Computing power service access method and system and node information uploading method of computing power service

Abstract

The invention discloses a computing power service access method and system and a computing power service node information uploading method. The method is applied to a cloud host, and comprises the following steps: receiving a cloud host access request; determining a private network address and a private network port corresponding to a target computing power service according to a private network address and a private network port corresponding to the cloud host in the cloud host access request based on a target computing power service mapping relationship configured by the cloud host, and performing message information replacement to obtain a target access request; the target access request is forwarded to a machine room gateway corresponding to the target computing power service, so that the machine room gateway forwards the target access request to a service instance corresponding to the target computing power service, and the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP. The technical problem that the computing power resources are wasted due to the fact that the computing power services in the computing power resources without fixed IP addresses cannot be directly accessed is solved.

Description

Technical Field

[0001] The present invention relates to the field of computing power network technology, and in particular to a computing power service access method, system and a computing power service node information uploading method. Background Art

[0002] Currently, there are many types of computing service resources with different performances. If they are integrated together, they can achieve effective collaborative work of resources. Through the computing network, different computing resources can work together to achieve higher computing efficiency and performance. However, due to the existence of multiple computing service resources, there are certain difficulties in accessing computing services. Some computing services cannot be directly accessed, resulting in a waste of computing resources.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a computing power service access method, system and node information uploading method of computing power service, so as to at least solve the technical problem that computing power resources are wasted due to the inability to directly access computing power services in computing power resources without fixed IP addresses.

[0005] According to one aspect of an embodiment of the present invention, a computing power service access method is provided, which is applied to a cloud host, and includes: receiving a cloud host access request, wherein the cloud host access request is determined by a data center gateway based on a pre-configured cloud host address conversion rule according to the data center access request, and the data center access request is obtained by converting an initial access request received from a user terminal by the computing power gateway based on a preset non-fixed IP computing power service address conversion rule; based on a target computing power service mapping relationship configured by the cloud host, according to a private network address and a private network port corresponding to the cloud host in the cloud host access request, determining a private network address and a private network port corresponding to the target computing power service, replacing the message information, and obtaining a target access request; forwarding the target access request to a computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to a service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

[0006] Optionally, the target access request is forwarded to the computer room gateway corresponding to the target computing power service, including: determining the first IP security encrypted tunnel based on the private network address and private network port corresponding to the target computing power service in the target access request; forwarding the target access request to the computer room gateway corresponding to the target computing power service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service.

[0007] Optionally, the target access request is forwarded to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, including: adding an IPsec header to the target access request, obtaining a modified target access request and forwarding the modified target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway removes the IPsec header in the modified target access request to obtain the target access request and forwards it to the service instance corresponding to the target computing power service.

[0008] Optionally, the above method also includes: receiving a reply message sent by the service instance corresponding to the target computing power service; based on the configured source address conversion rules, according to the source address and source port in the reply message, determining the private network address and private network port of the cloud host and obtaining a first reply message; forwarding the first reply message to the data center gateway, so that the data center gateway converts the first reply message into a second reply message and forwards the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rules and sends the target reply message to the user end.

[0009] According to one aspect of an embodiment of the present invention, a computing power service access method is provided, which is applied to a computing power gateway, including: receiving an initial access request issued by a user terminal; based on a preset non-fixed IP computing power service address conversion rule, determining the public network address and public network port of the corresponding cloud host according to the destination address and destination port in the initial access request, and replacing the message information to obtain a data center access request; forwarding the data center access request to a data center gateway, so that the data center gateway converts the data center access request into a cloud host access request based on the pre-configured cloud host address conversion rule and forwards it to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0010] Optionally, based on the preset non-fixed IP computing power service address conversion rule, the destination address and destination port in the initial access request are used to determine the corresponding public network address and public network port of the cloud host, and the message information is replaced to obtain a data center access request, including: determining the service identifier corresponding to the target computing power service according to the initial access request; determining the target service instance identifier according to the service identifier corresponding to the target computing power service based on the non-fixed IP computing power service address conversion rule; and obtaining the data center access request after replacing the message information according to the public network address and public network port of the cloud host corresponding to the target service instance identifier.

[0011] Optionally, the above method also includes: receiving a second reply message forwarded by the data center gateway, wherein the second reply message is obtained by the data center gateway according to the conversion of the first reply message, and the first reply message is obtained by the cloud host based on the configured source address conversion rule according to the reply message sent by the service instance corresponding to the received target computing power service; based on the non-fixed IP computing power service address conversion rule, determine the service identifier according to the public network address and public network port of the cloud host in the second reply message; based on the service identifier, replace the public network address and public network port of the cloud host to generate a target reply message; and send the target reply message to the user end.

[0012] According to one aspect of an embodiment of the present invention, a computing power service access method is provided and applied to a data center gateway, including: receiving a data center access request issued by a computing power gateway, wherein the data center access request is obtained by converting an initial access request received from a user terminal by the computing power gateway based on a preset non-fixed IP computing power service address conversion rule; based on a pre-configured cloud host address conversion rule, according to the public network address and public network port of the cloud host in the data center access request, determining a private network address and private network port corresponding to the cloud host and performing message information replacement to obtain a cloud host access request; forwarding the cloud host access request to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards it to a computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to a service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0013] Optionally, the above method also includes: receiving a first reply message forwarded by the cloud host, wherein the first reply message is obtained by converting the received reply message sent by the service instance corresponding to the target computing power service based on the configured source address conversion rule; converting the private network address and private network port of the cloud host in the first reply message into the public network address and public network port of the cloud host to obtain a second reply message; forwarding the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rule and sends the target reply message to the user end.

[0014] According to another aspect of an embodiment of the present invention, a method for uploading node information of a computing power service is provided, which is applied to a computer room gateway, wherein the method is applied to any one of the above-mentioned computing power service access methods, including: uploading and storing the node information corresponding to the computing power service to a computing power network management platform, so that the computing power network management platform determines the address conversion rules of the computing power service without a fixed IP according to the node information corresponding to the computing power service and sends it to the computing power gateway, wherein the node information corresponding to the computing power service includes a corresponding service identifier and a service instance identifier, the service instance corresponding to the computing power service is a computing power service instance without a fixed IP, the service identifier represents the unified access destination address and destination port corresponding to the target computing power service, and the service instance identifier represents the cloud host public network address and public network port corresponding to the computing power service instance without a fixed IP.

[0015] Optionally, the node information corresponding to the computing power service in the computer room gateway is uploaded to the computing power network management platform, including: uploading the node information corresponding to the computing power service to the computing power network management platform based on the second IP security encrypted tunnel.

[0016] According to another aspect of an embodiment of the present invention, a computing power service access system is also provided, which uses any of the above computing power service access methods to access computing power services, including: a computing power gateway, a data center and a cloud host, wherein the computing power gateway is used to receive an initial access request sent by a user end, and based on a preset non-fixed IP computing power service address conversion rule, determine the public network address and public network port of the corresponding cloud host according to the destination address and destination port in the initial access request, and obtain a data center access request after replacing the message information; the data center gateway is located in the data center, and is used to convert the cloud host address configured on the data center gateway according to the cloud host in the data center access request. The public network address and public network port of the cloud host are used to determine the private network address and private network port corresponding to the cloud host, replace the message information, and obtain the cloud host access request; the cloud host is used to determine the private network address and private network port corresponding to the target computing service based on the target computing service mapping relationship configured by the cloud host, according to the private network address and private network port corresponding to the cloud host in the cloud host access request, replace the message information, and obtain the target access request, and forward the target access request to the computer room gateway corresponding to the target computing service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing service, wherein the target computing service is a computing service without a fixed IP.

[0017] Optionally, the above system also includes a computing power network management platform, wherein the computing power network management platform is used to receive node information corresponding to the computing power service uploaded by the computer room gateway, determine the address conversion rules of the computing power service without a fixed IP based on the node information corresponding to the computing power service, and send the address conversion rules of the computing power service without a fixed IP to the computing power gateway, wherein the node information corresponding to the computing power service includes the corresponding service identifier and service instance identifier, the service identifier represents the unified access destination address and destination port corresponding to the target computing power service, and the service instance identifier represents the cloud host public network address and public network port corresponding to the computing power service instance without a fixed IP.

[0018] Optionally, the cloud host is set up in a data center.

[0019] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, the non-volatile storage medium including a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any one of the above-mentioned computing power service access methods.

[0020] According to another aspect of an embodiment of the present invention, a computer device is provided. The computer device includes a processor, and the processor is used to run a program. When the program is run, any one of the above-mentioned computing power service access methods is executed.

[0021] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, any one of the above-mentioned computing power service access methods is implemented.

[0022] In an embodiment of the present invention, a computing power service access method is adopted and applied to a cloud host, by receiving a cloud host access request, wherein the cloud host access request is determined by a data center gateway based on a pre-configured cloud host address conversion rule according to the data center access request, and the data center access request is obtained by converting the initial access request received from the user terminal by the computing power gateway based on the preset non-fixed IP computing power service address conversion rule; based on the target computing power service mapping relationship configured by the cloud host, according to the private network address and private network port corresponding to the cloud host in the cloud host access request, the private network address and private network port corresponding to the target computing power service are determined, and after replacing the message information, the target access request is obtained; the target access request is forwarded to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance, so that the user can access the computing power resources without a fixed IP address, thereby achieving the technical effect of improving the utilization rate of computing power resources, and then solving the technical problem that the computing power resources are wasted due to the inability to directly access the computing power services in the computing power resources without a fixed IP address. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0024] Figure 1 It is a flowchart of a computing power service access method applied to a cloud host according to an embodiment of the present invention;

[0025] Figure 2 It is a flowchart of a computing power service access method applied to a computing power gateway according to an embodiment of the present invention;

[0026] Figure 3 It is a flowchart of a computing power service access method applied to a data center gateway according to an embodiment of the present invention;

[0027] Figure 4 is an architecture diagram of a computing power service access system provided according to an embodiment of the present invention;

[0028] Figure 5 It is an architecture diagram of a computing power service access system provided according to an optional embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] At present, there are a large number of scattered small-scale computing resources scattered in computer rooms with poor network environment. The host or server resources in these computer rooms were previously mainly planned for local users to access the external network or to complete the work of pushing local monitoring and collection information to external servers. Therefore, the computer room did not plan a fixed IP address in the initial design stage. That is, this type of computing resources has the ability to access the external network but cannot be accessed by external users, which leads to the waste of these computing resources. In order to solve this technical problem, the present invention proposes a computing service access method. Figure 1 FIG. 1 is a flow chart of a computing service access method applied to a cloud host according to an embodiment of the present invention. Figure 1 As shown, the method is applied to a cloud host and includes the following steps:

[0032] Step S102, receiving a cloud host access request, wherein the cloud host access request is determined by the data center gateway based on the pre-configured cloud host address conversion rules according to the data center access request, and the data center access request is obtained by the computing power gateway converting the initial access request received from the user terminal based on the preset non-fixed IP computing power service address conversion rules.

[0033] In this step, a cloud host access request is received, wherein the cloud host access request includes the private network address and private network port corresponding to the cloud host. When the user wants to access the computing service, it will send an initial access request to the computing service access system, and the initial request will be converted by the computing gateway and the data center gateway in turn to form a cloud host access request. Among them, the service identifier and service port corresponding to the computing service that the user wants to access will be used as the destination address and destination port of the message in the initial access request.

[0034] The user can enter the destination address and destination port, i.e., the service identifier, in the browser to initiate a request to access the computing service. For example, enter 5.5.5.5:80 in the browser to initiate a request to access the computing service. The user can set the computing gateway in the computing service access system as the default gateway for traffic, so that the computing gateway in the computing service access system will receive the access request issued by the user.

[0035] After the computing power gateway receives the initial access request, it will modify the destination address and destination port in the initial access request to the public network address and access port of the cloud host based on the non-fixed computing power service address conversion rule, that is, the correspondence between the service identifier of the computing power service and the public network address and access port of the corresponding cloud host, and obtain a data center access request. The non-fixed computing power service address conversion rule can be obtained from the computing power network management platform.

[0036] The data center access request will be sent to the data center gateway, which is a device located at the edge of the data center network and is responsible for connecting the internal network and the external network. At the data center gateway, the public IP address and port number of the cloud host will be mapped to the private IP address and port number of the cloud host, and the cloud host access request will be obtained and then further forwarded to the cloud host. For example, after the data center access request arrives at the data center, the data center egress gateway will automatically modify the cloud host public network address 47.xxx.xxx.186 to the private network address 172.27.21.76 of the cloud host to obtain the cloud host access request.

[0037] Step S104, based on the target computing service mapping relationship configured by the cloud host, determine the private network address and private network port corresponding to the target computing service according to the private network address and private network port corresponding to the cloud host in the cloud host access request, replace the message information, and obtain the target access request.

[0038] After receiving the cloud host access request forwarded from the data center gateway, the cloud host will perform address conversion according to the private network address and private network port corresponding to the cloud host stored in the request. The cloud host can convert the private network address and private network port corresponding to the cloud host into the private network IP_C+PORT_C of the non-fixed IP computing service according to its own DNAT configuration (destination address conversion rule), that is, the target computing service mapping relationship configured by the cloud host, and then continue to forward. After receiving the access request, the cloud host will map the private network address and private network port corresponding to the cloud host in the access request to the real private network IP and port number of the service deployment based on the destination network address conversion rule (DNAT), where the destination network address conversion (Destination Network Address Translation, referred to as destination NAT or DNAT) is a network address conversion technology that can change the destination IP address and port information in the data packet header. DNAT rules can be some standard destination NAT rules for common application scenarios. These rules can be used directly without customization, or the destination NAT rules can be customized according to specific business needs or security policies. Among them, specific source IP addresses, destination IP addresses, port numbers or protocol types can be included.

[0039] The cloud host selects a free port number PORT_B as a mapping port for accessing the computing power service without a fixed IP based on the transmission type TYPE_A for accessing the computing power service without a fixed IP.

[0040] You can configure NAT mapping rules on the cloud host in advance: For the traffic from users accessing the non-fixed IP computing service, set the DNAT conversion rules: Perform DNAT conversion on the packets whose destination address, transmission type and destination port match the cloud host private network IP_B+TYPE_A+port PORT_B (the non-fixed IP computing service mapping port), convert the destination address and destination address of the packet to the non-fixed IP computing service private network IP_C+PORT_C and then continue to forward. For the traffic from the non-fixed IP computing service back to the user, set SNAT conversion: The cloud host will perform SNAT conversion on the packets whose source address and transmission type match the non-fixed IP computing service private network IP_C+TYPE_A, convert the source address to the cloud host private network IP_B and then continue to forward. The cloud host can convert the destination address and destination address of the packet, that is, the private network address and corresponding port number in the cloud host access request, to the non-fixed IP computing service private network IP_C+PORT_C according to its own DNAT configuration, and then obtain the target access request.

[0041] As an access proxy for computing resources without fixed IP addresses, cloud hosts are access bridges for users to access computing resources without fixed IP addresses. Cloud hosts can be located in data centers, which can be divided by region. One or more cloud hosts with fixed public IP addresses can be enabled in a data center in a region, and cloud hosts can be accessed externally by users. Use cloud hosts as access proxy for computing resources without fixed IP addresses in the region. Among them, cloud hosts can have two addresses, one is a public IP address, i.e. a north-south address, which can be used for external users to access, and the other is a private IP address of the data center, which is used for the east-west internal network within the data center. When users want to access cloud hosts externally, they need to access them through the public IP address and port of the cloud host. When there are hosts inside the data center that need to access the cloud hosts, they need to access them through the private IP address and port of the cloud host.

[0042] For example, you can open a cloud host with a fixed public IP in the data center as an access proxy for computing resources without a fixed IP. The east-west private network address of the cloud host is 172.27.21.76, and the bound public network address is 47.xxx.xxx.186.

[0043] Step S106, forwarding the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

[0044] According to the private network address corresponding to the target computing service, the cloud host can forward the cloud host access request to the computer room gateway corresponding to the target computing service. For example, the cloud host can forward the cloud host access request through the first IP security encryption tunnel (IPSEC tunnel), that is, according to the configuration of the flow of interest, the traffic (cloud host access request) enters the ipsec tunnel and is sent to the egress router of the computer room without a fixed IP. After decapsulation of the tunnel, it continues to be forwarded to the computing service instance through the computer room gateway according to the real private network IP C+PORT C.

[0045] Among them, the cloud host can install the client of IP security encrypted tunnel (IPSEC client). Based on this client, the cloud host can establish IP security encrypted tunnel (IPSEC encrypted tunnel) with computing resources without fixed IP addresses. Similarly, the IPSEC client can be turned on on the original network exit router or optical modem of the computer room where the computing resources without fixed IP addresses are located. Then assign an intranet address to each computing resource in the computer room and connect it to the exit router or optical modem of the computer room. After the cloud host and computing resources have completed the configuration of the IPSEC client, the IPSEC function client of the computer room where the computing resources without fixed IP addresses are located initiates a connection request, and the IPSEC encrypted logical tunnel to the public IP address bound to the cloud host can be established. When the IP address of the computing resources without fixed IP addresses changes, it will not affect the use of the upper-layer IPSEC encrypted tunnel.

[0046] As an optional embodiment, forwarding the target access request to the computer room gateway corresponding to the target computing power service includes: determining the first IP security encrypted tunnel based on the private network address and private network port corresponding to the target computing power service in the target access request; forwarding the target access request to the computer room gateway corresponding to the target computing power service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service.

[0047] Optionally, according to the configuration of the interested message of the IPSEC tunnel, the access request to the service deployment will enter the IP security encrypted tunnel (IPSEC encrypted tunnel) for forwarding. After reaching the IPSEC exit of the computer room corresponding to the computing power resource without a fixed IP address, the computer room gateway can find the port number of the corresponding host according to the private network address and private network port corresponding to the target computing power service, and the access request will reach the service instance corresponding to the corresponding target computing power service. Among them, the configuration of the interested message of the IPSEC tunnel usually refers to the network traffic that triggers the establishment of the IPSec tunnel and applies encryption and integrity protection. The matching rules of the interested messages can be configured to identify and filter out the interested messages. Specifically, these rules can be based on IP addresses, port numbers, protocol types, etc. The use of IP security encrypted tunnels achieves the purpose of accessing computing power resources without fixed IP addresses, while effectively preventing attackers from obtaining computing power information and ensuring the security of message transmission between computing power resources and user terminals.

[0048] By using the cloud host as an access proxy and the bidirectional NAT function, the problem of not being able to directly access computing resources without a fixed IP address is solved. And by building an IPSEC encrypted logical tunnel, reliable access to computing resources without a fixed IP address and secure transmission of computing services are achieved.

[0049] As an optional embodiment, the target access request is forwarded to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, including: adding an IPsec header to the target access request, obtaining a modified target access request and forwarding the modified target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway removes the IPsec header in the modified target access request to obtain the target access request and forwards it to the service instance corresponding to the target computing power service.

[0050] Among them, IPsec (Internet Protocol Security) is a network layer security protocol that provides confidentiality, integrity and authentication of data transmission on the IP layer. IPsec can work in two modes: transport mode and tunnel mode. Transport mode is mainly used to protect communication between two hosts, while tunnel mode can be used to protect communication between the entire network. IPsec Header is an important part of the IPsec protocol, which contains the necessary information for encrypting and authenticating data packets. There are two types of IPsec headers: ESP (Encapsulating Security Payload) header and AH (Authentication Header) header. When the cloud host forwards the target access request to the computer room gateway, the ipsec header can be added to the target access request, and then the modified target access request is forwarded to the computer room gateway. This ensures the security of data transmission between the cloud host and the computer room gateway. IPsec supports two-way authentication to ensure the identity of both parties in communication. This helps prevent man-in-the-middle attacks and increase the security of the communication link. After removing the ipsec header at the computer room gateway, it is convenient to further process the access request.

[0051] As an optional embodiment, a reply message sent by a service instance corresponding to a target computing power service is received; based on the configured source address conversion rules, the private network address and private network port of the cloud host are determined according to the source address and source port in the reply message, and a first reply message is obtained; the first reply message is forwarded to a data center gateway, so that the data center gateway converts the first reply message into a second reply message and forwards the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rules and sends the target reply message to the user end.

[0052] Optionally, after the computing power resource has processed the user's access request, a response message will be generated for the user. The response message can be forwarded to the cloud host first, for example, it can be forwarded to the cloud host through an IP security encrypted tunnel. The cloud host can convert the real private IP address and private port of the computing power resource without a fixed IP address in the response message into the private IP address and private port of the cloud host based on the source network address translation rule (SNAT). The cloud host forwards the access request, which passes through the data center gateway and the computing power gateway in turn. The private network address and private network port of the cloud host will finally be converted into a service identifier to obtain the target response message, and the target response message will be forwarded to the user through the computing power gateway.

[0053] For example, after the computing power service processes the user request, it returns a response message. The message enters the IPSEC tunnel and is sent to the cloud host. After SNAT conversion, the cloud host replaces the source address from 192.168.1.3 to 172.27.21.76, which is the private network address of the cloud host, and sends it to the data center gateway. The data center gateway converts the source address from 172.27.21.76 to 47.xxx.xxx.186, which is the public network address of the cloud host, and sends it to the computing power gateway. The computing power gateway will convert the source address and source port information back to 5.5.5.5:80, which is the service identifier, and finally send the target response message to the user.

[0054] In summary, the forwarding process of the computing power service to the user after processing the user's traffic request is opposite to the forwarding process of the access request. It first goes through the IPSEC tunnel to reach the cloud host, and then is forwarded through the data center gateway and computing power gateway in turn to the user end.

[0055] Figure 2 FIG. 1 is a flow chart of a method for accessing a computing power service applied to a computing power gateway according to an embodiment of the present invention. Figure 2 As shown, the method is applied to a computing power gateway and includes the following steps:

[0056] Step S202: receiving an initial access request sent by a user terminal.

[0057] Step S204, based on the preset non-fixed IP computing power service address conversion rules, according to the destination address and destination port in the initial access request, determine the public network address and public network port of the corresponding cloud host, and replace the message information to obtain a data center access request.

[0058] Step S206, forwarding the data center access request to the data center gateway, so that the data center gateway converts the data center access request into a cloud host access request based on the pre-configured cloud host address conversion rules and forwards it to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

[0059] The user can enter the destination address and destination port, i.e., the service identifier, in the browser to initiate an access request to the computing service, i.e., the initial access request. For example, enter 5.5.5.5:80 in the browser to initiate a request to access the computing service. The user can set the computing gateway in the computing service access system as the default gateway for traffic, so that the computing gateway in the computing service access system will receive the initial access request issued by the user.

[0060] After receiving the initial access request, the computing power gateway can modify the destination address and destination port in the initial access request to the public network address and access port of the cloud host based on the non-fixed computing power service address conversion rules integrated and issued by the computing power network management platform, that is, the correspondence between the service identifier of the computing power service and the public network address and access port of the corresponding cloud host, and obtain the data center access request.

[0061] As an optional embodiment, based on the preset non-fixed IP computing power service address conversion rule, the destination address and destination port in the initial access request are used to determine the corresponding public network address and public network port of the cloud host, and the message information is replaced to obtain a data center access request, including: determining the service identifier corresponding to the target computing power service according to the initial access request; determining the target service instance identifier according to the service identifier corresponding to the target computing power service based on the non-fixed IP computing power service address conversion rule; and obtaining the data center access request after replacing the message information according to the public network address and public network port of the cloud host corresponding to the target service instance identifier.

[0062] Optionally, after receiving the initial access request initiated by the user, the computing power gateway will identify the destination address and destination port in the initial access request, that is, the service identifier. For example, the service identifier can be 5.5.5.5:80, where 5.5.5.5 is the destination address and 80 is the destination port. According to the destination address and destination port SID_A:PORT_D in the initial access request, the computing power gateway can find the service instance access address corresponding to the service identifier as IP_A:PORT_B, and modify the destination address and destination port of the message to the public network + access port of the cloud host for further forwarding. Among them, the correspondence between the service identifier and the service instance identifier can be pre-stored in the computing power network management platform, and the computing power gateway can read it directly from it.

[0063] For example, if the service ID is 5.5.5.5:80, the computing power gateway queries the corresponding computing power routing information in the computing power routing table based on the service ID, and then modifies the destination address and destination port of the message to the public network address and port number 47.xxx.xxx.186:50000 of the cloud host to obtain the data center access request.

[0064] As an optional embodiment, a second reply message forwarded by a data center gateway is received, wherein the second reply message is obtained by the data center gateway according to a conversion of a first reply message, and the first reply message is obtained by the cloud host according to a configured source address conversion rule based on a reply message sent by a service instance corresponding to the received target computing power service; based on the non-fixed IP computing power service address conversion rule, the service identifier is determined according to the public network address and public network port of the cloud host in the second reply message; based on the service identifier, the public network address and public network port of the cloud host are replaced to generate a target reply message; and the target reply message is sent to the user end.

[0065] Optionally, the computing power gateway receives the second response message forwarded by the data center gateway, and there is no fixed IP computing power service address conversion rule. According to the public network address and public network port of the cloud host in the second response message, the service identifier is determined. The target response message is determined according to the service identifier, and the target response message is sent to the user end.

[0066] Figure 3 FIG. 1 is a flow chart of a computing power service access method applied to a data center gateway according to an embodiment of the present invention. Figure 3 As shown, the method is applied to a data center gateway and includes the following steps:

[0067] Step S302, receiving a data center access request issued by a computing power gateway, wherein the data center access request is obtained by converting an initial access request received from a user terminal by the computing power gateway based on a preset non-fixed IP computing power service address conversion rule.

[0068] Step S304, based on the pre-configured cloud host address conversion rules, according to the public network address and public network port of the cloud host in the data center access request, determine the private network address and private network port corresponding to the cloud host and replace the message information to obtain the cloud host access request.

[0069] Step S306, forwarding the cloud host access request to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards it to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

[0070] The data center gateway is a device located at the edge of the data center network, responsible for connecting the internal network and the external network. It configures the correspondence between the public network address and public network port of the cloud host and the private network address and private network port. The data center access request will be sent to the data center gateway, which will map the public network IP address and port number of the cloud host to the private network IP address and port number of the cloud host, obtain the cloud host access request, and then further forward the cloud host access request to the cloud host.

[0071] Specifically, after the data center access request reaches the data center, the data center egress gateway will automatically modify the cloud host public network address 47.xxx.xxx.186 to the cloud host's private network address 172.27.21.76 to obtain the cloud host access request.

[0072] As an optional embodiment, a first reply message forwarded by the cloud host is received, wherein the first reply message is obtained by converting the received reply message sent by the service instance corresponding to the target computing power service based on the configured source address conversion rule; the private network address and private network port of the cloud host in the first reply message are converted into the public network address and public network port of the cloud host to obtain a second reply message; the second reply message is forwarded to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rule and sends the target reply message to the user end.

[0073] Optionally, the data center gateway will receive a first reply message forwarded by the cloud host, and according to the correspondence between the public network address and public network port of the cloud host configured by itself and the private network address and private network port, convert the private network address and private network port in the first reply message into the public network address and public network port of the cloud host to obtain a second reply message, and send the second reply message to the computing power gateway, wherein the computing power gateway will determine the target reply message based on the second reply message, and forward the target reply message to the user end.

[0074] Through the above steps, the purpose of enabling users to access computing resources without fixed IP addresses is achieved, thereby achieving the technical effect of improving the utilization rate of computing resources, and further solving the technical problem of wasting computing resources due to the inability to directly access computing services in computing resources without fixed IP addresses.

[0075] The present invention also proposes a method for uploading node information of a computing power service, which is applied to any of the above-mentioned computing power service access methods, including:

[0076] The node information corresponding to the computing power service is uploaded and stored to the computing power network management platform, so that the computing power network management platform determines the address conversion rules of the computing power service without a fixed IP according to the node information corresponding to the computing power service and sends it to the computing power gateway, wherein the node information corresponding to the computing power service includes the corresponding service identifier and service instance identifier. The service instance corresponding to the computing power service is a computing power service instance without a fixed IP. The service identifier represents the unified access destination address and destination port corresponding to the target computing power service, and the service instance identifier represents the cloud host public network address and public network port corresponding to the computing power service instance without a fixed IP.

[0077] Optionally, the node information corresponding to the computing service in the computer room gateway can be stored in the computing network platform for management, wherein the node information can include the service identifier and service instance identifier corresponding to the computing service. The computer room gateway can report the above node information to the computing network management platform, and the computing gateway can query the public IP address and public port number of the cloud host corresponding to the service identifier from the non-fixed computing service address conversion rule information integrated and issued by the computing network management platform. That is, the user end will initiate an access request based on the service identifier, and the computing gateway will query the public IP address and port number of the corresponding cloud host in the information issued to the computing gateway by the computing network management platform according to the service identifier and service port, so that the computing gateway can convert the initial access request into a data center access request according to the public IP address and public port of the cloud host and forward it to the data center gateway. The private IP address and port number of the cloud host will be determined at the data center gateway, and then the access request will be forwarded to the cloud host, and finally forwarded to the computing resource through the cloud host.

[0078] As an optional embodiment, the node information corresponding to the computing power service in the computer room gateway is uploaded to the computing power network management platform, including: uploading the node information corresponding to the computing power service to the computing power network management platform based on the second IP security encrypted tunnel.

[0079] The computing power resources can also upload node information to the computing power network management platform based on IP security encrypted tunnels (IPSEC encrypted tunnels). The computing power service client can be installed at the computer room gateway. After the client is started, it can actively initiate an IPSEC encrypted tunnel connection request to the computing power network management platform based on the pre-configured address of the computing power network management platform. After the IPSEC encrypted tunnel between the computing power service client and the computing power network management platform is established, the computing power resources without fixed IP addresses in the computer room gateway can upload node information to the computing power network management platform based on the IPSEC encrypted tunnel.

[0080] The computer room gateway includes multiple computing resources without fixed IP addresses, among which the computing resources without fixed IP addresses can report the node information deployed on the local computing resources, that is, the computing service information, to the computing network management platform based on the IPSEC encrypted tunnel. The reported computing service information includes: service identification information SID_A:PORT_D, and access information of the service instance. The access information of the service instance is the private network address IP_C:PORT_C assigned to the computer room where the service is deployed. The computing network management platform will obtain the service information without fixed IP addresses, integrate the computing node information, update the service instance access information of the computing service to the public network address of the data center cloud host and the service mapping port IP_A:PORT_B, and notify the updated information to the computing gateway device. In this way, the computing gateway device can perform address conversion based on the above information.

[0081] Specifically, the computing power network management platform can be deployed on the public network address 47.xx111, and the computing power network management platform installs the IPSEC client. The computing power service collection module on the host in the computer room without a fixed IP reports the computing power service node information to the computing power network management platform through IPSEC. The reported information may include service identification, service port, protocol type, service instance access address, service instance access port, service private network vrf information, number of CPU cores of the service cloud host, CPU utilization of the service cloud host, memory of the service cloud host, remaining available memory of the service cloud host, disk storage space of the service cloud host, and remaining available disk storage space of the service cloud host. Among them, the service identification is 5.5.5.5, the port service is 80, the protocol type is TCP, and the service instance access address is 192.168.1.3:50000 (the actual deployment address, but this address is a private network address and cannot be directly accessed by external users). The computing power network management platform updates the computing power information. According to the deployment of the cloud host network, the computing power service information is updated to: service identifier 5.5.5.5, port service 80, protocol type TCP, service instance access address 47.xxx.xxx.186:50000; integrated and updated to the new computing power service information. The computing power network management platform continues to send the updated computing power service information to the computing power gateway, which receives and stores it in the computing power routing table to form a computing power route, corresponding to the service identifier 5.5.5.5, port service 80, protocol type TCP, and service instance access address 47.xxx.xxx.186:50000.

[0082] Here is a specific example:

[0083] S1. System construction: Set up a cloud host with a fixed public IP address in a data center within the region, where the private IP address of the cloud host is 172.27.21.76 and the bound public IP address is 47.xxx.xxx.186. Install and enable the IPSEC client function on the network exit router or optical modem of the computer room where the computing resources without fixed IP addresses are located. Configure the private IP address 192.168.1.3 on the host in the computer room that plans to provide services, and deploy the service on the TCP 50000 port of the host. The host is connected to the same network segment interface of the computer room exit router or optical modem, which is the private network gateway of the host of the computing service. Complete the IPSEC client configuration for the cloud host and the computer room where the computing resources without fixed IP are located. The IPSEC client for the computer room where the computing resources without fixed IP are located uses IKE brutal mode as the connection initiator to establish a two-way IPSEC encrypted logical tunnel, forming a two-way IPSEC encrypted tunnel between the exit of the computer room without fixed IP address and the public network address 47.xxx.xxx.186 of the cloud host.

[0084] S2. Cloud host configuration: Set up DNAT conversion on the cloud host to forward the traffic accessing the cloud host to the specific service deployed on the computing power resources without fixed IP. Configure DNAT rules: Map the traffic accessing 172.27.21.76:50000 (50000 is the idle TCP interface of the cloud host, and other port numbers can also be selected) to the deployment address of the service: 192.168.1.3:50000. Set up SNAT conversion, modify the source address and source port information of the traffic returned to the user by the computing power service without fixed IP, and forward it to the user. Configure SNAT rules: Map the source address of the traffic whose source address is the computing power server address 192.168.1.3 to the private network address of the cloud host: 172.27.21.76.

[0085] S3. Computing power resource management: Deploy the computing power network management platform on the public network address 47.xx111, install the IPSEC client on the computing power network management platform, and complete the initial configuration. Continue to use the IPSEC client installed and enabled on the network exit router or optical modem in the computer room where the computing power resources without fixed IP addresses are located, and complete the initial configuration. Complete the configuration of the IPSEC function client in the cloud host and the computer room where the computing power resources without fixed IP addresses are located. The IPSEC function client in the computer room where the computing power resources without fixed IP addresses are located uses IKE brutal mode as the connection initiator to establish a two-way IPSEC encrypted logical tunnel, forming a two-way IPSEC encrypted tunnel between the exit of the computer room without fixed IP addresses and the public network address 47.xx111 of the computing power network management platform. Install the computing power service client on the computing power resource host without fixed IP addresses, actively initiate an access request to the computing power network management platform, and report the node information of the computing power service to the computing power network management platform through the IPSEC encrypted tunnel. Among them, the reported information can include the following: service identifier and the cloud host public network IP address and port number corresponding to the service identifier. For example, the service ID is 5.5.5.5, the service port is 80, the protocol type is TCP, the cloud host public IP address is 47.xxx.xxx.186, the service instance access port number is 50000, and the service private network vrf information is 0.

[0086] S4, User access: The user initiates a computing service access request based on the service ID, enters 5.5.5.5:80 in the browser, accesses the service, and the user sets the computing gateway as the default gateway for traffic, so the traffic reaches the computing gateway. The computing gateway finds the corresponding computing routing information based on the service ID 5.5.5.5:80 in the computing routing table, modifies the destination address and destination port in the message to the service instance access address 47.xxx.xxx.186:50000, and further forwards it as the destination address of the service node. After the traffic reaches the data center, the data center egress gateway will automatically modify the destination address 47.xxx.xxx.186 of the message to the private network address 172.27.21.76 of the cloud host corresponding to the public network address. After the message reaches the cloud host according to the modified destination address, the TCP traffic accessing 172.27.21.76:50000 is mapped to the deployment address of the real service: 192.168.1.3:50000 according to the DNAT configuration on the cloud host. According to the configuration of the IPSEC tunnel's message of interest, the message destined for the destination address 192.168.1.3 will enter the IPSEC tunnel for forwarding and reach the IPSEC egress of the computing resource room without a fixed address. It will then be further forwarded to port 50000 of the 192.168.1.3 host according to the intranet address. Finally, the message reaches the computing service deployed on the host in the room without a fixed IP address.

[0087] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0088] Through the description of the above implementation methods, those skilled in the art can clearly understand that the computing power service access method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0089] According to an embodiment of the present invention, a computing power service access system for implementing the above computing power service access method is also provided. Figure 4 is an architecture diagram of a computing power service access system provided according to an embodiment of the present invention, such as Figure 4 As shown, the computing power service access system includes: a computing power gateway, a data center and a cloud host, wherein the computing power gateway is used to receive the initial access request sent by the user end, and based on the preset non-fixed IP computing power service address conversion rule, determine the corresponding cloud host's public network address and public network port according to the destination address and destination port in the initial access request, and obtain the data center access request after replacing the message information; the data center gateway is located in the data center, and is used to determine the private network corresponding to the cloud host according to the public network address and public network port of the cloud host in the data center access request based on the cloud host address conversion rule configured on the data center gateway. The cloud host determines the private network address and private network port corresponding to the target computing service based on the mapping relationship of the target computing service configured by the cloud host, and obtains the target access request according to the private network address and private network port corresponding to the cloud host in the cloud host access request, replaces the message information, and obtains the target access request, and forwards the target access request to the computer room gateway corresponding to the target computing service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing service, wherein the target computing service is a computing service without a fixed IP.

[0090] Figure 5is an architecture diagram of a computing power service access system provided according to an optional embodiment of the present invention, such as Figure 5 As shown, the above system also includes a computing power network management platform, wherein the computing power network management platform is used to receive the node information corresponding to the computing power service uploaded by the computer room gateway, determine the address conversion rules of the computing power service without a fixed IP based on the node information corresponding to the computing power service, and send the address conversion rules of the computing power service without a fixed IP to the computing power gateway, wherein the node information corresponding to the computing power service includes the corresponding service identifier and service instance identifier, the service identifier represents the unified access destination address and destination port corresponding to the target computing power service, and the service instance identifier represents the cloud host public network address and public network port corresponding to the computing power service instance without a fixed IP.

[0091] The data interaction between the computing power network management platform and the computer room gateway and computing power gateway can all be done through the IPSEC tunnel. Among them, on the cloud host and the IPSEC function client of the non-fixed IP computer room, complete the IPSEC configuration information and the dual-end interest flow settings respectively (the dual-end interest flow settings are configured based on the cloud host private network information and the non-fixed IP computing power service information, so that the traffic accessing the non-fixed IP computing power service can enter the IPSEC tunnel on the cloud host side, and the traffic sent by the non-fixed IP computing power service can enter the IPSEC tunnel on the non-fixed IP computer room egress router side). Configure the IPSEC function client of the non-fixed IP computer room as the connection initiator, initiate the link establishment to the public IP address bound to the cloud host through the IKE brutal mode, and complete the establishment of the dual-end IPSEC encrypted logical tunnel. Install the IPSEC client on the host where the computing power network management platform is located, and complete the IPSEC related configuration and interest flow configuration of the IPSEC client in the host where the computing power network management platform is located and the IPSEC function client of the non-fixed IP computer room. Configure the IPSEC client of the non-fixed IP room as the connection initiator, initiate the link establishment to the public IP address bound to the cloud host through IKE barbaric mode, and complete the establishment of a dual-end IPSEC encrypted logical tunnel. In this way, the computing power network management platform can transmit information with the non-fixed room through the IPSEC tunnel.

[0092] Among them, the access request sent by the user end will first reach the computing power gateway. The computing power gateway will obtain the public IP address and port number of the cloud host corresponding to the service identifier from the computing power network management platform based on the service identifier in the access request, and update the destination address in the access request to the public IP address and port number of the cloud host. Further, the access request is forwarded to the data center gateway, where the public IP address of the cloud host is mapped to the private IP address of the cloud host, and the access request is further forwarded to the cloud host. The cloud host can convert the private IP address and port number of the cloud host to the private IP address and port number of the host corresponding to the computing power resource without a fixed IP address based on DNAT conversion. Then, based on the IPSEC encrypted tunnel, the access request is forwarded to the IPSEC-enabled client in the computer room where the computing power resource without a fixed IP address is located, and then the access request is forwarded to the corresponding computing power resource according to the private IP address and port number.

[0093] During the return trip, the cloud host is also used to receive the reply message sent by the computing power service based on the first IP security encrypted tunnel and determine the private network address and private port of the cloud host based on the source network address conversion rules configured by the cloud host and the source address and source port in the reply message, and obtain a first reply message; the data center gateway is also used to convert the private network address and private port of the cloud host in the first reply message into the public network address and public port of the cloud host to obtain a second reply message; the computing power gateway is also used to determine the service identification information based on the message source address and source port information in the second reply message based on the non-fixed IP computing power service address conversion rules integrated and issued by the computing power network management platform, and replace the message source address and source port in the second reply message based on the service identification information, generate a target reply message and send the target reply message to the user end.

[0094] The computing power network management platform enables the perception and management of computing power services without fixed IP addresses, thereby improving the utilization rate and management efficiency of computing power resources.

[0095] As an optional embodiment, the cloud host is set in a data center.

[0096] Optionally, the cloud host can be located in a data center, which can be divided by region. One or more cloud hosts with fixed public IP addresses can be enabled in a data center in a region, and the cloud host can be accessed externally by users. The cloud host is used as an access proxy for computing resources without fixed IP addresses in the region.

[0097] An embodiment of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one network device among multiple network devices of a computer network. The computer device includes a memory and a processor.

[0098] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the computing power service access method and system in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned computing power service access method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0099] The processor at the cloud host can call the information and application stored in the memory through the transmission device to perform the following steps: receiving a cloud host access request, wherein the cloud host access request is determined by the data center gateway based on the pre-configured cloud host address conversion rule according to the data center access request, and the data center access request is obtained by converting the initial access request received from the user terminal by the computing power gateway based on the preset non-fixed IP computing power service address conversion rule; based on the target computing power service mapping relationship configured by the cloud host, according to the private network address and private network port corresponding to the cloud host in the cloud host access request, determine the private network address and private network port corresponding to the target computing power service, replace the message information, and obtain the target access request; forward the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0100] Optionally, the processor may also execute the program code of the following steps: forwarding the target access request to the computer room gateway corresponding to the target computing power service, including: determining the first IP security encrypted tunnel based on the private network address and private network port corresponding to the target computing power service in the target access request; forwarding the target access request to the computer room gateway corresponding to the target computing power service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service.

[0101] Optionally, the processor may also execute the program code of the following steps: forwarding the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, including: adding an IPsec header to the target access request, obtaining a modified target access request and forwarding the modified target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway removes the IPsec header in the modified target access request to obtain the target access request and forwards it to the service instance corresponding to the target computing power service.

[0102] Optionally, the processor may also execute the program code of the following steps: receiving a reply message sent by a service instance corresponding to a target computing power service; based on the configured source address conversion rules, determining the private network address and private network port of the cloud host according to the source address and source port in the reply message and obtaining a first reply message; forwarding the first reply message to the data center gateway, so that the data center gateway converts the first reply message into a second reply message and forwards the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rules and sends the target reply message to the user end.

[0103] The processor at the computing power gateway can call the information and application programs stored in the memory through the transmission device to perform the following steps: receive an initial access request issued by the user end; based on the preset non-fixed IP computing power service address conversion rules, determine the corresponding cloud host's public network address and public network port according to the destination address and destination port in the initial access request, and replace the message information to obtain a data center access request; forward the data center access request to the data center gateway, so that the data center gateway converts the data center access request into a cloud host access request based on the pre-configured cloud host address conversion rules and forwards it to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0104] Optionally, the processor may also execute the following program code: based on a preset non-fixed IP computing power service address conversion rule, determine the corresponding public network address and public network port of the cloud host for the destination address and destination port in the initial access request, and replace the message information to obtain a data center access request, including: determining the service identifier corresponding to the target computing power service according to the initial access request; determining the target service instance identifier according to the service identifier corresponding to the target computing power service based on the non-fixed IP computing power service address conversion rule; and obtaining the data center access request after replacing the message information based on the public network address and public network port of the cloud host corresponding to the target service instance identifier.

[0105] Optionally, the processor may also execute the program code of the following steps: receiving a second reply message forwarded by the data center gateway, wherein the second reply message is obtained by converting the data center gateway according to the first reply message, and the first reply message is converted by the cloud host based on the configured source address conversion rule according to the reply message sent by the service instance corresponding to the received target computing power service; based on the non-fixed IP computing power service address conversion rule, determining the service identifier according to the public network address and public network port of the cloud host in the second reply message; based on the service identifier, replacing the public network address and public network port of the cloud host to generate a target reply message; and sending the target reply message to the user end.

[0106] The processor at the data center gateway can call the information and application programs stored in the memory through the transmission device to perform the following steps: receiving a data center access request issued by the computing power gateway, wherein the data center access request is obtained by converting the initial access request received from the user terminal based on the preset non-fixed IP computing power service address conversion rule by the computing power gateway; based on the pre-configured cloud host address conversion rule, according to the public network address and public network port of the cloud host in the data center access request, determine the private network address and private network port corresponding to the cloud host and replace the message information to obtain the cloud host access request; forward the cloud host access request to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards it to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0107] Optionally, the processor may also execute the program code of the following steps: receiving a first reply message forwarded by the cloud host, wherein the first reply message is obtained by converting the received reply message sent by the service instance corresponding to the target computing power service based on the configured source address conversion rule; converting the private network address and private network port of the cloud host in the first reply message into the public network address and public network port of the cloud host to obtain a second reply message; forwarding the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rule and sends the target reply message to the user end.

[0108] According to an embodiment of the present invention, a computing power service access method is provided, which is applied to a cloud host, and receives a cloud host access request, wherein the cloud host access request is determined by a data center gateway based on a pre-configured cloud host address conversion rule according to the data center access request, and the data center access request is obtained by converting the initial access request received from the user terminal by the computing power gateway based on the preset non-fixed IP computing power service address conversion rule; based on the target computing power service mapping relationship configured by the cloud host, according to the private network address and private network port corresponding to the cloud host in the cloud host access request, the private network address and private network port corresponding to the target computing power service are determined, and after replacing the message information, the target access request is obtained; the target access request is forwarded to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance, so that the user can access the computing power resources without a fixed IP address, thereby achieving the technical effect of improving the utilization rate of computing power resources, and further solving the technical problem that the computing power resources are wasted due to the inability to directly access the computing power services in the computing power resources without a fixed IP address. The inability to directly access computing services in computing resources without fixed IP addresses results in a waste of computing resources.

[0109] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a non-volatile storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0110] The embodiment of the present invention further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the computing power service access method provided in the above embodiment.

[0111] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network corresponding to the cloud host, or in any mobile terminal in a mobile terminal group.

[0112] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: receiving a cloud host access request, wherein the cloud host access request is determined by the data center gateway based on a pre-configured cloud host address conversion rule according to the data center access request, and the data center access request is obtained by converting the initial access request received from the user terminal by the computing power gateway based on the preset non-fixed IP computing power service address conversion rule; based on the target computing power service mapping relationship configured by the cloud host, according to the private network address and private network port corresponding to the cloud host in the cloud host access request, determine the private network address and private network port corresponding to the target computing power service, replace the message information, and obtain the target access request; forward the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0113] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: forwarding the target access request to the computer room gateway corresponding to the target computing power service, including: determining the first IP security encrypted tunnel based on the private network address and private network port corresponding to the target computing power service in the target access request; forwarding the target access request to the computer room gateway corresponding to the target computing power service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service.

[0114] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: forwarding the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, including: adding an IPsec header to the target access request, obtaining a modified target access request and forwarding the modified target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway removes the IPsec header in the modified target access request to obtain the target access request and forwards it to the service instance corresponding to the target computing power service.

[0115] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: receiving a reply message sent by a service instance corresponding to a target computing power service; based on the configured source address conversion rules, determining the private network address and private network port of the cloud host according to the source address and source port in the reply message and obtaining a first reply message; forwarding the first reply message to the data center gateway, so that the data center gateway converts the first reply message into a second reply message and forwards the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rules and sends the target reply message to the user end.

[0116] Optionally, in this embodiment, the above-mentioned non-volatile storage medium can be located in any computer terminal in the computer terminal group in the computer network corresponding to the computing power gateway, or in any mobile terminal in the mobile terminal group.

[0117] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: receiving an initial access request issued by a user terminal; based on a preset non-fixed IP computing power service address conversion rule, determining the public network address and public network port of the corresponding cloud host according to the destination address and destination port in the initial access request, and replacing the message information to obtain a data center access request; forwarding the data center access request to a data center gateway, so that the data center gateway converts the data center access request into a cloud host access request based on a pre-configured cloud host address conversion rule and forwards it to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0118] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: based on a preset non-fixed IP computing power service address conversion rule, the destination address and destination port in the initial access request are used to determine the public network address and public network port of the corresponding cloud host, and the message information is replaced to obtain a data center access request, including: determining the service identifier corresponding to the target computing power service according to the initial access request; based on the non-fixed IP computing power service address conversion rule, determining the target service instance identifier according to the service identifier corresponding to the target computing power service; and obtaining the data center access request after replacing the message information according to the public network address and public network port of the cloud host corresponding to the target service instance identifier.

[0119] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: receiving a second reply message forwarded by the data center gateway, wherein the second reply message is obtained by the data center gateway according to a conversion of the first reply message, and the first reply message is obtained by the cloud host according to the configured source address conversion rule based on a reply message sent by the service instance corresponding to the received target computing power service; based on the non-fixed IP computing power service address conversion rule, determining the service identifier according to the public network address and public network port of the cloud host in the second reply message; based on the service identifier, replacing the public network address and public network port of the cloud host to generate a target reply message; and sending the target reply message to the user end.

[0120] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network corresponding to the data center gateway, or in any mobile terminal in a mobile terminal group.

[0121] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: receiving a data center access request issued by a computing power gateway, wherein the data center access request is obtained by the computing power gateway converting the initial access request received from the user terminal based on a preset non-fixed IP computing power service address conversion rule; based on the pre-configured cloud host address conversion rule, according to the public network address and public network port of the cloud host in the data center access request, determining the private network address and private network port corresponding to the cloud host and replacing the message information to obtain a cloud host access request; forwarding the cloud host access request to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards it to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a non-fixed IP computing power service instance.

[0122] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: receiving a first reply message forwarded by the cloud host, wherein the first reply message is obtained by converting the received reply message sent by the service instance corresponding to the target computing power service based on the configured source address conversion rule; converting the private network address and private network port of the cloud host in the first reply message into the public network address and public network port of the cloud host to obtain a second reply message; forwarding the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rule and sends the target reply message to the user end.

[0123] An embodiment of the present invention further provides a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, any one of the above-mentioned computing power service access methods can be implemented.

[0124] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0125] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0127] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0128] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0129] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0130] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A computing power service access method, characterized in that: Applicable to cloud hosts, including: Receive a cloud host access request, wherein the cloud host access request is determined by the data center gateway based on a pre-configured cloud host address conversion rule according to the data center access request, and the data center access request is obtained by converting the initial access request sent by the user terminal received by the computing power gateway based on a preset non-fixed IP computing power service address conversion rule; Based on the target computing power service mapping relationship configured by the cloud host, the private network address and private network port corresponding to the cloud host in the cloud host access request are determined, and after replacing the message information, the target access request is obtained; The target access request is forwarded to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

2. The method according to claim 1, characterized in that The forwarding of the target access request to the computer room gateway corresponding to the target computing power service includes: Determine a first IP security encrypted tunnel according to the private network address and private network port corresponding to the target computing service in the target access request; The target access request is forwarded to the computer room gateway corresponding to the target computing power service through the first IP security encrypted tunnel, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service.

3. The method according to claim 1, characterized in that The forwarding of the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, includes: An IPSec header is added to the target access request to obtain a modified target access request and the modified target access request is forwarded to the computer room gateway corresponding to the target computing power service, so that the computer room gateway removes the IPSec header in the modified target access request to obtain the target access request and forwards it to the service instance corresponding to the target computing power service.

4. The method according to claim 1, characterized in that: Also includes: Receive a response message sent by the service instance corresponding to the target computing power service; Based on the configured source address translation rule, according to the source address and source port in the response message, determine the private network address and private network port of the cloud host and obtain a first response message; Forward the first reply message to the data center gateway, so that the data center gateway converts the first reply message into a second reply message and forwards the second reply message to the computing power gateway, so that the computing power gateway converts the second reply message into a target reply message based on the non-fixed IP computing power service address conversion rule and sends the target reply message to the user end.

5. A computing power service access method, characterized in that: Applied to computing power gateway, including: Receiving an initial access request from a user terminal; Based on the preset non-fixed IP computing service address conversion rule, according to the destination address and destination port in the initial access request, the public network address and public network port of the corresponding cloud host are determined, and the message information is replaced to obtain a data center access request; The data center access request is forwarded to the data center gateway, so that the data center gateway converts the data center access request into the cloud host access request based on the pre-configured cloud host address conversion rule and forwards it to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards the target access request to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

6. The method according to claim 5, characterized in that The method of determining the public network address and public network port of the corresponding cloud host based on the preset non-fixed IP computing power service address conversion rule, and performing message information replacement to obtain a data center access request includes: Determine, according to the initial access request, a service identifier corresponding to the target computing power service; Based on the non-fixed IP computing power service address conversion rule, determine the target service instance identifier according to the service identifier corresponding to the target computing power service; The data center access request is obtained after replacing the message information according to the cloud host public network address and public network port corresponding to the target service instance identifier.

7. The method according to claim 5, characterized in that Also includes: Receive a second reply message forwarded by the data center gateway, wherein the second reply message is obtained by the data center gateway according to the conversion of the first reply message, and the first reply message is obtained by the cloud host according to the configured source address conversion rule and the reply message sent by the service instance corresponding to the received target computing power service; Based on the non-fixed IP computing power service address conversion rule, determine the service identifier according to the public network address and public network port of the cloud host in the second response message; Based on the service identifier, replace the public network address and public network port of the cloud host to generate a target response message; The target response message is sent to the user end.

8. A method for accessing computing power services, characterized in that: Applied to data center gateways, including: Receive a data center access request issued by a computing power gateway, wherein the data center access request is obtained by the computing power gateway converting an initial access request issued by a received user terminal based on a preset non-fixed IP computing power service address conversion rule; Based on the pre-configured cloud host address conversion rule, according to the public network address and public network port of the cloud host in the data center access request, determine the private network address and private network port corresponding to the cloud host and replace the message information to obtain the cloud host access request; The cloud host access request is forwarded to the cloud host, so that the cloud host converts the cloud host access request into a target access request based on the configured target computing power service mapping relationship and forwards it to the computer room gateway corresponding to the target computing power service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing power service, wherein the service instance corresponding to the target computing power service is a computing power service instance without a fixed IP.

9. The method according to claim 8, characterized in that Also includes: Receiving a first response message forwarded by the cloud host, wherein the first response message is obtained by the cloud host converting a response message sent by a service instance corresponding to the target computing power service based on a configured source address conversion rule; Convert the private network address and private network port of the cloud host in the first response message into the public network address and public network port of the cloud host to obtain a second response message; The second response message is forwarded to the computing power gateway, so that the computing power gateway converts the second response message into a target response message based on the non-fixed IP computing power service address conversion rule and sends the target response message to the user end.

10. A method for uploading node information of a computing power service, characterized in that: Applied to a computer room gateway, wherein the method is applied to any one of the computing power service access methods of claims 1 to 9 above, comprising: The node information corresponding to the computing power service is uploaded and stored to the computing power network management platform, so that the computing power network management platform determines the address conversion rule of the computing power service without a fixed IP according to the node information corresponding to the computing power service and sends it to the computing power gateway, wherein the node information corresponding to the computing power service includes the corresponding service identifier and service instance identifier, the service instance corresponding to the computing power service is a computing power service instance without a fixed IP, the service identifier represents the unified access destination address and destination port corresponding to the target computing power service, and the service instance identifier represents the cloud host public network address and public network port corresponding to the computing power service instance without a fixed IP.

11. The method according to claim 10, characterized in that Uploading the node information corresponding to the computing service in the computer room gateway to the computing network management platform includes: The node information corresponding to the computing power service is uploaded to the computing power network management platform based on the second IP security encrypted tunnel.

12. A computing power service access system, characterized in that: The computing service access method according to any one of claims 1 to 9 is used to access the computing service, including: a computing gateway, a data center and a cloud host, wherein: The computing power gateway is used to receive the initial access request sent by the user end, and based on the preset non-fixed IP computing power service address conversion rule, determine the public network address and public network port of the corresponding cloud host according to the destination address and destination port in the initial access request, and obtain the data center access request after replacing the message information; A data center gateway, located in the data center, is used to determine the private network address and private network port corresponding to the cloud host according to the public network address and public network port of the cloud host in the data center access request based on the cloud host address conversion rule configured on the data center gateway, replace the message information, and obtain the cloud host access request; The cloud host is used to determine the private network address and private network port corresponding to the target computing service based on the target computing service mapping relationship configured by the cloud host and according to the private network address and private network port corresponding to the cloud host in the cloud host access request, replace the message information, and obtain the target access request, and forward the target access request to the computer room gateway corresponding to the target computing service, so that the computer room gateway forwards the target access request to the service instance corresponding to the target computing service, wherein the target computing service is a computing service without a fixed IP.

13. The system according to claim 12, characterized in that Also includes: Computing network management platform, including: The computing power network management platform is used to receive the node information corresponding to the computing power service uploaded by the computer room gateway, determine the address conversion rule of the computing power service without a fixed IP based on the node information corresponding to the computing power service, and send the address conversion rule of the computing power service without a fixed IP to the computing power gateway, wherein the node information corresponding to the computing power service includes the corresponding service identifier and service instance identifier, the service identifier represents the unified access destination address and destination port corresponding to the target computing power service, and the service instance identifier represents the cloud host public network address and public network port corresponding to the computing power service instance without a fixed IP.

14. The system according to claim 12, characterized in that The cloud host is arranged in the data center.

15. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the computing power service access method described in any one of claims 1 to 9.

16. A computer device, characterized in that: include: Memory and processor, The memory stores a computer program; The processor is used to execute the computer program stored in the memory, and when the computer program is running, the processor executes the computing power service access method described in any one of claims 1 to 9.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computing power service access method described in any one of claims 1 to 9 is implemented.

Images