Cloud platform and configuration method and configuration device thereof

Abstract

The invention provides a cloud platform and a configuration method and device thereof. The cloud platform is additionally provided with a first agent module used for communicating the security subnet and the first subnet and a second agent module used for communicating the security subnet and the second subnet, and under the condition that the IP addresses of the first cloud host and the second cloud host are the same, the first cloud host can obtain the security service of the security service module through the first agent module, and the second cloud host can obtain the security service of the security service module through the second agent module. And the second cloud host obtains the security service of the security service module through the second agent module. The problem of communication between the security service client and the server when the IP addresses of the cloud hosts in different VPC instances are the same is solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a cloud platform and a configuration method and a configuration device thereof. Background Art

[0002] Cloud is the current mainstream technology. To meet the security protection needs of cloud hosts of tenants in the cloud, cloud providers support security services in the cloud. Security services are divided into exclusive and shared types. Shared security services deploy a security service server cluster in the security zone of the cloud platform. The cloud hosts under each VPC (Virtual Private Cloud) in the cloud platform share the security capabilities provided by this security service server cluster.

[0003] VPC in the cloud is an isolated network environment that runs on the infrastructure of a public cloud service provider. It allows users to create and manage independent virtual networks in a cloud environment, similar to traditional data center networks, but with the flexibility and scalability of cloud computing. VPC has the characteristics of network isolation and support for network customization. In VPC, users can freely define subnets and set IP address ranges. Therefore, users can create subnet instances of the same network segment in different VPCs. The security zone gateway is connected to different VPC routers. For the security service server in the security zone, it means that there are cloud hosts with the same IP address, but they don’t know which one to address.

[0004] How to solve the problem of normal connectivity between cloud hosts with the same address in different VPCs and security service server clusters in security zones to enable security capabilities is a technical problem to be solved in this field. Summary of the invention

[0005] In order to overcome the problems existing in the related art, the present application provides a cloud platform and a configuration method and a configuration device thereof.

[0006] According to a first aspect of an embodiment of the present application, a cloud platform is provided, the cloud platform comprising:

[0007] At least one security service module deployed in the security subnet;

[0008] A first cloud host deployed in a first subnet of a first VPC instance, and a second cloud host deployed in a second subnet of a second VPC instance, wherein the IP address of the first cloud host is the same as the IP address of the second cloud host;

[0009] a first proxy module for connecting the secure subnet and the first subnet, and a second proxy module for connecting the secure subnet and the second subnet;

[0010] The first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

[0011] According to a second aspect of an embodiment of the present application, a cloud platform configuration method is provided, including:

[0012] Creating a first proxy module for connecting a security subnet and a first subnet under a first VPC instance, and a second proxy module for connecting a security subnet and a second subnet under a second VPC instance, wherein the security subnet is deployed with at least one security service module, the first subnet is deployed with a first cloud host, the second subnet is deployed with a second cloud host, and the IP address of the first cloud host is the same as the IP address of the second cloud host;

[0013] The security service module is configured, or the first cloud host and the second cloud host are configured so that the first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

[0014] According to a third aspect of an embodiment of the present application, a cloud platform configuration device is provided, including:

[0015] A creation module, configured to create a first proxy module for connecting a security subnet and a first subnet under a first VPC instance, and a second proxy module for connecting a security subnet and a second subnet under a second VPC instance, wherein the security subnet is deployed with at least one security service module, the first subnet is deployed with a first cloud host, the second subnet is deployed with a second cloud host, and the IP address of the first cloud host is the same as the IP address of the second cloud host;

[0016] A configuration module is used to configure the security service module, or to configure the first cloud host and the second cloud host, so that the first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

[0017] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0018] In the embodiment of the present application, a first proxy module for connecting the security subnet and the first subnet, and a second proxy module for connecting the security subnet and the second subnet are newly added to the cloud host. When the IP addresses of the first cloud host and the second cloud host are the same, the first cloud host can obtain the security service of the security service module through the first proxy module, and the second cloud host can obtain the security service of the security service module through the second proxy module. This solves the connectivity problem between the security service client and the server when the IP addresses of the cloud hosts in different VPC instances are the same.

[0019] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0021] Figure 1 A first schematic diagram of a cloud platform provided in an embodiment of the present application;

[0022] Figure 2 A second schematic diagram of a cloud platform provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of host security of a cloud platform provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of a bastion host of a cloud platform provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of database auditing of a cloud platform provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of a cloud platform configuration method provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of the cloud platform configuration device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0029] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0030] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0031] Traditional cloud platforms connect the network between the security zone gateway and the business zone VPC router to make the two zones reachable, thereby achieving network connectivity between the security service server and the cloud host in the VPC. However, since the VPC network segment is user-defined, there may be overlaps between different VPC network segments, resulting in the same IP address for cloud hosts in different VPCs. In this case, the security service server of the traditional cloud platform will not know which cloud host to address.

[0032] In response to the above problems, the present application provides a cloud platform and its configuration method and configuration device to solve the problem of normal connectivity between cloud hosts with the same address under different VPCs and security service server clusters in security zones, thereby enabling security capabilities.

[0033] Next, the embodiments of the present application are described in detail.

[0034] The present application embodiment provides a cloud platform, such as Figure 1 As shown, the cloud platform includes:

[0035] A security zone, including at least one security service module deployed in a security subnet;

[0036] A business zone includes a first cloud host deployed in a first subnet of a first VPC instance and a second cloud host deployed in a second subnet of a second VPC instance, wherein an IP address of the first cloud host is the same as an IP address of the second cloud host;

[0037] The connection area includes a first proxy module for connecting the security subnet and the first subnet, and a second proxy module for connecting the security subnet and the second subnet.

[0038] The first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

[0039] Specifically, this application adds a security and business connectivity zone based on the traditional cloud platform. One end of the connectivity zone is connected to the security subnet of the security zone, and the other end is connected to the business subnet in each VPC instance. As a specific implementation method, for each VPC instance, this application creates a virtual machine in the connectivity zone, and implements the proxy function of the security service through the virtual machine. The virtual machine contains two network cards, one of which is connected to the business subnet in the VPC instance, and the other is connected to the security subnet in the security zone.

[0040] The present application divides the security service module into two types according to the traffic direction, namely, a first security service module and a second security service module, wherein the traffic direction of the first security service module is from the server to the client, and the traffic direction of the second security service module is from the client to the server.

[0041] If the security service module is the first security service module with traffic direction from the server to the client, as a specific implementation method, the present application implements the first proxy module and the second proxy module through Gost. Gost is a network tool used to create various network proxies and forwarding services. It supports multiple protocols, including the Socks5 network proxy protocol. The present application creates a Socks5 proxy through Gost, which is used to listen to the port of the security subnet, forward TCP traffic or UDP traffic, and can further set authentication information such as username and password.

[0042] Therefore, in Figure 1 In the embodiment, if the security service module is the first security service module whose traffic direction is from the server to the client, the first proxy module and the second proxy module are Gost modules, and the first proxy instance and the second proxy instance are deployed on the security service module, and the following configuration is performed: the peer port number of the first proxy instance in the security service module is configured as the port number of the first proxy module connected to the security subnet, and the peer port number of the second proxy instance in the security service module is configured as the port number of the second proxy module connected to the security subnet.

[0043] If the security service module is a second security service module whose traffic direction is from the client to the server, as a specific implementation method, the present application implements the first proxy module and the second proxy module through Nginx. Nginx is a reverse proxy service that supports forwarding client requests to the backend server, supports 4-layer proxy, and forwards TCP requests or UDP requests. Nginx supports configuring the listening port and the server address and port of the proxy in the form of a configuration file. The present application configures Nginx to implement the ports of the first proxy module and the second proxy module as proxies for the security service module.

[0044] Therefore, in Figure 1 In the embodiment, when the security service module is a second security service module with traffic direction from the client to the server, the first agent module and the second agent module are Nginx modules, the first agent module is deployed on the first cloud host, and the second agent module is deployed on the second cloud host, and the following configuration is performed: the opposite IP address of the first agent module in the first cloud host is configured as the IP address of the first agent module connected to the first subnet, and the opposite IP address of the second agent module in the second cloud host is configured as the IP address of the second agent module connected to the second subnet.

[0045] As mentioned above, in this application, at least one security service module is deployed under the security subnet. When multiple security service modules are deployed under the security subnet, different security service modules provide different security services, such as host security, database auditing, bastion host, etc. In this case, different cloud hosts only need to obtain security services from the corresponding security service modules according to their own security needs.

[0046] Therefore, as a specific implementation, if the security subnet is deployed with multiple security service modules, the first cloud host obtains the security service of the third security service module through the first proxy module, and the second cloud host obtains the security service of the fourth security service module through the second proxy module, wherein the third security service module is a security service module determined according to the business needs of the first cloud host, and the fourth security service module is a security service module determined according to the business needs of the second cloud host. It is understandable that the number of security service modules in the third security service module and the fourth security service module is an arbitrary integer greater than or equal to 1, and the security service modules in the third security service module and the fourth security service module can be partially or even completely the same, and this application does not limit this.

[0047] As mentioned above, in this application, the security service modules deployed in the security subnet include any one or more of the following: host security module, database audit module, bastion host module. The following is an explanation of different security services:

[0048] Host security is a product used to protect computer systems from malicious attacks, supporting anti-virus and anti-malware software. The working mode is client-server mode. The host installs the client program, and the client program is linked to the server in a one-way manner, including sending virus detection results to the server, or querying protection strategies from the server. The server provides protection strategy configuration functions, protection result statistics display, etc.

[0049] Database auditing is a product that records, monitors and analyzes database operations and access behaviors to ensure data security and compliance. The working mode is client-server mode. The client program is installed on the host where the data is located. The client program is linked to the server in a single direction, including sending database access behavior data to the server, and the server generates analysis reports.

[0050] The bastion host is a security device used to manage and control external access, providing centralized access control and auditing functions for the core resources within the enterprise. It processes various access requests through a unified entrance, thereby improving system security and compliance. When users need to access assets, they complete asset access through the bastion host's proxy.

[0051] In combination with the above embodiments, the implementation process of the present application is further explained below by taking a specific application as an example.

[0052] like Figure 2 As shown, two virtual machine proxies are created in the security and business connectivity zone (hereinafter referred to as the security and business connectivity zone), one virtual machine connects the security subnet and the first business subnet of the first VPC instance, and the other virtual machine connects the security subnet and the second business subnet of the second VPC instance. The first cloud host VM1 under the first business subnet of the first VPC instance has the same IP address as the second cloud host VM1 under the second business subnet of the second VPC instance. Three security service modules are deployed under the security subnet, namely the host security module, the bastion host module, and the database audit module.

[0053] like Figure 2 As shown in the figure, the Gost service and Nginx service are installed in the two virtual machine proxies. When the security service server actively accesses the cloud host in the VPC instance, it accesses through the Gost service proxy. The Nginx service in the virtual machine proxy has the ability to proxy the security service server. When the cloud host in the VPC instance actively accesses the security service server, it accesses the security service server by accessing the VPC side address of the virtual machine proxy.

[0054] like Figure 3 As shown in the figure, the steps to implement the host security service are as follows:

[0055] (31) Create a virtual machine proxyvpc1 in the security and business connectivity area (if the corresponding virtual machine has been created for VPC instance 1, there is no need to create it again). The network card address connected to the business subnet of the VPC instance is configured to 192.168.1.6, and the network card address connected to the security subnet is configured to 9.9.9.3.

[0056] (32) Install the Nginx service on the virtual machine proxyvpc1.

[0057] (33) Add configuration to the configuration file of the proxy server Nginx, define the TCP port and UDP port to be listened, and specify the target IP and port to be forwarded. The details are as follows:

[0058] Listen to TCP and UDP port 7443, and forward the traffic to 9.9.9.13:7443; listen to TCP and UDP port 80, and forward the traffic to 9.9.9.13:80; other ports (9686, 9685, 9683, 9682) are also similarly set up, listening and forwarding to the corresponding targets.

[0059] (34) Download the host security client agent program and install the agent program in the cloud host VM1 under VPC instance 1.

[0060] (35) Modify the upstream server address in the agent program configuration file to 192.168.1.6.

[0061] (36) After completing the above steps, the agent program installed in the cloud host VM1 under VPC instance 1 can complete the connection with the server, thereby completing the protection of the cloud host VM1.

[0062] like Figure 4 As shown, the steps to implement the bastion host service are as follows:

[0063] (41) Create a virtual machine proxyvpc1 in the security and business connectivity zone. Set the network card address connected to the business subnet of the VPC instance to 192.168.1.6, and the network card address connected to the security subnet to 9.9.9.3.

[0064] (42) Install the Gost service in the virtual machine proxyvpc1.

[0065] (43) Run the Socks5 proxy service and listen on port 3389 through the TCP protocol. Users need to enter the correct username and password for authentication before they can connect to the network through this proxy. The Gost service configuration is as follows:

[0066] Specify the service name as service-0, set the service listening address and port, here listening to the local port 3389. Specify the handler type as SOCKS5 proxy. Configure the identity authentication information, the user name is `root`, the password is `Aab123! @`. Set the listening protocol type to tcp.

[0067] (44) Configure a proxy instance on the bastion host, name it vpc1-proxy, set the address to 9.9.9.3, the port to 3389, the protocol type to socks5, the user name to root, and the password to Aab123!@.

[0068] (45) Create asset A on the bastion host. The address of asset A is 192.168.1.2. Asset A is associated with the vpc1 proxy.

[0069] (46) After completing the above steps, the safe zone bastion function can access asset A normally.

[0070] like Figure 5 As shown, the steps to implement database audit are as follows:

[0071] (51) Create a virtual machine proxyvpc1 in the security and business connectivity zone (if the corresponding virtual machine has been created for VPC instance 1, there is no need to create it again). The network card address connected to the business subnet of the VPC instance is configured to 192.168.1.6, and the network card address connected to the security subnet of the security zone is configured to 9.9.9.3.

[0072] (52) Install the Nginx service on the virtual machine proxyvpc1.

[0073] (53) Add configuration in Nginx to define multiple server blocks for listening and forwarding traffic. The details are as follows:

[0074] Each server block defines a server configuration that listens on a specific port and protocol (TCP or UDP) and forwards traffic to the specified IP address and port. The first and second server blocks: listen on TCP and UDP port 1443 and forward traffic to 9.9.9.15:1443; the third and fourth server blocks: listen on TCP and UDP port 9265 and forward traffic to 9.9.9.15:9265; the fifth and sixth server blocks: listen on TCP and UDP port 9266 and forward traffic to 9.9.9.15:9266.

[0075] (54) Download the database audit client agent program and install the agent program in the cloud host VM1 under VPC instance 1.

[0076] (55) Modify the upstream server address in the agent program configuration file to 192.168.1.6.

[0077] (56) After completing the above steps, the agent program installed in the cloud host VM1 under VPC instance 1 can complete the connection with the server, thereby completing the protection of the cloud host.

[0078] It can be seen from the above technical solutions that the present application provides a cloud platform, which adds a connectivity zone connecting the business zone and the security zone, converts the three-layer interconnection into a four-layer interconnection to avoid the drawbacks of the three-layer interconnection. Specifically, it solves the connectivity problem between the security service client and the server when the IP addresses of the cloud hosts in different VPC instances are the same.

[0079] Based on the same inventive concept, the present application also provides a cloud platform configuration method, the flow chart of which is as follows: Figure 6 As shown, the specific steps include:

[0080] Step 610: Create a first proxy module for connecting the security subnet and the first subnet under the first VPC instance, and a second proxy module for connecting the security subnet and the second subnet under the second VPC instance, wherein the security subnet is deployed with at least one security service module, the first subnet is deployed with a first cloud host, the second subnet is deployed with a second cloud host, and the IP address of the first cloud host is the same as the IP address of the second cloud host;

[0081] Step 620: configure the security service module, or configure the first cloud host and the second cloud host so that the first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

[0082] As a specific implementation manner, when the security service module is a first security service module with a traffic direction from the server to the client, the first proxy module and the second proxy module are Gost modules, and the method specifically configures the security service module in the following manner:

[0083] The peer port number of the first proxy instance in the security service module is configured as the port number of the first proxy module connecting to the security subnet, and the peer port number of the second proxy instance in the security service module is configured as the port number of the second proxy module connecting to the security subnet.

[0084] As a specific implementation manner, the protocol type of the first proxy instance and the second proxy instance in the security service module is configured as the socks5 protocol.

[0085] As a specific implementation manner, when the security service module is a second security service module with a traffic direction from the client to the server, the first proxy module and the second proxy module are Nginx modules, and the method specifically configures the first cloud host and the second cloud host in the following manner:

[0086] The peer IP address of the first agent module in the first cloud host is configured as the IP address of the first agent module connected to the first subnet, and the peer IP address of the second agent module in the second cloud host is configured as the IP address of the second agent module connected to the second subnet.

[0087] As a specific implementation manner, if the security subnet is deployed with multiple security service modules, the method specifically configures the security service module, or configures the first cloud host and the second cloud host in the following manner:

[0088] The security service module is configured, or the first cloud host and the second cloud host are configured so that the first cloud host obtains the security service of the third security service module through the first proxy module, and the second cloud host obtains the security service of the fourth security service module through the second proxy module, wherein the third security service module is a security service module determined according to the business needs of the first cloud host, and the fourth security service module is a security service module determined according to the business needs of the second cloud host.

[0089] As a specific implementation method, the security service module deployed in the security subnet includes any one or more of the following: a host security module, a database audit module, and a bastion host module.

[0090] Based on the same inventive concept, the present application also provides a cloud platform configuration device, the structure diagram of which is as follows: Figure 7 As shown, specifically including:

[0091] A creation module 710 is used to create a first proxy module for connecting a security subnet and a first subnet under a first VPC instance, and a second proxy module for connecting a security subnet and a second subnet under a second VPC instance, wherein the security subnet is deployed with at least one security service module, the first subnet is deployed with a first cloud host, the second subnet is deployed with a second cloud host, and the IP address of the first cloud host is the same as the IP address of the second cloud host;

[0092] Configuration module 720 is used to configure the security service module, or configure the first cloud host and the second cloud host, so that the first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

[0093] As a specific implementation manner, when the security service module is a first security service module with a traffic direction from the server to the client, the first proxy module and the second proxy module are Gost modules, and the configuration module 720 specifically configures the security service module in the following manner:

[0094] The peer port number of the first proxy instance in the security service module is configured as the port number of the first proxy module connecting to the security subnet, and the peer port number of the second proxy instance in the security service module is configured as the port number of the second proxy module connecting to the security subnet.

[0095] As a specific implementation manner, the protocol type of the first proxy instance and the second proxy instance in the security service module is configured as the Socks5 protocol.

[0096] As a specific implementation manner, when the security service module is a second security service module with a traffic direction from the client to the server, the first proxy module and the second proxy module are Nginx modules, and the configuration module 720 specifically configures the first cloud host and the second cloud host in the following manner:

[0097] The peer IP address of the first agent module in the first cloud host is configured as the IP address of the first agent module connected to the first subnet, and the peer IP address of the second agent module in the second cloud host is configured as the IP address of the second agent module connected to the second subnet.

[0098] As a specific implementation, if the security subnet is deployed with multiple security service modules, the configuration module 720 specifically configures the security service module, or configures the first cloud host and the second cloud host in the following manner:

[0099] The security service module is configured, or the first cloud host and the second cloud host are configured so that the first cloud host obtains the security service of the third security service module through the first proxy module, and the second cloud host obtains the security service of the fourth security service module through the second proxy module, wherein the third security service module is a security service module determined according to the business needs of the first cloud host, and the fourth security service module is a security service module determined according to the business needs of the second cloud host.

[0100] As a specific implementation method, the security service module deployed in the security subnet includes any one or more of the following: a host security module, a database audit module, and a bastion host module.

[0101] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A cloud platform, characterized in that: The cloud platform includes: At least one security service module deployed in the security subnet; A first cloud host deployed in a first subnet of a first VPC instance, and a second cloud host deployed in a second subnet of a second VPC instance, wherein the IP address of the first cloud host is the same as the IP address of the second cloud host; a first proxy module for connecting the secure subnet and the first subnet, and a second proxy module for connecting the secure subnet and the second subnet; The first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

2. The cloud platform according to claim 1, characterized in that: When the security service module is the first security service module whose traffic direction is from the server to the client, the first proxy module and the second proxy module are Gost modules, the peer port number of the first proxy instance in the security service module is configured as the port number of the first proxy module connected to the security subnet, and the peer port number of the second proxy instance in the security service module is configured as the port number of the second proxy module connected to the security subnet.

3. The cloud platform according to claim 2, characterized in that: The protocol type of the first proxy instance and the second proxy instance in the security service module is configured as the socks5 protocol.

4. The cloud platform according to claim 1, characterized in that: When the security service module is a second security service module with traffic direction from the client to the server, the first agent module and the second agent module are Nginx modules, the peer IP address of the first agent module in the first cloud host is configured as the IP address of the first agent module connected to the first subnet, and the peer IP address of the second agent module in the second cloud host is configured as the IP address of the second agent module connected to the second subnet.

5. The cloud platform according to any one of claims 1 to 4, characterized in that: If the security subnet is deployed with multiple security service modules, the first cloud host obtains the security service of the third security service module through the first proxy module, and the second cloud host obtains the security service of the fourth security service module through the second proxy module, wherein the third security service module is a security service module determined according to the business needs of the first cloud host, and the fourth security service module is a security service module determined according to the business needs of the second cloud host.

6. The cloud platform according to claim 5, characterized in that: The security service modules deployed in the security subnet include any one or more of the following: host security module, database audit module, and bastion host module.

7. A cloud platform configuration method, characterized in that: include: Creating a first proxy module for connecting a security subnet and a first subnet under a first VPC instance, and a second proxy module for connecting a security subnet and a second subnet under a second VPC instance, wherein the security subnet is deployed with at least one security service module, the first subnet is deployed with a first cloud host, the second subnet is deployed with a second cloud host, and the IP address of the first cloud host is the same as the IP address of the second cloud host; The security service module is configured, or the first cloud host and the second cloud host are configured so that the first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

8. The method according to claim 7, characterized in that When the security service module is a first security service module with a traffic direction from the server to the client, the first proxy module and the second proxy module are Gost modules, and the method specifically configures the security service module in the following manner: The peer port number of the first proxy instance in the security service module is configured as the port number of the first proxy module connecting to the security subnet, and the peer port number of the second proxy instance in the security service module is configured as the port number of the second proxy module connecting to the security subnet.

9. The method according to claim 7, characterized in that: When the security service module is a second security service module with traffic direction from the client to the server, the first proxy module and the second proxy module are Nginx modules, and the method specifically configures the first cloud host and the second cloud host in the following manner: The peer IP address of the first agent module in the first cloud host is configured as the IP address of the first agent module connected to the first subnet, and the peer IP address of the second agent module in the second cloud host is configured as the IP address of the second agent module connected to the second subnet.

10. The method according to any one of claims 7 to 9, characterized in that: If the security subnet is deployed with multiple security service modules, the method specifically configures the security service modules, or configures the first cloud host and the second cloud host in the following manner: The security service module is configured, or the first cloud host and the second cloud host are configured so that the first cloud host obtains the security service of the third security service module through the first proxy module, and the second cloud host obtains the security service of the fourth security service module through the second proxy module, wherein the third security service module is a security service module determined according to the business needs of the first cloud host, and the fourth security service module is a security service module determined according to the business needs of the second cloud host.

11. A cloud platform configuration device, characterized in that: include: A creation module, configured to create a first proxy module for connecting a security subnet and a first subnet under a first VPC instance, and a second proxy module for connecting a security subnet and a second subnet under a second VPC instance, wherein the security subnet is deployed with at least one security service module, the first subnet is deployed with a first cloud host, the second subnet is deployed with a second cloud host, and the IP address of the first cloud host is the same as the IP address of the second cloud host; A configuration module is used to configure the security service module, or to configure the first cloud host and the second cloud host, so that the first cloud host obtains the security service of the security service module through the first proxy module, and the second cloud host obtains the security service of the security service module through the second proxy module.

Images