Resource access method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a resource access method and device, computer equipment, a readable storage medium and a program product, and relates to the field of cloud networks. The method comprises the following steps: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and a resource access rule of the target object; based on the rule identifier of the resource access rule, packaging the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result of the target object. By adopting the method, the limitation during resource access can be reduced.

Description

Technical Field

[0001] The present application relates to the field of cloud networks, and in particular to a resource access method, apparatus, computer equipment, readable storage medium, and program product. Background Art

[0002] In the cloud network environment, there will be cloud tenant objects to rent resources and services in the cloud network. In this process, the cloud network also needs to access the resources of the tenant objects accordingly in order to make reasonable resource allocation and provide better cloud services.

[0003] Currently, data exchange and resource sharing between cloud networks and tenant objects are usually achieved by creating peer-to-peer connections between them. However, peer-to-peer connections have many restrictions, such as the inability to have overlapping network segments between the two parties. For example, if a cloud network wants to access resources of multiple tenants, it needs to create multiple peer-to-peer connections and configure multiple routes. As a result, the current cloud network has certain limitations when it comes to resource access to tenant objects. Summary of the invention

[0004] Based on this, it is necessary to provide a resource access method, apparatus, computer device, computer-readable storage medium and computer program product that can reduce the limitations of resource access in order to address the above technical problems.

[0005] In a first aspect, the present application provides a resource access method, comprising: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and a resource access rule for the target object; based on a rule identifier of the resource access rule, encapsulating the resource access information to obtain a resource access message for the target object; performing resource access on the target object according to the resource access message to obtain a resource access result for the target object.

[0006] In one of the embodiments, based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object, including: based on the rule identifier of the resource access rule, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message; the temporary access message is sent to the switch, and the temporary access message is encapsulated at the physical network layer through the switch to obtain a resource access message for the target object.

[0007] In one of the embodiments, resource access is performed on a target object based on a resource access message to obtain a resource access result of the target object, including: sending the resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; sending the target access message to the target object through the intermediate network element device to obtain a resource access result of the target object.

[0008] In one of the embodiments, a target access message is sent to a target object to obtain a resource access result of the target object, including: sending a target access message to the target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

[0009] In one of the embodiments, the method further includes: extracting access permission information of the target object from the resource access rule; and encapsulating the resource access information based on a rule identifier of the resource access rule when the access permission information indicates that access is allowed.

[0010] In one of the embodiments, sending a target access message to a target object includes: screening a target message transmission path in an idle state from a plurality of candidate message transmission paths through an intermediate network element device; and sending a resource access message to the target object through the target message transmission path.

[0011] In the second aspect, the present application also provides a resource access device, including: an information acquisition module, used to respond to a resource access instruction for a target object, obtain resource access information indicated by the resource access instruction, and the resource access rule of the target object; a message encapsulation module, used to encapsulate the resource access information based on the rule identifier of the resource access rule, and obtain a resource access message for the target object; a resource access module, used to perform resource access on the target object according to the resource access message, and obtain a resource access result of the target object.

[0012] In a third aspect, the present application also provides a computer device, including a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and a resource access rule for the target object; based on a rule identifier of the resource access rule, encapsulating the resource access information to obtain a resource access message for the target object; performing resource access on the target object according to the resource access message to obtain a resource access result for the target object.

[0013] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the following steps when the computer program is executed by a processor: in response to a resource access instruction for a target object, obtain resource access information indicated by the resource access instruction and a resource access rule for the target object; based on a rule identifier of the resource access rule, encapsulate the resource access information to obtain a resource access message for the target object; and based on the resource access message, perform resource access on the target object to obtain a resource access result for the target object.

[0014] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the following steps when executed by a processor: in response to a resource access instruction for a target object, obtain resource access information indicated by the resource access instruction and a resource access rule for the target object; based on a rule identifier of the resource access rule, encapsulate the resource access information to obtain a resource access message for the target object; and based on the resource access message, perform resource access on the target object to obtain a resource access result for the target object.

[0015] The above-mentioned resource access method, device, computer equipment, computer-readable storage medium and computer program product, in response to a resource access instruction for a target object, first obtains the resource access information indicated by the resource access instruction and the resource access rule of the target object. Based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object. Finally, according to the resource access message, the target object is accessed to obtain the resource access result of the target object. It can be seen that the focus of this application is to introduce a resource access rule identifier that is independent of the network segment, perform message encapsulation, thereby distinguishing the resource access path, and avoiding the problem of network segment conflict in the prior art. Moreover, the resource access rule has higher flexibility, and the resource access rule can be dynamically adjusted according to actual needs to meet diverse business needs. Therefore, this application can effectively reduce the limitations of resource access, make resource access more flexible, and further improve the efficiency of resource access. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0017] FIG1 is an application environment diagram of a resource access method in one embodiment;

[0018] FIG2 is a schematic diagram of a flow chart of a resource access method in one embodiment;

[0019] FIG3 is a schematic diagram of configuration information in one embodiment;

[0020] FIG4 is a schematic diagram of a first cloud host accessing multiple tenant objects in one embodiment;

[0021] FIG5 is a schematic diagram of a process of double-layer encapsulation of a message in one embodiment;

[0022] FIG6 is a schematic diagram of a resource access message from port 1 to port 2 in one embodiment;

[0023] FIG7 is a schematic diagram of a flow chart of network address translation in one embodiment;

[0024] FIG8 is a schematic diagram of a target access message from port 3 to port 4 in one embodiment;

[0025] FIG9 is a schematic diagram of session information in one embodiment;

[0026] FIG10 is a schematic diagram of a process of returning a resource access result by a second cloud host in one embodiment;

[0027] FIG11 is a schematic diagram of a message from port 4 to port 3 in one embodiment;

[0028] FIG12 is a schematic diagram of a message from port 2 to port 1 in one embodiment;

[0029] FIG13 is a schematic diagram of a process for detecting resource access rights in one embodiment;

[0030] FIG14 is a schematic diagram of a process for determining a target message transmission path in one embodiment;

[0031] FIG15 is a block diagram of a resource access device in one embodiment;

[0032] FIG. 16 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] In a large-scale public cloud network environment, some cloud services are usually deployed to provide services for tenant objects of the entire public cloud. In order to solve the centralized management of cloud service resources, cloud networks often divide cloud service resources into one or more separate VPCs (Virtual Private Clouds). When tenant objects schedule cloud services, cloud services also need to access the network resources of tenant objects accordingly, perform some resource acquisition and data calculation, etc., in order to make reasonable resource allocation and provide better services for tenant objects. This involves cross-network resource access between cloud services and tenant objects.

[0035] Currently, data exchange and resource sharing across networks between cloud services and tenant objects are usually achieved by creating peer-to-peer connections between them. However, peer-to-peer connections have many restrictions, such as the network segments cannot overlap between the two parties. For example, if a cloud service wants to access the network resources of multiple tenant objects, it needs to create multiple peer-to-peer connections and configure multiple routes. This will lead to certain limitations in the resource access of tenant objects.

[0036] Based on this, an embodiment of the present application provides a resource access method, which can be applied to an application environment as shown in FIG. 1. A first cloud host 102 of a VPC where a cloud service is located, and a second cloud host 104 of a VPC where a tenant object is located are included. In the embodiment of the present application, an intermediate network element device 106 is also introduced to forward resource access messages sent by the first cloud host 102 to the second cloud host 104. There are also two ports on the intermediate network element device 106, namely port 2 and port 3, wherein port 2 is connected to port 1 on the first cloud host 102, and port 3 is connected to port 4 on the second cloud host 104. The interconnection between the ports can realize the traffic transmission from the first cloud host 102 to the intermediate network element device 106 and then to the second cloud host 104, and of course, the traffic transmission from the second cloud host 104 to the intermediate network element device 106 and then to the first cloud host 102 can also be realized. Among them, the cloud host is a computing resource in cloud computing, which can include elastic cloud servers, bare metal servers, etc.

[0037] Specifically, the first cloud host 102 responds to the resource access instruction for the target object, that is, the tenant object, and first obtains the resource access information indicated by the resource access instruction and the resource access rule of the target object. Based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object. The first cloud host 102 sends the resource access message to the intermediate network element device 106, and the resource access message is sent to the second cloud host 104 through the intermediate network element device 106, thereby realizing resource access to the target object.

[0038] In an exemplary embodiment, as shown in FIG. 2 , a resource access method is provided, which is described by taking the method applied to the first cloud host 102 in FIG. 1 as an example, including:

[0039] Step S202: In response to a resource access instruction for a target object, obtain resource access information indicated by the resource access instruction and a resource access rule of the target object.

[0040] The target object may refer to a tenant object in the cloud network. The target object may be one tenant object or multiple tenant objects. The resource access instruction may refer to an instruction to access the network resources of the target object. The network resources may include but are not limited to terminal service resources and NAT (Network Address Translation) resources in the tenant object VPC. Resource access information may include but is not limited to source address, destination address, access content, etc. In one example, the source address is the address of port 1 in the first cloud host, the destination address is the address of port 2 in the intermediate network element device, and the access content is the specific resource that the cloud service wants to access the tenant object. Resource access rules are rules for cloud services to access tenant objects. Resource access rules can be configured based on source addresses, destination addresses, ports, etc.

[0041] Exemplarily, when the first cloud host receives an access instruction for a network resource of a tenant object, it may first parse the access instruction to obtain resource access information and resource access rules for the tenant object.

[0042] In one example, the first cloud host can pre-specify a resource access instance in a subnet in the cloud service VPC, bind it to the intermediate network element device, and create a binding port for the resource access instance while creating the resource access instance, which is port 2 in Figure 1. Then create corresponding resource access rules in each tenant object VPC, and these resource access rules can be bound to the resource access instance. At the same time, it is also necessary to create a binding port for the resource access rule, which is port 3 in Figure 1. The information shown in Figure 3 can be obtained in the configuration. That is, for the resource access instance, the resource access instance ID and the port information corresponding to the resource access instance can be configured. For the resource access rule, the rule identifier, the associated instance ID, and the corresponding port information can be configured. For the port, the port ID, the corresponding VPC information, the subnet information, and the port IP (Internet Protocol) address can be configured. There can be multiple port IPs, such as port 2 and port 3. These three configurations can be associated through the port ID.

[0043] In one example, when the first cloud host needs to access multiple tenant objects, corresponding ports and corresponding resource access rules can be created in the intermediate network element device, as shown in Figure 4, which shows a schematic diagram of the first cloud host accessing tenant object 1 and tenant object 2.

[0044] Step S204: encapsulate the resource access information based on the rule identifier of the resource access rule to obtain a resource access message for the target object.

[0045] Among them, a message is a unit of data exchanged and transmitted in the network, and a resource access message is an information package exchanged between the two parties during the process of cloud service accessing resources to tenant objects, which contains all resource information exchanged between the two parties. A rule identifier is a unique identifier of a resource access rule, such as a resource access rule ID. Of course, in actual applications, other information can also be selected or customized as the unique identifier of a resource access rule.

[0046] Exemplarily, after the first cloud host inquires about the resource access rule of the target object, it can use the rule identifier of the resource access rule to encapsulate the resource access information, thereby obtaining a resource access message for the target object.

[0047] Step S206: perform resource access on the target object according to the resource access message to obtain a resource access result of the target object.

[0048] The resource access result may be a result returned by the target object based on the resource access message, and may include resource information that the first cloud host wants to access.

[0049] Exemplarily, the first cloud host sends the resource access message to port 2 through port 1, and port 2 forwards it to the intermediate network element device. The intermediate network element device then sends the resource access message to port 4 through port 3, and port 4 sends the resource access message to the second cloud host. After the second cloud host processes the resource access message, it feeds back the resource access result to the first cloud host through the original path. At this point, the first cloud host in the cloud service VPC successfully accesses the second cloud host in the tenant object VPC.

[0050] In this embodiment, the first cloud host in the cloud service VPC responds to the resource access instruction for the second cloud host in the tenant object VPC, and first obtains the resource access information indicated by the resource access instruction and the resource access rule of the tenant object. Based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the tenant object. Finally, according to the resource access message, the target object is accessed to obtain the resource access result of the tenant object. It can be seen that the focus of this embodiment is to introduce a resource access rule identifier that is independent of the network segment, perform message encapsulation, thereby distinguishing the resource access path, and avoiding the problem of network segment conflict in the prior art. Moreover, the resource access rule has higher flexibility, and the resource access rule can be dynamically adjusted according to actual needs to meet diverse business needs. Therefore, this embodiment can effectively reduce the limitations of cross-network resource access between cloud services and tenant objects, making cross-network resource access between cloud services and tenant objects more flexible, and can further improve resource access efficiency.

[0051] In an exemplary embodiment, as shown in FIG5 , based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object, including:

[0052] Step S502: Based on the rule identifier of the resource access rule, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message.

[0053] The virtual network layer encapsulation can be understood as an operation of encapsulating resource access information at the virtual network level, and the obtained message is a temporary access message.

[0054] Exemplarily, the first cloud host uses the rule identifier of the resource access rule to encapsulate the original message corresponding to the resource access information with a Vxlan (Virtual eXtensible Local Area Network) header, wherein the source address is the network address of port 1 of the first cloud host, the destination address is the network address of port 2 of the intermediate network element device, and the rule identifier of the resource access rule is used as the Vxlan ID to obtain a temporary access message.

[0055] Step S504: Send the temporary access message to the switch, and perform physical network layer encapsulation on the temporary access message through the switch to obtain a resource access message for the target object.

[0056] Among them, physical network layer encapsulation can be understood as the operation of encapsulating temporary access messages at the physical network level. A switch is a device that completes the information exchange function in a communication system. In this embodiment, the switch can process the temporary access message of the first cloud host and then forward it to the intermediate network element device. The first cloud host can be connected to the switch through a physical machine. Correspondingly, the second cloud host can also be connected to the corresponding switch through the corresponding physical machine.

[0057] Exemplarily, after the first cloud host sends the temporary access message to the switch, the switch will query the physical network information bound to port 2, also known as Underlay information, based on the destination address in the temporary access message, that is, the network address of port 2. This information tells the switch how to transmit the temporary access message to port 2 through the physical network. After obtaining the Underlay information, the switch can encapsulate the temporary access message again, that is, encapsulate the Underlay Vxlan header, and obtain the final resource access message, so that the resource access message can be transmitted to port 2 of the intermediate network element device.

[0058] In one example, the resource access message from port 1 to port 2 is shown in FIG6, including the IP address of physical machine 1, which is the IP address of the physical machine corresponding to the first cloud host, the network element IP, which is the IP address of the intermediate network element device, the cloud service VPC VxlanID, which is the unique identifier in the Vxlan network, the IP address of port 1, the IP address of port 2, the rule identifier of the resource access rule, the source IP address, which is the IP address of port 3, and the IP address of port 4. It should be noted that when the resource access message flows to the intermediate network element device, it will be sent from port 3, and the source IP will become the address of port 3.

[0059] In this embodiment, by encapsulating the resource access information, it is ensured that the resource access message can reach the second cloud host along the correct path, thereby improving the efficiency and accuracy of resource access.

[0060] In an exemplary embodiment, as shown in FIG7 , performing resource access on a target object according to a resource access message to obtain a resource access result of the target object includes:

[0061] Step S702: Send the resource access message to the intermediate network element device, and perform network address translation on the resource access message through the intermediate network element device to obtain a target access message.

[0062] Among them, network address translation refers to the operation of converting the source address in the resource access message. The target access message refers to the message that has completed the source address translation.

[0063] Exemplarily, after receiving the resource access message sent by the switch, the intermediate network element device can perform double-layer message unpacking to obtain the original message information, that is, the original message of the resource access information, and perform source address conversion on it, that is, convert the source address into the IP address of port 3 to obtain the target access message.

[0064] Step S704: Send the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

[0065] Exemplarily, the intermediate network element device sends the target access message to port 4 on the second cloud host through port 3, and port 4 sends the target access message to the tenant object. After the tenant object processes the target access message, the corresponding resource access result can be returned along the original path.

[0066] In one example, FIG8 shows a target access message from port 3 to port 4, including the network element IP, the physical machine 2 IP, which is the IP address of the physical machine corresponding to the second cloud host, the tenant object VPC Vxlan ID, the port 3 IP, and the port 4 IP. The session information is shown in FIG9.

[0067] In this embodiment, the intermediate network element device ensures the accuracy of the message transmission path through network address translation, thereby ensuring the accuracy of the cloud service's resource access to the tenant object.

[0068] In an exemplary embodiment, as shown in FIG10 , a target access message is sent to a target object to obtain a resource access result of the target object, including:

[0069] Step S1002: Send the target access message to the target object.

[0070] Step S1004, receiving the resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

[0071] The target resource information may refer to the resource information that the cloud service needs to access.

[0072] Exemplarily, the intermediate network element device sends the target access message to the switch corresponding to the second cloud host, and the switch forwards it to the corresponding physical machine. After the physical machine unpacks the target access message, it obtains the original message of resource access information and sends it to the second cloud host through port 4. After the second cloud host processes the original message, it swaps the source address and destination address in the message, that is, the current source address is the IP address of port 4, and the destination address is the IP address of port 3, and encapsulates the target resource information into the message and sends it to the switch. The switch encapsulates the Underlay Vxlan header and sends it to the intermediate network element device. After receiving the message, the intermediate network element device also performs network address conversion and sends it to the physical machine corresponding to the first cloud host, and the physical machine sends it to the first cloud host through port 1.

[0073] In one example, Figure 11 shows a message from port 4 to port 3, including physical machine 2 IP, network element IP, tenant object VPC Vxlan ID, port 4 IP, and port 3 IP. Figure 12 shows a message from port 2 to port 1.

[0074] In this embodiment, the tenant object will also feed back the resource access result to the cloud service according to the transmission path corresponding to the first cloud host, thereby realizing a closed loop of cross-network resource access between the cloud service and the tenant object.

[0075] In an exemplary embodiment, as shown in FIG13 , the resource access method further includes:

[0076] Step S1302: extracting access permission information of the target object from the resource access rule.

[0077] Among them, the access permission information may refer to the access permission set by the target object for the cloud service. This is because not all tenant objects allow cloud services to access resources. Therefore, this embodiment chooses to configure an access permission information in the resource access rule to record the cloud service whitelist that the tenant object is allowed to access.

[0078] Exemplarily, after obtaining the resource access rules of the target object, the first cloud host may extract the access permission information of the target object, that is, the cloud service whitelist, to determine whether the cloud service corresponding to the first cloud host has the permission to access the target object resources.

[0079] Step S1304: When the access permission information indicates that access is allowed, the resource access information is encapsulated based on the rule identifier of the resource access rule.

[0080] Exemplarily, when the access permission information indicates that access is allowed, that is, the cloud service whitelist includes the cloud service corresponding to the first cloud host, indicating that the first cloud host has the permission to access the target object resources. At this time, the first cloud host can encapsulate the resource access information based on the rule identifier of the resource access rule. When the access permission information indicates that access is not allowed, that is, the cloud service whitelist does not include the cloud service corresponding to the first cloud host, indicating that the first cloud host does not have the permission to access the target object resources, the first cloud host cannot access the network resources of the target object.

[0081] In this embodiment, by configuring corresponding resource access permissions in the resource access rules, resource access to the cloud service is restricted to a certain extent to prevent cloud services that tenant objects are not allowed to access from accessing resources, thereby ensuring the security of resource access.

[0082] In an exemplary embodiment, as shown in FIG. 14 , sending a target access message to a target object includes:

[0083] Step S1402: Screening a target message transmission path in an idle state from among a plurality of candidate message transmission paths through an intermediate network element device.

[0084] Step S1404: Send the resource access message to the target object through the target message transmission path.

[0085] Among them, the candidate message transmission path refers to the message transmission path configured in the intermediate network element device, that is, a port of the intermediate network device can have multiple message transmission paths, or multiple elastic IP addresses. This can achieve throughput expansion for the intermediate network element device, that is, increase the number of messages that the intermediate network element device can transmit per second, and improve the message transmission capacity of the intermediate network element device. The idle state can mean that the candidate message transmission path is not currently transmitting other messages.

[0086] Exemplarily, when sending a target access message to a tenant object, the intermediate network element device may select a target message transmission path that is currently in an idle state from among a plurality of candidate message transmission paths pre-configured by the intermediate network element device for transmitting the target access message.

[0087] In one example, when the throughput of the intermediate network element device needs to be reduced, the elastic IP address can be adaptively reduced to reduce the message transmission path. In addition, multiple resource access rules can be created to increase the number of sessions and achieve throughput expansion.

[0088] In this embodiment, multiple elastic IP addresses are bound to the ports of intermediate network element devices to establish multiple message transmission paths, thereby achieving throughput expansion of the intermediate network element devices, thereby improving the message transmission capacity of the intermediate network element devices, and further improving the efficiency of cross-network resource access between cloud services and tenant objects.

[0089] In a specific embodiment, the process of cross-network resource access between a cloud service and a tenant object includes: the first cloud host in the cloud service VPC responds to a resource access instruction for the tenant object VPC, and first obtains the resource access information indicated by the resource access instruction and the resource access rule of the tenant object. Based on the rule ID of the resource access rule, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message. The temporary access message is sent to the switch, and the temporary access message is encapsulated at the physical network layer through the switch to obtain a resource access message for the tenant object. The switch sends the resource access message to the intermediate network element device, and the resource access message is converted by the intermediate network element device to obtain a target access message. The intermediate network element device sends the target access message to the tenant object, and receives the resource access result returned by the tenant object based on the target access message. At this point, the first cloud host in the cloud service VPC has successfully accessed the second cloud host in the tenant object VPC.

[0090] In this embodiment, the first cloud host in the cloud service VPC responds to the resource access instruction for the second cloud host in the tenant object VPC, and first obtains the resource access information indicated by the resource access instruction and the resource access rule of the tenant object. Based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the tenant object. Finally, according to the resource access message, the target object is accessed to obtain the resource access result of the tenant object. It can be seen that the focus of this embodiment is to introduce a resource access rule identifier that is independent of the network segment, perform message encapsulation, thereby distinguishing the resource access path, and avoiding the problem of network segment conflict in the prior art. Moreover, the resource access rule has higher flexibility, and the resource access rule can be dynamically adjusted according to actual needs to meet diverse business needs. Therefore, this embodiment can effectively reduce the limitations of cross-network resource access between cloud services and tenant objects, making cross-network resource access between cloud services and tenant objects more flexible, and can further improve resource access efficiency.

[0091] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0092] Based on the same inventive concept, the embodiment of the present application also provides a resource access device for implementing the resource access method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more resource access device embodiments provided below can refer to the limitations on the resource access method above, and will not be repeated here.

[0093] In an exemplary embodiment, as shown in FIG. 15 , a resource access device is provided, including: an information acquisition module 1502, for obtaining, in response to a resource access instruction for a target object, resource access information indicated by the resource access instruction and a resource access rule for the target object; a message encapsulation module 1504, for encapsulating the resource access information based on a rule identifier of the resource access rule to obtain a resource access message for the target object; and a resource access module 1506, for performing resource access on the target object according to the resource access message to obtain a resource access result for the target object.

[0094] In one of the embodiments, the message encapsulation module 1504 is also used to: based on the rule identifier of the resource access rule, encapsulate the resource access information at the virtual network layer to obtain a temporary access message; send the temporary access message to the switch, and through the switch, encapsulate the temporary access message at the physical network layer to obtain a resource access message for the target object.

[0095] In one of the embodiments, the resource access module 1506 is also used to: send a resource access message to an intermediate network element device, perform network address translation on the resource access message through the intermediate network element device, and obtain a target access message; send the target access message to a target object through the intermediate network element device to obtain a resource access result for the target object.

[0096] In one embodiment, the resource access module 1506 is also used to: send a target access message to a target object; receive a resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

[0097] In one of the embodiments, the device is further used to: extract access permission information of the target object from the resource access rule; and encapsulate the resource access information based on the rule identifier of the resource access rule when the access permission information indicates that access is allowed.

[0098] In one of the embodiments, the resource access module 1506 is further used to: filter a target message transmission path in an idle state from a plurality of candidate message transmission paths through an intermediate network element device; and send a resource access message to a target object through the target message transmission path.

[0099] Each module in the resource access device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0100] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG16. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store resource access data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a resource access method is implemented.

[0101] Those skilled in the art will understand that the structure shown in FIG. 16 is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0102] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and a resource access rule for the target object; based on a rule identifier of the resource access rule, encapsulating the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result for the target object.

[0103] In one embodiment, when the processor executes the computer program, the following steps are also implemented: based on the rule identifier of the resource access rule, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message; the temporary access message is sent to the switch, and the temporary access message is encapsulated at the physical network layer through the switch to obtain a resource access message for the target object.

[0104] In one embodiment, when the processor executes the computer program, the following steps are also implemented: sending a resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; sending the target access message to a target object through the intermediate network element device to obtain a resource access result of the target object.

[0105] In one embodiment, when the processor executes the computer program, it also implements the following steps: sending a target access message to a target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

[0106] In one embodiment, when the processor executes the computer program, the following steps are also implemented: extracting access permission information of the target object from the resource access rule; and encapsulating the resource access information based on the rule identifier of the resource access rule when the access permission information indicates that access is allowed.

[0107] In one embodiment, when the processor executes the computer program, the following steps are also implemented: through the intermediate network element device, among multiple candidate message transmission paths, a target message transmission path in an idle state is screened; and through the target message transmission path, a resource access message is sent to the target object.

[0108] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: in response to a resource access instruction for a target object, resource access information indicated by the resource access instruction and a resource access rule for the target object are obtained; based on a rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object; according to the resource access message, resource access is performed on the target object to obtain a resource access result for the target object.

[0109] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the rule identifier of the resource access rule, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message; the temporary access message is sent to the switch, and the temporary access message is encapsulated at the physical network layer through the switch to obtain a resource access message for the target object.

[0110] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: sending a resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; sending the target access message to a target object through the intermediate network element device to obtain a resource access result for the target object.

[0111] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: sending a target access message to the target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

[0112] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting access permission information of the target object from the resource access rule; and encapsulating the resource access information based on the rule identifier of the resource access rule when the access permission information indicates that access is allowed.

[0113] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: through the intermediate network element device, among multiple candidate message transmission paths, a target message transmission path in an idle state is screened; and through the target message transmission path, a resource access message is sent to the target object.

[0114] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: in response to a resource access instruction for a target object, obtain resource access information indicated by the resource access instruction and a resource access rule for the target object; based on a rule identifier of the resource access rule, encapsulate the resource access information to obtain a resource access message for the target object; and according to the resource access message, perform resource access on the target object to obtain a resource access result for the target object.

[0115] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the rule identifier of the resource access rule, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message; the temporary access message is sent to the switch, and the temporary access message is encapsulated at the physical network layer through the switch to obtain a resource access message for the target object.

[0116] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: sending a resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; sending the target access message to a target object through the intermediate network element device to obtain a resource access result for the target object.

[0117] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: sending a target access message to the target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

[0118] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting access permission information of the target object from the resource access rule; and encapsulating the resource access information based on the rule identifier of the resource access rule when the access permission information indicates that access is allowed.

[0119] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: through the intermediate network element device, among multiple candidate message transmission paths, a target message transmission path in an idle state is screened; and through the target message transmission path, a resource access message is sent to the target object.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0121] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0122] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0123] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A resource access method, characterized in that: The method comprises: In response to a resource access instruction for a target object, acquiring resource access information indicated by the resource access instruction and a resource access rule for the target object; Based on the rule identifier of the resource access rule, encapsulate the resource access information to obtain a resource access message for the target object; According to the resource access message, resource access is performed on the target object to obtain a resource access result of the target object.

2. The method according to claim 1, characterized in that: The rule identifier based on the resource access rule encapsulates the resource access information to obtain a resource access message for the target object, including: Based on the rule identifier of the resource access rule, encapsulate the resource access information at the virtual network layer to obtain a temporary access message; The temporary access message is sent to a switch, and the temporary access message is encapsulated at the physical network layer by the switch to obtain a resource access message for the target object.

3. The method according to claim 1, characterized in that The performing resource access on the target object according to the resource access message to obtain the resource access result of the target object includes: Sending the resource access message to an intermediate network element device, and performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; The target access message is sent to the target object through the intermediate network element device to obtain the resource access result of the target object.

4. The method according to claim 3, characterized in that The sending the target access message to the target object to obtain the resource access result of the target object includes: Sending the target access message to the target object; Receive a resource access result returned by the target object based on the target access message; the resource access result is obtained after the target object encapsulates the target resource information requested by the target access message.

5. The method according to claim 1, characterized in that The method further comprises: Extracting access permission information of the target object from the resource access rule; In a case where the access permission information indicates that access is permitted, the resource access information is encapsulated based on the rule identifier of the resource access rule.

6. The method according to claim 3, characterized in that: The sending the target access message to the target object includes: By means of the intermediate network element device, a target message transmission path in an idle state is selected from a plurality of candidate message transmission paths; The resource access message is sent to the target object through the target message transmission path.

7. A resource access device, characterized in that: The device comprises: An information acquisition module, configured to, in response to a resource access instruction for a target object, acquire resource access information indicated by the resource access instruction and a resource access rule for the target object; A message encapsulation module, used to encapsulate the resource access information based on the rule identifier of the resource access rule to obtain a resource access message for the target object; The resource access module is used to perform resource access on the target object according to the resource access message to obtain the resource access result of the target object.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images