Data processing method and device and electronic equipment

Abstract

The invention discloses a data processing method and device and electronic equipment. The method comprises the following steps: receiving an access request sent by a target object; under the condition that the access request is to access the Internet, providing a first access path through a virtual private cloud network created for the cloud host, and accessing the Internet through the first access path; and under the condition that the access request is to access the cloud platform, providing a second access path through a flat network created for the cloud host, and accessing the cloud platform through the second access path. The technical problem that a user is inconvenient to use after a service network and a management network of a cloud platform are separated in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a method, device and electronic equipment for data processing. Background Art

[0002] In a private cloud architecture, if the management network and the business network are not separated, business security and cloud platform reliability will be challenged. After implementing the public transformation of the private cloud architecture and separating the business network and the management network, the cloud platform is accessed through the data communication network, and security and reliability are improved, but there is still the problem that the cloud platform is not as convenient for users as ordinary public clouds.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a data processing method, device and electronic device to at least solve the technical problem in the related art that the business network and management network of the cloud platform are separated, which is inconvenient for users to use.

[0005] According to one aspect of an embodiment of the present application, a method for data processing is provided, including: receiving an access request sent by a target object; when the access request is for accessing the Internet, providing a first access path through a virtual private cloud network created for a cloud host, and accessing the Internet through the first access path; when the access request is for accessing a cloud platform, providing a second access path through a flat network created for the cloud host, and accessing the cloud platform through the second access path.

[0006] Optionally, before receiving the access request sent by the target object, the method also includes: receiving an inbound security group created by the self-service system, wherein the inbound security group is used to control access rules entering the self-service system, the self-service system is deployed in a cloud host, and the self-service system is used to assist the cloud platform in processing the access request sent by the target object, and the cloud platform includes the cloud host; receiving an outbound security group created by the self-service system, wherein the outbound security group is used to control access rules entering the cloud platform.

[0007] Optionally, the method also includes: receiving cloud resource demand information selected by the target object in the cloud resource template; sending the cloud resource demand information to the cloud platform through a self-service system; receiving the cloud platform's approval result for the cloud resource demand information; and receiving the cloud resources allocated by the cloud platform to the cloud host based on the approval result.

[0008] Optionally, the cloud resource template is determined in the following manner: determining resource information contained in the cloud resource template, wherein the resource information includes at least one of the following: virtual machine configuration, network service, database service; creating a cloud resource template based on the resource information, security policy, and usage permissions; verifying whether the template configuration of the cloud resource template is correct, and after the cloud resource template is verified, publishing the cloud resource template to a designated organization.

[0009] Optionally, cloud resources allocated by the cloud platform to the cloud host are received based on the approval result, including: when the approval result is approved, receiving cloud resources allocated by the cloud platform according to cloud resource demand information; when the approval result is rejected, receiving approval failure information sent by the cloud platform.

[0010] Optionally, the method also includes: obtaining a resource operation request initiated by the target object through the self-service system; when the resource operation request includes an operation of a preset resource, automatically initiating an approval process for the resource operation request; and when the approval result of the approval process is approval passed, executing the resource operation request.

[0011] Optionally, after obtaining the resource operation request initiated by the target object through the self-service system, the method further includes: obtaining request information in the resource operation request; generating an order record based on the resource operation request and the request information; and storing the order record in a database.

[0012] According to another aspect of an embodiment of the present application, a data processing device is also provided, including: a receiving module for receiving an access request sent by a target object; a first access module for providing a first access path through a virtual private cloud network created for a cloud host when the access request is for accessing the Internet, and accessing the Internet through the first access path; a second access module for providing a second access path through a flat network created for the cloud host when the access request is for accessing a cloud platform, and accessing the cloud platform through the second access path.

[0013] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: receiving an access request sent by a target object; in the case where the access request is to access the Internet, providing a first access path through a virtual private cloud network created for the cloud host, and accessing the Internet through the first access path; in the case where the access request is to access a cloud platform, providing a second access path through a flat network created for the cloud host, and accessing the cloud platform through the second access path.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the above-mentioned data processing method by running the computer program.

[0015] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned data processing method when executed by a processor.

[0016] In an embodiment of the present application, an access request sent by a target object is received; when the access request is to access the Internet, a first access path is provided through a virtual private cloud network created for the cloud host, and the Internet is accessed through the first access path; when the access request is to access the cloud platform, a second access path is provided through a flat network created for the cloud host, and the cloud platform is accessed through the second access path, thereby achieving the purpose of flexibly and efficiently managing the cloud host's access to the Internet and cloud platform resources, thereby achieving the technical effect of improving the flexibility of network access, and further solving the technical problem in the related technology of separating the business network and the management network of the cloud platform, which is inconvenient for users to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a hardware structure block diagram of a computer terminal for implementing a data processing method according to an embodiment of the present application;

[0019] Figure 2 is a flow chart of a data processing method according to an embodiment of the present application;

[0020] Figure 3 It is a structural diagram of a data processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0024] First, some nouns or terms that appear in the process of explaining the embodiments of the present application are subject to the following explanations:

[0025] VPC (Virtual Private Cloud): is a technology used to achieve resource isolation and security in a cloud computing environment.

[0026] Cloud platform is a cloud computing platform, which refers to a computing service platform based on cloud computing technology, used to provide flexible, scalable, and shareable computing resources and system services. The process of opening and executing cloud resources is implemented in the cloud platform system. In a cloud platform based on the publicization of private clouds, you log in to the cloud platform as an administrator and open and deliver cloud hosts to customers on the cloud platform according to the cloud resource parameters required by the order.

[0027] In a private cloud architecture, if the management network and the business network are not separated, business security and cloud platform reliability will be challenged. After implementing the public transformation of the private cloud architecture and separating the business network from the management network, the cloud platform is accessed through the data communication network (DCN), and security and reliability are improved. However, there is a problem that the cloud platform is not as user-friendly as an ordinary public cloud, for example, it cannot provide a self-service page, and the user experience is poor.

[0028] In order to solve the problems existing in the related art, the embodiment of the present application provides a data processing method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is explained below.

[0029] The data processing method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a data processing method. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0030] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned data processing method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0032] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0034] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0035] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for data processing. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] Figure 2 is a flow chart of a data processing method according to an embodiment of the present application, such as Figure 2As shown, the method comprises the following steps:

[0037] Step S202: receiving an access request sent by the target object.

[0038] Step S204: When the access request is to access the Internet, a first access path is provided through a virtual private cloud (VPC) network created for the cloud host, and the Internet is accessed through the first access path.

[0039] In the above step S204, VPC is a service provided by a public cloud provider, which allows a user (or target object) to create an isolated, user-configured and managed virtual network environment in a public cloud environment. The user can fully control his virtual network environment, including selecting IP address ranges, creating subnets, configuring network access control policies, etc.

[0040] In the embodiment of the present application, the first access path can be created in the following manner:

[0041] 1. Create a VPC instance: On the cloud service provider's console, create a new VPC instance and select a name, CIDR block (Classless Inter-Domain Routing, which is used to define the IP address range within the VPC), and region for the created VPC.

[0042] 2. Create a subnet: Create a subnet in the VPC. The subnet defines the specific IP address range within the VPC. Each subnet is associated with a specific availability zone.

[0043] 3. Configure security groups: Security groups act as virtual firewalls to control traffic in and out of one or more subnets. Create security group rules to allow or deny specific types of network traffic, such as allowing HTTP or HTTPS traffic.

[0044] 4. Configure NAT Gateway or Elastic IP (EIP): In order to enable resources in the VPC subnet to access the Internet, you need to configure a NAT gateway or EIP. The NAT gateway allows multiple resources in the subnet to access the Internet through a public IP address without having to allocate an EIP for each resource. EIP allocates a public IP address to a single resource, allowing it to directly access the Internet.

[0045] By providing the first access path for the VPC network created for the cloud host and configuring the NAT gateway or EIP as well as the corresponding routing and security policies, the cloud host can access the Internet securely and efficiently.

[0046] Step S206: When the access request is for accessing the cloud platform, a second access path is provided through the flat network created for the cloud host, and the cloud platform is accessed through the second access path.

[0047] In the above step S206, the flat network is a simplified network architecture, which reduces the layers and complexity of the network and improves the flexibility and scalability of the network. In the cloud platform, the flat network is usually used to connect the cloud host and other components of the cloud platform to achieve efficient internal communication. In an optional embodiment, the flat network can be a cloud platform management network.

[0048] In the embodiment of the present application, the second access path can be created in the following manner:

[0049] 1. Cloud host network configuration: In the cloud platform, configure a flat network for the cloud host. For example, you can select or create a flat network instance and connect the cloud host to the network. The cloud host's network interface will be configured to use the IP address range of the flat network to communicate with other cloud hosts or cloud platform components connected to the same network.

[0050] 2. Cloud platform network architecture: The cloud platform network architecture needs to support the deployment and management of flat networks. For example, it includes configuring network switches, routers, firewalls and other devices to ensure smooth communication between cloud hosts. The cloud platform also needs to provide necessary network services, such as DNS, DHCP, etc., to support the network configuration and domain name resolution of cloud hosts.

[0051] 3. Access control policy: To ensure the security of the cloud platform, you need to configure access control policies to limit access to the cloud platform. For example, this includes setting firewall rules, using security groups or network ACLs (access control lists) to limit network traffic. In a flat network, you can configure appropriate access control policies to allow cloud hosts to access other components of the cloud platform while preventing unauthorized access.

[0052] When accessing the cloud platform through the second access path, it can be achieved through the following process:

[0053] 1. Routing configuration: The network architecture of the cloud platform needs to be configured with appropriate routing rules to ensure that the cloud host can access other components of the cloud platform through the flat network. For example, it involves configuring static routing, dynamic routing protocols, or default gateways.

[0054] 2. Packet forwarding: When a cloud host initiates a request to access the cloud platform, the packet will be sent to the default gateway or router on the flat network. The router will forward the packet to other components of the cloud platform according to the configured routing rules.

[0055] 3. Response processing: Other components of the cloud platform will process the cloud host's request and generate a response data packet. The response data packet will be returned to the cloud host along the same path, completing the entire access process.

[0056] By providing a second access path for the flat network created for the cloud host and configuring appropriate routing, access control policies and security measures, the cloud host can achieve efficient and secure access to the cloud platform.

[0057] In step S202 of the above data processing method, before receiving the access request sent by the target object, the method also includes: receiving an inbound security group created by a self-service system, wherein the inbound security group is used to control access rules entering the self-service system, the self-service system is deployed in a cloud host, the self-service system is used to assist the cloud platform in processing the access request sent by the target object, and the cloud platform includes the cloud host; receiving an outbound security group created by the self-service system, wherein the outbound security group is used to control access rules entering the cloud platform.

[0058] In the embodiment of the present application, the self-service system is a system deployed in a cloud host, and its main function is to assist the cloud platform in processing access requests from target objects (for example, users, applications or other services). The self-service system provides a mechanism that enables the target object to access resources or services on the cloud platform more conveniently and self-service. The cloud host is a basic component unit in the cloud computing environment. It is a virtual or physical server that runs applications and services. The self-service system is deployed on the cloud host, and the cloud host meets the configuration requirements required for the self-service system based on the publicization of the private cloud. The cloud platform is a collection of computing resources (such as servers, storage, databases, etc.) and services (such as software development, testing, deployment, etc.). The cloud platform allows users to access and use these resources and services through the Internet. The cloud platform includes the cloud host, that is, the environment in which the self-service system is deployed. The security group is a network security policy that defines a set of rules for controlling network traffic in and out of the cloud host or cloud platform. These rules can allow or deny traffic based on conditions such as IP address, port number, protocol type, etc. Specifically, the inbound security group is a collection of access rules that control access to the self-service system (i.e., the cloud host). By configuring the inbound security group, you can limit which IP addresses, ports, and protocols can access the self-service system, thereby improving the security of the system. The outbound security group is a collection of access rules that control the access from the self-service system (i.e., cloud host) to the cloud platform. By configuring the inbound and outbound security groups of the self-service system, you can ensure that only network traffic that complies with the security policy can enter or be sent from the self-service system, thereby ensuring the security of data transmission.

[0059] In the above data processing method, the method also includes: receiving cloud resource demand information selected by the target object in the cloud resource template; sending the cloud resource demand information to the cloud platform through the self-service system; receiving the cloud platform's approval result for the cloud resource demand information; and receiving the cloud resources allocated by the cloud platform to the cloud host based on the approval result.

[0060] In the embodiment of the present application, a cloud resource template is a predefined configuration that describes the type, quantity, performance requirements and other properties of cloud resources. These templates enable users to more easily select cloud resources that suit their needs. The target object (user, application, etc.) browses and selects the cloud resources they need in the cloud resource template through an interface (such as a Web interface, an API call, etc.). These selections may include, for example, the specifications of the virtual machine, the type and size of storage, the network configuration, etc. Once the target object makes a selection, the cloud resource demand information will be received. The self-service system is an intermediate layer that receives the cloud resource demand information of the target object and is responsible for passing this information to the cloud platform. In addition, the self-service system may include some logic to process or verify this demand information to ensure that it meets the requirements or policies of the cloud platform. Once the verification is passed, the self-service system will send the cloud resource demand information to the cloud platform for further processing. After receiving the cloud resource demand information, the cloud platform will perform a series of checks and approval processes. These checks may include, for example, verifying user permissions, checking resource availability, evaluating resource costs, etc. The approval result may be a simple "approval" or "rejection", or may contain more detailed information, such as resource parameters that need to be adjusted or additional cost information. The self-service system receives and processes these approval results, and then feeds them back to the target object. Specifically, if the approval result is "approved", the cloud platform will start to allocate the required cloud resources to the cloud host. The allocated resources may include, for example, virtual machine instances, storage volumes, network interfaces, etc. The self-service system is responsible for receiving these allocated resource information and presenting it to the target object. The target object can now use these resources to run applications, store data, or perform other tasks. This process reflects the self-service characteristics in the cloud computing environment, allowing the target object to quickly and flexibly obtain cloud resources according to its own needs. At the same time, the approval and verification mechanisms of the cloud platform and the self-service system also ensure the security and compliance of resource allocation.

[0061] In the above steps, the cloud resource template is determined in the following manner: determining the resource information contained in the cloud resource template, wherein the resource information includes at least one of the following: virtual machine configuration, network service, database service; creating a cloud resource template based on the resource information, security policy and usage permissions; verifying whether the template configuration of the cloud resource template is correct, and after the cloud resource template is verified, publishing the cloud resource template to the designated organization.

[0062] In an embodiment of the present application, before creating a cloud resource template, it is first necessary to determine what resource information the template will contain. Such resource information may include, for example, virtual machine configuration (such as CPU, memory, storage size, etc.), network services (such as network bandwidth, IP address, load balancing, etc.) and database services (such as database type, capacity, backup strategy, etc.). After determining the resource information, the next step is to create a cloud resource template based on this information, security policies and usage permissions. Security policies may include, for example, network isolation, data encryption, access control, etc. to ensure the security of resources. Usage permissions define which users or organizations can access and use the template. After the template is created, verification is required to ensure the correctness and validity of the template configuration. Verification may include, for example, checking whether the template configuration meets the requirements of the cloud platform, verifying whether the resource information is complete and conflict-free, and testing whether the deployment process of the template is smooth. If problems are found during the verification process, corresponding modifications and re-verification are required. Once the template is verified, it can be published to the specified organization or user group. The publishing process may, for example, involve uploading the template to the repository of the cloud platform, updating the metadata of the template (such as description, version, etc.), notifying relevant users or organizations, etc. This process reflects the characteristics of resource management and automated deployment in cloud computing environments. By creating and publishing cloud resource templates, the complexity of resource deployment can be simplified, deployment efficiency and consistency can be improved, and the security and compliance of resources can be ensured.

[0063] In the above steps, cloud resources allocated by the cloud platform to the cloud host are received based on the approval result, including: when the approval result is approved, cloud resources allocated by the cloud platform according to cloud resource demand information are received; when the approval result is rejected, approval failure information sent by the cloud platform is received.

[0064] In an embodiment of the present application, after the cloud resource demand information submitted by the target object has gone through the approval process of the cloud platform, if the approval result is "approved", it means that the cloud platform has confirmed that these requirements meet the resource availability and security requirements. In this case, the cloud platform will allocate corresponding cloud resources based on the submitted cloud resource demand information. These resources may include, for example, virtual machine instances, storage volumes, network interfaces, database services, etc. The target object (or its agent, such as a self-service system) will receive the cloud resource information allocated by the cloud platform, including the specific configuration of the resources, access credentials, location, etc. The received cloud resources can be used by the target object to run applications, store data, or perform other tasks.

[0065] If the approval result is "approval failed", it means that the cloud platform found some problems during the approval process, which made it impossible to approve these cloud resource requirements. In this case, the cloud platform will send approval failure information to the target object (or its agent). This information may include, for example, the reason for the approval failure, possible modification suggestions, and guidelines for resubmitting requirements. The target object needs to make corresponding adjustments based on the approval failure information, and then resubmit the cloud resource demand information for approval again. The above process reflects the approval and resource management characteristics in the cloud computing environment. Through the approval process, the cloud platform can ensure that the allocation of cloud resources meets the resource availability and security requirements, thereby maintaining the stability and security of the cloud environment. At the same time, by providing approval failure information and guidelines for resubmitting requirements, the cloud platform also helps the target object to make better adjustments to successfully obtain the required cloud resources.

[0066] In another optional embodiment, a cloud resource template can also be configured and generated in the self-service system and published to a designated organization. The cloud resource template is used to apply for a new cloud resource card that can be applied for. The user configures the cloud resource card to form the cloud host resource required by the user. The self-service system receives the user's application, sends the application information of the cloud resource application to the cloud platform, and receives the cloud resource demand information corresponding to the application information returned by the cloud platform; receives the approval request initiated by the user corresponding to the cloud resource demand information; obtains the approval result of the approval request, and sends the approval result to the cloud platform for execution.

[0067] In the above data processing method, the method also includes: obtaining a resource operation request initiated by the target object through the self-service system; when the resource operation request includes an operation of a preset resource, automatically initiating an approval process for the resource operation request; and when the approval result of the approval process is approval passed, executing the resource operation request.

[0068] In an embodiment of the present application, the target object (which may be a user, application or service) initiates an operation request for a cloud resource through a self-service system. These operation requests may include, for example, creating, modifying, deleting cloud resources, or making some configuration changes to cloud resources. The self-service system receives these operation requests and passes them to the back-end approval system or cloud platform for processing. After receiving the resource operation request, the system checks whether the request involves preset resources. Preset resources may refer to resources that require special approval due to security, compliance or resource restrictions, such as applying for a virtual machine, cloning a virtual machine, unsubscribing a virtual machine, unsubscribing a cloud hard disk, expanding the capacity of a cloud hard disk, changing computing specifications, etc. If the resource operation request includes an operation on a preset resource, the system will automatically trigger the approval process. This approval process may involve multiple approval nodes, for example, and each node may be responsible for different approval personnel or system components. The approval process evaluates the rationality, security and compliance of the resource operation request based on a series of rules and standards. If the resource operation request passes all nodes of the approval process and the approval result is "approved", the system will execute the resource operation request. The execution process may involve, for example, creating, modifying, or deleting resources on the cloud platform, or making some configuration changes to the resources. The execution results are fed back to the target object to inform it whether the operation was successful, as well as any possible impacts or subsequent steps. The entire process reflects the resource management and approval control characteristics in the cloud computing environment. Through the combination of the self-service system and the approval process, it can ensure that the operation requests for cloud resources meet the requirements of security, compliance, and resource constraints, thereby maintaining the stability and security of the cloud environment. At the same time, this process also improves the efficiency and automation of resource operations, allowing the target object to manage and use cloud resources more conveniently.

[0069] In the above steps, after obtaining the resource operation request initiated by the target object through the self-service system, the method further includes: obtaining request information in the resource operation request; generating an order record based on the resource operation request and the request information; and saving the order record in a database.

[0070] In an embodiment of the present application, after receiving a resource operation request, the system extracts key information from the request, which may include, for example, the identity of the target object, the resource type, quantity, configuration parameters, etc. of the required operation. Based on the resource operation request and the extracted request information, the system generates an order record. This order record may, for example, contain detailed information of the request, such as the request type, target object, resource information, operation time, etc. The order record is a formal record of the resource operation request, which is used to track the processing status of the request, resource allocation, etc. After the order record is generated, the system saves it in a database. The database is a key component in a cloud computing environment, which is used to store and manage various data, including user information, resource information, order records, etc. Saving order records helps with subsequent resource management, auditing, and compliance checks. The entire process embodies the resource management and order processing characteristics in a cloud computing environment. Receiving resource operation requests through a self-service system, extracting request information, and generating and saving order records can ensure the transparency, traceability, and compliance of resource operations. At the same time, this process also provides an effective resource management means for cloud computing service providers, which helps to improve service quality and customer satisfaction.

[0071] In another optional embodiment, when a user applies for preset resources or includes risky operations in the self-service system, such as applying for a virtual machine, cloning a virtual machine, unsubscribing a virtual machine, unsubscribing a cloud hard disk, expanding the capacity of a cloud hard disk, changing computing specifications, directly creating a security group, directly creating a virtual machine, directly creating a cloud hard disk, etc., an order record will be automatically generated. The order records the operation of resources on the self-service system in detail, and is an important basis for users to query information such as resource operation failures and resource deployment. Therefore, each order in the order management cannot be deleted. The order record provides users with a review panel where operations can be traced and resources can be located. In order to solve the problem of non-standardized resource and service delivery, the self-service system provides work orders, order-related definitions, applications, approvals, and management to meet the needs of standardized and fast offline delivery of resources and services.

[0072] Through the above steps, by deploying the self-service system on the cloud host, providing users with self-service based on Internet access through the VPC network, communicating with the cloud platform through the flat network, managing the cloud platform, sending user needs to the cloud platform in the form of work orders for processing, and opening up the management channel between the self-service system and the cloud platform through the management network, various work orders of the self-service system can be smoothly implemented on the cloud platform, achieving the purpose of flexibly and efficiently managing cloud hosts to access the Internet and cloud platform resources, thereby achieving the technical effect of improving network access flexibility, and further solving the technical problem of inconvenience for users after separating the business network and management network of the cloud platform in related technologies.

[0073] The following explains the self-service process in the above data processing method in combination with specific steps.

[0074] The self-service method is implemented through a series of service catalog operations. The service catalog is an index of the cloud resource pool provided to customers and can be regarded as a backstage shelf for displaying goods. Users can self-create the required cloud resource information in the cloud resource pool and implement it by completing the configuration of cloud resource templates in the service catalog. Through the construction of the service catalog, the required cloud resources, such as virtual machine templates, are treated as commodities. Only after publishing can the virtual machine be put on the front-end shelf of the service application. Customers (applicants) can obtain the virtual machine configuration that is self-delegated by customers in the service application and complete the virtual machine application and deployment. After the customer (applicant) completes the configuration of the virtual machine template in the service catalog and publishes it, a card is added to the corresponding service application, which is the newly released virtual machine template, forming an application order. After the application order is formed, it enters the process management stage. Process management includes the necessary process configuration involved in risk operations of important resources. When applying for, unsubscribing resources such as virtual machines and cloud hard disks, as well as self-service services such as cloud hard disk expansion and computing specifications change, the corresponding process management will be automatically triggered, and the necessary process approval configuration will be performed. After approval, the operation can be implemented. The self-service system obtains the approval result of the approval request and sends the approval result to the cloud platform. The self-service system creates orders for the self-service process, through which the operation application can be recorded, tracked and audited afterwards. Order factors include application content, basic information and other elements. The factors that trigger the current order can be viewed based on the above fields. The deployment of the self-service system includes the deployment of the operating system base and the installation of the self-service software. At the same time, the necessary ports are opened on the VPC network, and necessary verification checks are implemented during the deployment process. The self-service system based on Internet access is provided to customers through the VPC network. The management channel between the self-service system and the cloud platform is opened through the management network, so that various work orders of the self-service platform can be smoothly implemented on the cloud platform.

[0075] Figure 3 is a structural diagram of a data processing device according to an embodiment of the present application, such as Figure 3 As shown, the device comprises:

[0076] The receiving module 30 is used to receive the access request sent by the target object;

[0077] A first access module 32, configured to provide a first access path through a virtual private cloud network created for the cloud host and access the Internet through the first access path when the access request is to access the Internet;

[0078] The second access module 34 is used to provide a second access path through the flat network created for the cloud host and access the cloud platform through the second access path when the access request is to access the cloud platform.

[0079] In the receiving module in the above-mentioned data processing device, the receiving module is also used to receive an inbound security group created by a self-service system, wherein the inbound security group is used to control access rules entering the self-service system, the self-service system is deployed in a cloud host, and the self-service system is used to assist the cloud platform in processing access requests sent by the target object, and the cloud platform includes the cloud host; receive an outbound security group created by the self-service system, wherein the outbound security group is used to control access rules entering the cloud platform.

[0080] In the receiving module in the above-mentioned data processing device, the receiving module is also used to receive the cloud resource demand information selected by the target object in the cloud resource template; send the cloud resource demand information to the cloud platform through the self-service system; receive the cloud platform's approval result for the cloud resource demand information; and receive the cloud resources allocated by the cloud platform to the cloud host based on the approval result.

[0081] The above-mentioned data processing device also includes a determination module 36, which is used to determine the cloud resource template. Specifically, the cloud resource template is determined in the following manner: determining the resource information contained in the cloud resource template, wherein the resource information includes at least one of the following: virtual machine configuration, network service, database service; creating a cloud resource template based on the resource information, security policy and usage rights; verifying whether the template configuration of the cloud resource template is correct, and after the cloud resource template is verified, publishing the cloud resource template to the designated organization.

[0082] In the receiving module in the above-mentioned data processing device, the receiving module is also used to receive the cloud resources allocated by the cloud platform according to the cloud resource demand information when the approval result is approval passed; and to receive the approval failure information sent by the cloud platform when the approval result is approval failed.

[0083] The above-mentioned data processing device also includes a processing module 38, which is used to obtain a resource operation request initiated by the target object through the self-service system; when the resource operation request includes an operation of a preset resource, an approval process for the resource operation request is automatically initiated; when the approval result of the approval process is approved, the resource operation request is executed.

[0084] In the processing module in the above data processing device, the processing module is also used to obtain request information in the resource operation request; generate an order record based on the resource operation request and the request information; and save the order record in a database.

[0085] It should be noted that Figure 3The data processing device shown is used to perform Figure 2 The data processing method shown in the figure, therefore the relevant explanations in the above data processing method are also applicable to the data processing device, and will not be repeated here.

[0086] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory, and is used to execute program instructions to implement the following functions: receiving an access request sent by a target object; when the access request is to access the Internet, providing a first access path through a virtual private cloud network created for the cloud host, and accessing the Internet through the first access path; when the access request is to access a cloud platform, providing a second access path through a flat network created for the cloud host, and accessing the cloud platform through the second access path.

[0087] It should be noted that the above electronic equipment is used to execute Figure 2 The data processing method shown, therefore the relevant explanations and instructions in the above data processing method are also applicable to the electronic device and will not be repeated here.

[0088] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following data processing method by running the computer program: receiving an access request sent by a target object; in the case where the access request is to access the Internet, providing a first access path through a virtual private cloud network created for the cloud host, and accessing the Internet through the first access path; in the case where the access request is to access a cloud platform, providing a second access path through a flat network created for the cloud host, and accessing the cloud platform through the second access path.

[0089] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The data processing method shown, therefore the relevant explanations in the above data processing method are also applicable to the non-volatile storage medium, and will not be repeated here.

[0090] An embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the data processing method in each embodiment of the present application.

[0091] The embodiments of the present application also provide a computer program, which, when executed by a processor, implements the steps of the data processing method in each embodiment of the present application.

[0092] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0093] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0095] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0096] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0097] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0098] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for data processing, characterized in that: include: Receive the access request sent by the target object; In the case where the access request is to access the Internet, providing a first access path through a virtual private cloud network created for the cloud host, and accessing the Internet through the first access path; In the case where the access request is for accessing the cloud platform, a second access path is provided through a flat network created for the cloud host, and the cloud platform is accessed through the second access path.

2. The method according to claim 1, characterized in that Before receiving the access request sent by the target object, the method further includes: receiving an inbound security group created by a self-service system, wherein the inbound security group is used to control access rules to the self-service system, the self-service system is deployed in the cloud host, the self-service system is used to assist the cloud platform in processing access requests sent by the target object, and the cloud platform includes the cloud host; An outbound security group created by the self-service system is received, wherein the outbound security group is used to control access rules to the cloud platform.

3. The method according to claim 2, characterized in that The method further comprises: Receiving cloud resource demand information selected by the target object in the cloud resource template; Sending the cloud resource demand information to the cloud platform through the self-service system; Receiving the approval result of the cloud platform on the cloud resource demand information; Receive cloud resources allocated by the cloud platform to the cloud host according to the approval result.

4. The method according to claim 3, characterized in that The cloud resource template is determined in the following way: Determine resource information included in the cloud resource template, wherein the resource information includes at least one of the following: virtual machine configuration, network service, and database service; Creating the cloud resource template according to the resource information, security policy and usage authority; Verify whether the template configuration of the cloud resource template is correct, and after the cloud resource template passes the verification, publish the cloud resource template to the designated organization.

5. The method according to claim 3, characterized in that: Receiving cloud resources allocated by the cloud platform to the cloud host according to the approval result, including: When the approval result is approved, receiving cloud resources allocated by the cloud platform according to the cloud resource demand information; When the approval result is failure to approve, approval failure information sent by the cloud platform is received.

6. The method according to claim 2, characterized in that The method further comprises: Obtaining a resource operation request initiated by the target object through the self-service system; When the resource operation request includes an operation of a preset resource, automatically initiating an approval process for the resource operation request; When the approval result of the approval process is approval, the resource operation request is executed.

7. The method according to claim 6, characterized in that After obtaining the resource operation request initiated by the target object through the self-service system, the method further includes: Obtaining request information in the resource operation request; Generate an order record according to the resource operation request and the request information; The order record is stored in a database.

8. A data processing device, characterized in that: include: A receiving module, used for receiving an access request sent by a target object; A first access module, configured to provide a first access path through a virtual private cloud network created for the cloud host and access the Internet through the first access path when the access request is to access the Internet; The second access module is used to provide a second access path through the flat network created for the cloud host when the access request is to access the cloud platform, and access the cloud platform through the second access path.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is connected to the memory and is used to execute program instructions to implement the following functions: receiving an access request sent by a target object; when the access request is to access the Internet, providing a first access path through a virtual private cloud network created for the cloud host, and accessing the Internet through the first access path; when the access request is to access a cloud platform, providing a second access path through a flat network created for the cloud host, and accessing the cloud platform through the second access path.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the data processing method according to any one of claims 1 to 7 by running the computer program.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the data processing method described in any one of claims 1 to 7 is implemented.

Images