruction stored thereon, characterized in that: When the program or instruction is executed by the processor, it implements the steps in the security protection method as described in any one of claims 1 to 6, or the steps in the security protection method as described in any one of claims 7 to 12, or the steps in the security protection method as described in any one of claims 13 to 14, or the steps in the security protection method as described in any one of claims 15 to 16, or the steps in the cloud access method as described in claim 17, or the steps in the cloud access method as described in claim 18.

Images