Resource access method and device, computer device, readable storage medium and program product

Abstract

The application relates to a resource access method and device, computer equipment, a readable storage medium and a program product, and relates to the field of cloud networks. The method comprises the following steps: in response to a resource access instruction for a target object, acquiring resource access information indicated by the resource access instruction and a resource access rule of the target object; based on a rule identifier of the resource access rule, encapsulating the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result of the target object. The method can reduce the limitations during resource access.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud networks, and in particular to a resource access method and device, a computer device, a readable storage medium, and a program product. BACKGROUND

[0002] In a cloud network environment, there will be a cloud tenant object to rent resources and services in the cloud network. In this process, the cloud network also needs to access the resources of the tenant object to facilitate reasonable resource configuration and thus provide better cloud services.

[0003] Currently, data exchange and resource sharing between the cloud network and the tenant object are usually achieved by creating a peer-to-peer connection between them. However, peer-to-peer connections have many limitations, such as the inability to have overlapping network segments between the two parties, and the need to create multiple peer-to-peer connections and configure multiple routes if the cloud network wants to access the resources of multiple tenants. This results in certain limitations of the current cloud network in accessing the resources of the tenant object. SUMMARY

[0004] Therefore, it is necessary to provide a resource access method and device, a computer device, a computer readable storage medium, and a computer program product that can reduce the limitations of resource access.

[0005] In a first aspect, the present application provides a resource access method, comprising: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and a resource access rule of the target object; based on a rule identifier of the resource access rule, encapsulating the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result of the target object.

[0006] In one embodiment, based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain the resource access message for the target object, which comprises: based on the rule identifier of the resource access rule, the resource access information is encapsulated at a virtual network layer to obtain a temporary access message; and the temporary access message is sent to a switch, and the temporary access message is encapsulated at a physical network layer by the switch to obtain the resource access message for the target object.

[0007] In one embodiment, according to the resource access message, resource access is performed on the target object to obtain a resource access result of the target object, which comprises: the resource access message is sent to an intermediate network element device, and the resource access message is converted by the intermediate network element device to obtain a target access message; and the target access message is sent to the target object by the intermediate network element device to obtain the resource access result of the target object.

[0008] In one of the embodiments, the target access message is sent to the target object to obtain the resource access result of the target object, including: sending the target access message to the target object; receiving the resource access result returned by the target object based on the target access message; and the resource access result is obtained by the target object encapsulating the target resource information requested by the target access message.

[0009] In one of the embodiments, the method further includes: extracting the access permission information of the target object from the resource access rule; and encapsulating the resource access information based on the rule identifier of the resource access rule in the case that the access permission information indicates that the access is allowed.

[0010] In one of the embodiments, the target access message is sent to the target object, including: screening the target message transmission path in an idle state from the plurality of candidate message transmission paths through the intermediate network element device; and sending the resource access message to the target object through the target message transmission path.

[0011] In the second aspect, the application further provides a resource access device, including: an information acquisition module, configured to acquire resource access information indicated by a resource access instruction and a resource access rule of a target object in response to the resource access instruction for the target object; a message encapsulation module, configured to encapsulate the resource access information based on a rule identifier of the resource access rule to obtain a resource access message for the target object; and a resource access module, configured to perform resource access on the target object according to the resource access message to obtain a resource access result of the target object.

[0012] In the third aspect, the application further provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program: acquiring resource access information indicated by a resource access instruction and a resource access rule of a target object in response to the resource access instruction for the target object; encapsulating the resource access information based on a rule identifier of the resource access rule to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result of the target object.

[0013] In the fourth aspect, the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the following steps: acquiring resource access information indicated by a resource access instruction and a resource access rule of a target object in response to the resource access instruction for the target object; encapsulating the resource access information based on a rule identifier of the resource access rule to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result of the target object.

[0014] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and resource access rules for the target object; based on the rule identifier of the resource access rules, encapsulating the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain the resource access result of the target object.

[0015] The aforementioned resource access method, apparatus, computer device, computer-readable storage medium, and computer program product, in response to a resource access instruction for a target object, first acquire the resource access information indicated by the resource access instruction and the resource access rules for the target object. Then, based on the rule identifier of the resource access rules, the resource access information is encapsulated to obtain a resource access message for the target object. Finally, based on the resource access message, resource access is performed on the target object to obtain the resource access result. It can be seen that the focus of this application is to introduce a network segment-independent resource access rule identifier for message encapsulation, thereby distinguishing resource access paths and avoiding the network segment conflict problem in the prior art. Moreover, the resource access rules have higher flexibility and can be dynamically adjusted according to actual needs to meet diverse business requirements. Therefore, this application can effectively reduce the limitations of resource access, making resource access more flexible and further improving the efficiency of resource access. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a diagram illustrating the application environment of a resource access method in one embodiment.

[0018] Figure 2 This is a flowchart illustrating a resource access method in one embodiment;

[0019] Figure 3 This is a schematic diagram of configuration information in one embodiment;

[0020] Figure 4 This is a schematic diagram of a first cloud host accessing multiple tenant objects in one embodiment;

[0021] Figure 5 This is a flowchart illustrating the process of double-layer encapsulation of a message in one embodiment;

[0022] Figure 6 This is a schematic diagram of resource access messages from port 1 to port 2 in one embodiment;

[0023] Figure 7 This is a schematic diagram of the network address translation process in one embodiment;

[0024] Figure 8 This is a schematic diagram of a target access packet from port 3 to port 4 in one embodiment;

[0025] Figure 9 This is a schematic diagram of session information in one embodiment;

[0026] Figure 10 This is a flowchart illustrating the process of the second cloud host returning resource access results in one embodiment.

[0027] Figure 11 This is a schematic diagram of the messages from port 4 to port 3 in one embodiment;

[0028] Figure 12 This is a schematic diagram of a message from port 2 to port 1 in one embodiment;

[0029] Figure 13 This is a flowchart illustrating the process of detecting resource access permissions in one embodiment;

[0030] Figure 14 This is a flowchart illustrating the process of determining the target message transmission path in one embodiment;

[0031] Figure 15 This is a structural block diagram of a resource access device in one embodiment;

[0032] Figure 16 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0034] In large-scale public cloud network environments, cloud services are typically deployed to serve tenants across the entire public cloud. To address the centralized management of cloud service resources, cloud networks often partition these resources into one or more separate VPCs (Virtual Private Clouds). When a tenant schedules a cloud service, the cloud service also needs to access the tenant's network resources to perform resource acquisition, data computation, and other tasks to optimize resource allocation and provide better service to the tenant. This involves cross-network resource access between the cloud service and the tenant.

[0035] Currently, cross-network data exchange and resource sharing between cloud services and tenant objects are typically achieved by creating peering connections. However, peering connections have several limitations. For example, overlapping network segments cannot exist between the communicating parties. Furthermore, if a cloud service needs to access the network resources of multiple tenant objects, multiple peering connections need to be created and multiple routes configured. These limitations restrict the resource access of tenant objects.

[0036] Based on this, embodiments of this application provide a resource access method that can be applied to, for example... Figure 1 The application environment shown includes a first cloud host 102 in the VPC where the cloud service resides, and a second cloud host 104 in the VPC where the tenant object resides. In this embodiment, an intermediate network element device 106 is also introduced to forward resource access messages sent from the first cloud host 102 to the second cloud host 104. The intermediate network element device 106 has two ports, port 2 and port 3. Port 2 is connected to port 1 on the first cloud host 102, and port 3 is connected to port 4 on the second cloud host 104. The interconnection between these ports enables traffic transmission from the first cloud host 102 to the intermediate network element device 106 and then to the second cloud host 104, and vice versa. A cloud host is a computing resource in cloud computing and can include elastic cloud servers, bare metal servers, etc.

[0037] Specifically, in response to a resource access command targeting a target object, i.e., a tenant object, the first cloud host 102 first obtains the resource access information indicated by the resource access command and the resource access rules for the target object. Based on the rule identifier of the resource access rules, it encapsulates the resource access information to obtain a resource access message for the target object. The first cloud host 102 sends the resource access message to the intermediate network element device 106, which then sends the resource access message to the second cloud host 104, thereby realizing resource access to the target object.

[0038] In one exemplary embodiment, such as Figure 2 As shown, a resource access method is provided, which is applied to... Figure 1 Taking the first cloud server 102 as an example, the explanation includes:

[0039] Step S202: In response to a resource access instruction for a target object, obtain the resource access information indicated by the resource access instruction and the resource access rules of the target object.

[0040] The target object can refer to a tenant object in the cloud network. It can be a single tenant object or multiple tenant objects. Resource access instructions refer to instructions for accessing the network resources of the target object. Network resources can include, but are not limited to, endpoint service resources and NAT (Network Address Translation) resources within the tenant object's VPC. Resource access information can include, but is not limited to, source address, destination address, and access content. In one example, the source address is port 1 of the first cloud host, the destination address is port 2 of the intermediate network element device, and the access content is the specific resource of the tenant object that the cloud service wants to access. Resource access rules are the rules by which the cloud service accesses tenant objects. Resource access rules can be configured based on source address, destination address, port, etc.

[0041] For example, when the first cloud host receives an access instruction for network resources of a tenant object, it can first parse the access instruction to obtain resource access information and resource access rules for the tenant object.

[0042] In one example, the first cloud host can pre-create a resource access instance within a specified subnet of the cloud service VPC, bind it to an intermediate network element device, and simultaneously create a binding port for the resource access instance. Figure 1 Port 2 in the context. Then, create corresponding resource access rules within each tenant object VPC. These resource access rules can be bound to resource access instances. It is also necessary to create a binding port for each resource access rule, which is... Figure 1 Port 3 in the configuration. Figure 3 The information shown refers to the following: For resource access instances, you can configure the resource access instance ID and the corresponding port information; for resource access rules, you can configure the rule identifier, the associated instance ID, and the corresponding port information; and for ports, you can configure the port ID, the corresponding VPC information, the subnet information, and the port IP (Internet Protocol) address. Multiple port IPs can be configured, such as port 2 and port 3. These three configurations are linked together using the port ID.

[0043] In one example, when the first cloud host needs to access multiple tenant objects, corresponding ports and resource access rules can be created in the intermediate network element device, such as... Figure 4 As shown, Figure 4 This diagram illustrates how the first cloud host accesses tenant object 1 and tenant object 2.

[0044] Step S204: Based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object.

[0045] In this context, a message is a unit of data exchanged and transmitted in a network. A resource access message refers to the information package exchanged between a cloud service and a tenant object during the process of accessing resources, containing all resource information exchanged between the two parties. A rule identifier is a unique identifier for a resource access rule, such as a resource access rule ID. Of course, in practical applications, other information can be selected or customized as the unique identifier for resource access rules.

[0046] For example, after the first cloud host queries the resource access rules of the target object, it can use the rule identifier of the resource access rule to encapsulate the resource access information, thereby obtaining the resource access message for the target object.

[0047] Step S206: Based on the resource access message, perform resource access on the target object to obtain the resource access result of the target object.

[0048] The resource access result can be the result returned by the target object based on the resource access message, and may include the resource information that the first cloud host wants to access.

[0049] For example, the first cloud host sends a resource access message to port 2 via port 1, and port 2 forwards it to an intermediate network element. The intermediate network element then sends the resource access message to port 4 via port 3, and port 4 forwards the resource access message to the second cloud host. After processing the resource access message, the second cloud host returns the resource access result to the first cloud host via the same route. Thus, the first cloud host within the cloud service VPC successfully accesses the second cloud host within the tenant object VPC.

[0050] In this embodiment, the first cloud host within the cloud service VPC responds to a resource access command for a second cloud host within the tenant object VPC. First, it obtains the resource access information indicated by the resource access command and the resource access rules for the tenant object. Then, based on the rule identifier of the resource access rules, it encapsulates the resource access information to obtain a resource access message for the tenant object. Finally, based on the resource access message, it performs resource access on the target object to obtain the resource access result for the tenant object. It can be seen that the key point of this embodiment is to introduce a network segment-independent resource access rule identifier for message encapsulation, thereby distinguishing resource access paths and avoiding the network segment conflict problem in the prior art. Moreover, the resource access rules have higher flexibility and can be dynamically adjusted according to actual needs to meet diverse business requirements. Therefore, this embodiment can effectively reduce the limitations of cross-network resource access between cloud services and tenant objects, making cross-network resource access between cloud services and tenant objects more flexible and further improving resource access efficiency.

[0051] In one exemplary embodiment, such as Figure 5 As shown, based on the rule identifier of the resource access rule, the resource access information is encapsulated to obtain a resource access message for the target object, including:

[0052] Step S502: Based on the rule identifier of the resource access rule, the resource access information is encapsulated in a virtual network layer to obtain a temporary access message.

[0053] Virtual network layer encapsulation can be understood as the operation of encapsulating resource access information at the virtual network layer, and the resulting message is a temporary access message.

[0054] For example, the first cloud host uses the rule identifier of the resource access rule to encapsulate the original message corresponding to the resource access information with a Vxlan (Virtual eXtensible Local Area Network) header. The source address is the network address of port 1 of the first cloud host, the destination address is the network address of port 2 of the intermediate network element device, and the rule identifier of the resource access rule is used as the Vxlan ID to obtain a temporary access message.

[0055] Step S504: The temporary access message is sent to the switch. The switch encapsulates the temporary access message at the physical network layer to obtain a resource access message for the target object.

[0056] Physical network layer encapsulation can be understood as the operation of encapsulating temporary access packets at the physical network layer. A switch is a device that performs information exchange functions in a communication system. In this embodiment, the switch can process the temporary access packets of the first cloud host and then forward them to intermediate network element devices. The first cloud host can be connected to the switch through a physical machine. Correspondingly, the second cloud host can also be connected to the corresponding switch through a corresponding physical machine.

[0057] For example, after the first cloud host sends a temporary access packet to the switch, the switch will use the destination address in the temporary access packet, which is the network address of port 2, to query the physical network information bound to port 2, also known as the Underlay information. This information tells the switch how to transmit the temporary access packet to port 2 through the physical network. After obtaining the Underlay information, the switch can then encapsulate the temporary access packet again, that is, encapsulate it with an Underlay VxLAN header, to obtain the final resource access packet. In this way, the resource access packet can be transmitted to port 2 of the intermediate network element device.

[0058] In one example, resource access packets from port 1 to port 2 are as follows: Figure 6 As shown, this includes the IP address of physical machine 1 (the physical machine corresponding to the first cloud host), the IP address of the network element (the IP address of the intermediate network element device), the VPC VxlanID (a unique identifier in the Vxlan network), the IP address of port 1, the IP address of port 2, the rule identifier of the resource access rule, the source IP address (the IP address of port 3), and the IP address of port 4. It should be noted that when the resource access packet is transferred to the intermediate network element device, it will be sent out from port 3, and the source IP will become the address of port 3.

[0059] In this embodiment, by encapsulating the resource access information, it is ensured that the resource access message can reach the second cloud host along the correct path, thereby improving the efficiency and accuracy of resource access.

[0060] In one exemplary embodiment, such as Figure 7 As shown, based on the resource access message, resource access is performed on the target object to obtain the resource access result of the target object, including:

[0061] Step S702: The resource access message is sent to the intermediate network element device. The intermediate network element device performs network address translation on the resource access message to obtain the target access message.

[0062] Network address translation (NAT) refers to the operation of translating the source address in a resource access message. A destination access message is a message that has completed source address translation.

[0063] For example, after receiving a resource access message sent by the switch, the intermediate network element device can perform two-layer message decapsulation to obtain the original message information, which is the original message of the resource access information. Then, it performs source address translation, that is, it translates the source address into the IP address of port 3 to obtain the target access message.

[0064] Step S704: Send the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

[0065] For example, the intermediate network element device sends the target access message to port 4 on the second cloud host through port 3. Port 4 then sends the target access message to the tenant object. After processing the target access message, the tenant object can return the corresponding resource access result through the same path.

[0066] In one example, Figure 8 The target access packets from port 3 to port 4 are shown, including the network element IP, the physical machine 2 IP (i.e., the IP address of the physical machine corresponding to the second cloud host), the tenant object VPC Vxlan ID, the port 3 IP, and the port 4 IP. Session information is as follows: Figure 9 As shown.

[0067] In this embodiment, the intermediate network element device ensures the accuracy of the packet transmission path through network address translation, thereby ensuring the accuracy of cloud service resource access for tenant objects.

[0068] In one exemplary embodiment, such as Figure 10 As shown, the target access message is sent to the target object, and the resource access result of the target object is obtained, including:

[0069] Step S1002: Send the target access message to the target object.

[0070] Step S1004: Receive the resource access result returned by the target object based on the target access message; the resource access result is obtained by the target object after encapsulating the target resource information requested by the target access message.

[0071] Among them, target resource information can refer to the resource information that the cloud service needs to access.

[0072] For example, the intermediate network element sends the target access packet to the switch corresponding to the second cloud host. The switch forwards it to the corresponding physical machine. The physical machine decapsulates the target access packet to obtain the original packet containing resource access information, and sends it to the second cloud host via port 4. The second cloud host processes the original packet, swaps the source and destination addresses (i.e., the source address is the IP address of port 4, and the destination address is the IP address of port 3), encapsulates the target resource information into the packet, and sends it to the switch. The switch encapsulates the packet with an Underlay VxLAN header and sends it to the intermediate network element. The intermediate network element receives the packet, performs network address translation, and sends it to the physical machine corresponding to the first cloud host. The physical machine then forwards the packet to the first cloud host via port 1.

[0073] In one example, Figure 11 The packets from port 4 to port 3 are shown, including the physical machine 2 IP, network element IP, tenant object VPC Vxlan ID, port 4 IP, and port 3 IP. Figure 12 The message from port 2 to port 1 is shown.

[0074] In this embodiment, the tenant object also feeds back the resource access results to the cloud service according to the transmission path corresponding to the first cloud host, realizing a closed loop of cross-network resource access between the cloud service and the tenant object.

[0075] In one exemplary embodiment, such as Figure 13 As shown, resource access methods also include:

[0076] Step S1302: Extract the access permission information of the target object from the resource access rules.

[0077] The access permission information can refer to the access permissions set by the target object for cloud services. This is because not all tenant objects allow cloud services to access resources. Therefore, this embodiment chooses to configure access permission information in the resource access rules to record the whitelist of cloud services that the tenant object is allowed to access.

[0078] For example, after obtaining the resource access rules of the target object, the first cloud host can extract the access permission information of the target object, i.e., the cloud service whitelist, to determine whether the cloud service corresponding to the first cloud host has the permission to access the target object's resources.

[0079] Step S1304: If the access permission information indicates that access is allowed, the resource access information is encapsulated based on the rule identifier of the resource access rule.

[0080] For example, if the access permission information indicates that access is permitted, meaning the cloud service corresponding to the first cloud host is included in the cloud service whitelist, it means that the first cloud host has permission to access the target object's resources. In this case, the first cloud host can encapsulate the resource access information based on the rule identifier of the resource access rules. If the access permission information indicates that access is not permitted, meaning the cloud service corresponding to the first cloud host is not included in the cloud service whitelist, it means that the first cloud host does not have permission to access the target object's resources, and therefore the first cloud host cannot access the target object's network resources.

[0081] In this embodiment, by configuring corresponding resource access permissions in the resource access rules, resource access to cloud services is restricted to a certain extent, preventing cloud services that tenant objects are not allowed to access from also accessing resources, thereby ensuring the security of resource access.

[0082] In one exemplary embodiment, such as Figure 14 As shown, sending the target access message to the target object includes:

[0083] Step S1402: Through intermediate network element devices, select the target packet transmission path that is in an idle state from multiple candidate packet transmission paths.

[0084] Step S1404: Send the resource access message to the target object through the target message transmission path.

[0085] Here, "candidate packet transmission path" refers to the packet transmission path configured in the intermediate network element device. In other words, a single port of an intermediate network device can have multiple packet transmission paths, or multiple elastic IP addresses. This allows for throughput expansion of the intermediate network element device, increasing the number of packets it can transmit per second and improving its packet transmission capacity. "Idle state" means that the candidate packet transmission path is currently not transmitting any other packets.

[0086] For example, when an intermediate network element sends a target access message to a tenant object, it can select a target message transmission path that is currently idle from its pre-configured multiple candidate message transmission paths for transmitting the target access message.

[0087] In one example, when throughput scaling of intermediate network element devices is required, elastic IP addresses can be adaptively reduced, thereby reducing packet transmission paths. In addition, multiple resource access rules can be created to increase the number of sessions, which can also achieve throughput scaling.

[0088] In this embodiment, by binding multiple elastic IP addresses to the ports of intermediate network element devices, multiple packet transmission paths are established, thereby expanding the throughput of intermediate network element devices, improving their packet transmission capabilities, and ultimately improving the efficiency of cross-network resource access between cloud services and tenant objects.

[0089] In one specific embodiment, the process of cross-network resource access between a cloud service and a tenant object includes: A first cloud host in the cloud service VPC responds to a resource access instruction for the tenant object VPC by first obtaining the resource access information indicated by the resource access instruction and the resource access rules of the tenant object. Based on the rule ID of the resource access rules, the resource access information is encapsulated at the virtual network layer to obtain a temporary access message. The temporary access message is sent to a switch, which performs physical network layer encapsulation on the temporary access message to obtain a resource access message for the tenant object. The switch sends the resource access message to an intermediate network element device, which performs network address translation on the resource access message to obtain a target access message. The intermediate network element device sends the target access message to the tenant object and receives the resource access result returned by the tenant object based on the target access message. Thus, the first cloud host in the cloud service VPC successfully accesses the second cloud host in the tenant object VPC.

[0090] In this embodiment, the first cloud host within the cloud service VPC responds to a resource access command for a second cloud host within the tenant object VPC. First, it obtains the resource access information indicated by the resource access command and the resource access rules for the tenant object. Then, based on the rule identifier of the resource access rules, it encapsulates the resource access information to obtain a resource access message for the tenant object. Finally, based on the resource access message, it performs resource access on the target object to obtain the resource access result for the tenant object. It can be seen that the key point of this embodiment is to introduce a network segment-independent resource access rule identifier for message encapsulation, thereby distinguishing resource access paths and avoiding the network segment conflict problem in the prior art. Moreover, the resource access rules have higher flexibility and can be dynamically adjusted according to actual needs to meet diverse business requirements. Therefore, this embodiment can effectively reduce the limitations of cross-network resource access between cloud services and tenant objects, making cross-network resource access between cloud services and tenant objects more flexible and further improving resource access efficiency.

[0091] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0092] Based on the same inventive concept, this application also provides a resource access apparatus for implementing the resource access method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more resource access apparatus embodiments provided below can be found in the limitations of the resource access method described above, and will not be repeated here.

[0093] In one exemplary embodiment, such as Figure 15 As shown, a resource access device is provided, including: an information acquisition module 1502, used to acquire resource access information indicated by the resource access instruction and resource access rules of the target object in response to a resource access instruction for a target object; a message encapsulation module 1504, used to encapsulate the resource access information based on the rule identifier of the resource access rules to obtain a resource access message for the target object; and a resource access module 1506, used to perform resource access on the target object according to the resource access message to obtain the resource access result of the target object.

[0094] In one embodiment, the message encapsulation module 1504 is further configured to: encapsulate the resource access information in a virtual network layer based on the rule identifier of the resource access rule to obtain a temporary access message; send the temporary access message to the switch, and encapsulate the temporary access message in a physical network layer through the switch to obtain a resource access message for the target object.

[0095] In one embodiment, the resource access module 1506 is further configured to: send a resource access message to an intermediate network element device, perform network address translation on the resource access message through the intermediate network element device to obtain a target access message; and send the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

[0096] In one embodiment, the resource access module 1506 is further configured to: send a target access message to a target object; receive a resource access result returned by the target object based on the target access message; the resource access result is obtained by the target object after encapsulating the target resource information requested by the target access message.

[0097] In one embodiment, the apparatus is further configured to: extract access permission information of the target object from the resource access rules; and, if the access permission information indicates that access is permitted, encapsulate the resource access information based on the rule identifier of the resource access rules.

[0098] In one embodiment, the resource access module 1506 is further configured to: filter the target packet transmission path that is idle from among multiple candidate packet transmission paths through an intermediate network element device; and send the resource access packet to the target object through the target packet transmission path.

[0099] Each module in the aforementioned resource access device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0100] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 16 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores resource access data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a resource access method.

[0101] Those skilled in the art will understand that Figure 16The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0102] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and resource access rules for the target object; encapsulating the resource access information based on the rule identifier of the resource access rules to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain the resource access result of the target object.

[0103] In one embodiment, when the processor executes the computer program, it further performs the following steps: based on the rule identifier of the resource access rule, it encapsulates the resource access information in a virtual network layer to obtain a temporary access message; it sends the temporary access message to the switch, and through the switch, it encapsulates the temporary access message in a physical network layer to obtain a resource access message for the target object.

[0104] In one embodiment, when the processor executes the computer program, it further performs the following steps: sending a resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; and sending the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

[0105] In one embodiment, when the processor executes the computer program, it further performs the following steps: sending a target access message to a target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained by the target object after encapsulating the target resource information requested by the target access message.

[0106] In one embodiment, when the processor executes the computer program, it further performs the following steps: extracting access permission information of the target object from the resource access rules; and encapsulating the resource access information based on the rule identifier of the resource access rules if the access permission information indicates that access is permitted.

[0107] In one embodiment, when the processor executes the computer program, it further performs the following steps: through an intermediate network element device, filtering out a target packet transmission path that is idle from multiple candidate packet transmission paths; and sending a resource access packet to a target object through the target packet transmission path.

[0108] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and resource access rules for the target object; based on the rule identifier of the resource access rules, encapsulating the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain the resource access result of the target object.

[0109] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: based on the rule identifier of the resource access rule, it encapsulates the resource access information in a virtual network layer to obtain a temporary access message; it sends the temporary access message to the switch, and through the switch, it encapsulates the temporary access message in a physical network layer to obtain a resource access message for the target object.

[0110] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending a resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; and sending the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

[0111] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending a target access message to a target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained by the target object after encapsulating the target resource information requested by the target access message.

[0112] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: extracting access permission information of the target object from the resource access rules; and encapsulating the resource access information based on the rule identifier of the resource access rules if the access permission information indicates that access is permitted.

[0113] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: filtering a target packet transmission path that is idle from multiple candidate packet transmission paths through an intermediate network element device; and sending a resource access packet to the target object through the target packet transmission path.

[0114] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and resource access rules for the target object; based on the rule identifier of the resource access rules, encapsulating the resource access information to obtain a resource access message for the target object; and performing resource access on the target object according to the resource access message to obtain a resource access result for the target object.

[0115] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: based on the rule identifier of the resource access rule, it encapsulates the resource access information in a virtual network layer to obtain a temporary access message; it sends the temporary access message to the switch, and through the switch, it encapsulates the temporary access message in a physical network layer to obtain a resource access message for the target object.

[0116] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending a resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; and sending the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

[0117] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending a target access message to a target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained by the target object after encapsulating the target resource information requested by the target access message.

[0118] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: extracting access permission information of the target object from the resource access rules; and encapsulating the resource access information based on the rule identifier of the resource access rules if the access permission information indicates that access is permitted.

[0119] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: filtering a target packet transmission path that is idle from multiple candidate packet transmission paths through an intermediate network element device; and sending a resource access packet to the target object through the target packet transmission path.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0121] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0122] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0123] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A resource access method, characterized by, The method comprises: in response to a resource access instruction for a target object, obtaining resource access information indicated by the resource access instruction and a resource access rule of the target object; based on a rule identifier of the resource access rule, performing virtual network layer encapsulation on the resource access information to obtain a temporary access message; sending the temporary access message to a switch, performing physical network layer encapsulation on the temporary access message through the switch to obtain a resource access message for the target object; performing resource access on the target object according to the resource access message to obtain a resource access result of the target object.

2. The method of claim 1, wherein, The performing resource access on the target object according to the resource access message to obtain a resource access result of the target object comprises: sending the resource access message to an intermediate network element device, performing network address translation on the resource access message through the intermediate network element device to obtain a target access message; sending the target access message to the target object through the intermediate network element device to obtain the resource access result of the target object.

3. The method of claim 2, wherein, The sending the target access message to the target object to obtain the resource access result of the target object comprises: sending the target access message to the target object; receiving a resource access result returned by the target object based on the target access message; the resource access result is obtained by the target object after encapsulating target resource information requested by the target access message.

4. The method of claim 1, wherein, The method further comprises: extracting access permission information of the target object from the resource access rule; in a case where the access permission information indicates that access is allowed, encapsulating the resource access information based on the rule identifier of the resource access rule.

5. The method of claim 2, wherein, The sending the target access message to the target object comprises: filtering, through the intermediate network element device, a target message transmission path in an idle state from a plurality of candidate message transmission paths; and sending the resource access message to the target object through the target message transmission path.

6. A resource access device, characterized by The apparatus comprises: an information obtaining module configured to, in response to a resource access instruction for a target object, obtain resource access information indicated by the resource access instruction and a resource access rule of the target object; a message encapsulating module configured to, based on a rule identifier of the resource access rule, perform virtual network layer encapsulation on the resource access information to obtain a temporary access message; and send the temporary access message to a switch, perform physical network layer encapsulation on the temporary access message through the switch to obtain a resource access message for the target object; a resource accessing module configured to perform resource access on the target object according to the resource access message to obtain a resource access result of the target object.

7. The apparatus of claim 6, wherein, The resource accessing module is further configured to: send the resource access message to an intermediate network element device, perform network address translation on the resource access message through the intermediate network element device to obtain a target access message; and The intermediate network element device sends the target access message to the target object to obtain a resource access result of the target object.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5. The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images