Method for transmitting data traffic in cloud platform through virtual firewall and cloud platform

Abstract

The invention discloses a method for transmitting data flow through a virtual firewall in a cloud platform and the cloud platform, and the method comprises the steps: responding to uplink data flow to be transmitted, and determining a target uplink virtual physical address of the uplink data flow; sending the uplink data traffic to the virtual firewall according to an uplink forwarding rule of the uplink data traffic, so as to forward the uplink data traffic according to the target uplink virtual physical address under the condition that a security verification result of the virtual firewall on the uplink data traffic represents that verification is passed; acquiring downlink data traffic corresponding to the uplink data traffic sent from the virtual firewall; the terminal of which the downlink data traffic is the uplink data traffic receives the virtual device and returns the data traffic according to the uplink data traffic. The problem that when the flow data of the virtual network passes through the firewall, the configuration complexity and the fine granularity cannot be considered at the same time is solved.

Description

Technical Field

[0001] The present application belongs to the field of cloud platform security, and specifically relates to a method for transmitting data traffic through a virtual firewall in a cloud platform, a cloud platform, a device, and a storage medium. Background Art

[0002] In the cloud computing environment, Virtual Private Cloud (VPC) has become an important way for enterprises to deploy services and applications. As the scale and complexity of business expands, the need for mutual access between different subnets or VPCs has become more and more common.

[0003] At present, in order to achieve secure management of traffic in cloud platforms, a variety of technical solutions have been proposed and applied. One solution is to forward traffic uniformly through Virtual Private Cloud Gateway (VPCGW), and implement traffic forwarding and firewall filtering by configuring routing rules.

[0004] However, the existing process of configuring routing rules in VPCGW is too complicated to be universal in different business scenarios. If only a simple unified forwarding configuration is performed, it will cause security policy problems with insufficient granularity. Summary of the invention

[0005] The present application aims to provide a method for transmitting data traffic through a virtual firewall in a cloud platform, as well as a cloud platform, a device and a storage medium, at least to solve the problem that configuration complexity and granularity cannot be taken into account when the traffic data of the virtual network passes through the firewall.

[0006] In a first aspect, an embodiment of the present application discloses a method for transmitting data traffic through a virtual firewall in a cloud platform, which is applied to a virtual service execution device, including:

[0007] In response to the uplink data traffic to be sent, determining a destination uplink virtual physical address of the uplink data traffic; the destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device of the uplink data traffic;

[0008] According to the uplink forwarding rule of the uplink data traffic, the uplink data traffic is sent to the virtual firewall, so that when the security verification result of the uplink data traffic by the virtual firewall is characterized as verification passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located;

[0009] Acquire downlink data traffic corresponding to the uplink data traffic and sent from the virtual firewall; the downlink data traffic is a terminal receiving virtual device of the uplink data traffic, based on the return data traffic of the uplink data traffic.

[0010] In a second aspect, the embodiment of the present application further discloses a method for transmitting data traffic through a virtual firewall in a cloud platform, which is applied to a virtual cloud platform gateway, including:

[0011] In response to the downlink data traffic to be forwarded, determining a destination downlink virtual physical address of the downlink data traffic; the destination downlink virtual physical address is a virtual physical address of a virtual service execution device corresponding to the downlink data traffic; the downlink data traffic is generated according to the uplink data traffic sent by the virtual service execution device, and is the return data traffic of the uplink data traffic;

[0012] According to the downlink forwarding rule of the downlink data traffic, the downlink data traffic is forwarded to the virtual firewall, so that when the security verification result of the virtual firewall on the downlink data traffic is characterized as passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0013] In a third aspect, the embodiment of the present application further discloses a method for transmitting data traffic through a virtual firewall in a cloud platform, which is applied to a virtual firewall and includes:

[0014] In response to the uplink data traffic and / or downlink data traffic to be forwarded, security verification is performed on the uplink data traffic and / or the downlink data traffic; the uplink data traffic is the data traffic sent by the virtual business execution device according to the uplink forwarding rule of the uplink data traffic; the downlink data traffic is the return data traffic of the uplink data traffic generated according to the uplink data traffic and forwarded by the virtual cloud platform gateway according to the downlink forwarding rule of the downlink data traffic; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located;

[0015] When the security verification result of the uplink data traffic is characterized as passed, forwarding the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic; the destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device of the uplink data traffic;

[0016] When the security verification result of the downlink data traffic is characterized as verification passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address of the downlink data traffic; the destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic.

[0017] In a fourth aspect, the embodiment of the present application further discloses a cloud platform for data traffic passing through a virtual firewall, including:

[0018] Virtual business execution device, virtual cloud platform gateway and virtual firewall;

[0019] The virtual service execution device is used to determine the destination uplink virtual physical address of the uplink data traffic in response to the uplink data traffic to be sent, and send the uplink data traffic to the virtual firewall according to the uplink forwarding rule of the uplink data traffic, so as to forward the uplink data traffic according to the destination uplink virtual physical address when the security verification result of the uplink data traffic by the virtual firewall is characterized as passed, and obtain the downlink data traffic sent from the virtual firewall and corresponding to the uplink data traffic; the destination uplink virtual physical address is the virtual physical address of the terminal receiving virtual device of the uplink data traffic; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located;

[0020] The virtual cloud platform gateway is used to determine the destination downlink virtual physical address of the downlink data traffic in response to the downlink data traffic to be forwarded, and forward the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic, so as to forward the downlink data traffic according to the destination downlink virtual physical address when the security verification result of the virtual firewall on the downlink data traffic is characterized as passed verification; the destination downlink virtual physical address is the virtual physical address of the virtual business execution device corresponding to the downlink data traffic; the downlink data traffic is generated according to the uplink data traffic sent by the virtual business execution device, and is the return data traffic of the uplink data traffic; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located;

[0021] The virtual firewall is used to perform security verification on the uplink data traffic and / or the downlink data traffic in response to the uplink data traffic and / or the downlink data traffic to be forwarded, and when the security verification result of the uplink data traffic is characterized by verification passing, forward the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic, and when the security verification result of the downlink data traffic is characterized by verification passing, forward the downlink data traffic according to the destination downlink virtual physical address of the downlink data traffic.

[0022] In the fifth aspect, an embodiment of the present application further discloses an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in any one of the first to third aspects are implemented.

[0023] In a sixth aspect, an embodiment of the present application further discloses a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in any one of the first to third aspects are implemented.

[0024] In summary, in the embodiment of the present application, by adding a dedicated uplink forwarding rule to the virtual business execution device, and adding a dedicated downlink forwarding rule to the virtual cloud platform gateway, during the data exchange process, the customer is unaware of the process of data traffic passing through the firewall. At the same time, by executing the uplink data traffic sending process on the virtual business execution device, and executing the downlink data traffic forwarding process on the virtual cloud platform gateway, the routing settings of the local device do not need to consider the conflict with the global routing, which simplifies the setting of the data forwarding rules. Therefore, based on the method of the embodiment of the present application, when configuring a virtual network with a firewall, there is no need to make complex designs and verifications in order to maintain an overall security routing table, which solves the problem that the configuration complexity and granularity cannot be taken into account when the traffic data of the virtual network passes through the firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In the attached picture:

[0026] Figure 1 It is a flowchart of the steps of a method for transmitting data traffic through a virtual firewall in a cloud platform provided by an embodiment of the present application;

[0027] Figure 2 It is a flowchart of the steps of another method for transmitting data traffic through a virtual firewall in a cloud platform provided by an embodiment of the present application;

[0028] Figure 3 It is a comparison diagram of the process of transmitting flow data by the method provided in the embodiment of the present application and the prior art;

[0029] Figure 4 It is a schematic diagram of the uplink and downlink process of data traffic under the method provided in the embodiment of the present application;

[0030] Figure 5 It is a schematic diagram of the steps of the uplink and downlink process of data traffic under the method provided in the embodiment of the present application;

[0031] Figure 6 A cloud platform for data traffic passing through a virtual firewall provided in an embodiment of the present application;

[0032] Figure 7 is a block diagram of an electronic device according to an embodiment of the present application;

[0033] Figure 8 It is a block diagram of an electronic device of another embodiment provided by the embodiments of the present application. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0035] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0036] Figure 1 This embodiment provides a method for transmitting data traffic through a virtual firewall in a cloud platform.

[0037] Among them, step 101, step 102, and step 108 are applied to the virtual business execution device, step 103, step 104, and step 107 are applied to the virtual firewall, and step 105 and step 106 are applied to the virtual cloud platform gateway.

[0038] Step 101: In response to uplink data traffic to be sent, determine a destination uplink virtual physical address of the uplink data traffic.

[0039] The destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device for uplink data traffic.

[0040] In some embodiments of the present application, in response to the uplink data traffic to be sent, the destination uplink virtual physical address of the uplink data traffic is determined. The reason for performing this step is to ensure that the uplink data traffic can accurately reach its terminal receiving virtual device. The process of performing this step includes determining its destination uplink virtual physical address according to the uplink forwarding rule of the uplink data traffic. The destination uplink virtual physical address is the virtual physical address of the terminal receiving virtual device of the uplink data traffic. After performing this step, it can be ensured that the uplink data traffic can be accurately forwarded to its terminal receiving virtual device during the sending process, thereby improving the accuracy and reliability of data transmission.

[0041] In a specific example, a user sends an uplink data flow on the cloud platform, and the data flow needs to be forwarded to a specific virtual device. The user first determines the destination uplink virtual physical address of the data flow according to the uplink forwarding rule of the uplink data flow. Then, the user sends the data flow to the virtual firewall for security verification.

[0042] Step 102, according to the uplink forwarding rule of the uplink data traffic, the uplink data traffic is sent to the virtual firewall, so that when the security verification result of the virtual firewall on the uplink data traffic is characterized as verification passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address.

[0043] Among them, the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0044] In some embodiments of the present application, the uplink data traffic is sent to the virtual firewall according to the uplink forwarding rule of the uplink data traffic. The reason for performing this step is to ensure that the uplink data traffic can be security verified during the transmission process to prevent unverified data traffic from posing a security threat to the system. The process of performing this step includes forwarding the uplink data traffic according to the destination uplink virtual physical address when the security verification result of the virtual firewall on the uplink data traffic is characterized as passed. The uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located. After performing this step, it can ensure that the uplink data traffic is accurately forwarded to its terminal receiving virtual device after security verification, thereby improving the security of the system and the accuracy of data transmission.

[0045] In a specific example, a user sends an uplink data flow on the cloud platform, and the data flow needs to be forwarded to a specific virtual device. The user sends the data flow to the virtual firewall for security verification according to the uplink forwarding rule of the uplink data flow. After the virtual firewall verifies the uplink data flow, it forwards the data flow according to the destination uplink virtual physical address.

[0046] Step 103: In response to the uplink data traffic and / or downlink data traffic to be forwarded, perform security verification on the uplink data traffic and / or downlink data traffic.

[0047] Among them, the uplink data traffic is the data traffic sent by the virtual business execution device according to the uplink forwarding rules of the uplink data traffic; the downlink data traffic is the return data traffic of the uplink data traffic generated according to the uplink data traffic and forwarded by the virtual cloud platform gateway according to the downlink forwarding rules of the downlink data traffic; the uplink forwarding rules are used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; the downlink forwarding rules are used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0048] In some embodiments of the present application, in response to the uplink data traffic and / or downlink data traffic to be forwarded, the uplink data traffic and / or downlink data traffic is security verified. The reason for performing this step is to ensure that all data traffic is security verified during the transmission process to prevent unverified data from threatening the system security. The process of performing this step includes security verification of the uplink data traffic and the downlink data traffic. The uplink data traffic is the data traffic sent by the virtual service execution device according to the uplink forwarding rule of the uplink data traffic, and the downlink data traffic is forwarded by the virtual cloud platform gateway according to the downlink forwarding rule of the downlink data traffic, and is the return data traffic generated according to the uplink data traffic. The uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located. After performing this step, it can ensure that the uplink and downlink data traffic are security verified during the transmission process, thereby improving the security and reliability of the system.

[0049] In a specific example, a user sends an uplink data flow on the cloud platform, and the data flow needs to be securely verified by the virtual firewall. The uplink data flow is sent to the virtual firewall according to the uplink forwarding rules, and the virtual firewall performs security verification on the uplink data flow. At the same time, the downlink data flow is forwarded by the virtual cloud platform gateway according to the downlink forwarding rules, and the return data flow is generated based on the uplink data flow. Subsequently, the downlink data flow also needs to be securely verified by the virtual firewall.

[0050] Step 104 : when the security verification result of the uplink data traffic indicates that the verification is passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address of the uplink data traffic.

[0051] The destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device for uplink data traffic.

[0052] In some embodiments of the present application, when the security verification result of the uplink data traffic is characterized as verification passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address of the uplink data traffic. The reason for performing this step is to ensure that the uplink data traffic can be accurately forwarded to its terminal receiving virtual device after passing the security verification, thereby ensuring the security and accuracy of data transmission. The process of performing this step includes forwarding the uplink data traffic that has passed the security verification according to its destination uplink virtual physical address. The destination uplink virtual physical address is the virtual physical address of the terminal receiving virtual device of the uplink data traffic. After performing this step, the accuracy of data transmission can be effectively improved, and the security of data during transmission can be ensured.

[0053] In a specific example, a user sends an uplink data flow on the cloud platform, and the data flow needs to be forwarded to a specific virtual device. After the virtual firewall performs security verification on the uplink data flow, if the verification passes, the data flow is forwarded to the terminal receiving virtual device according to the destination uplink virtual physical address of the uplink data flow. For example, if the destination uplink virtual physical address is the address of a virtual machine, the data flow will be accurately forwarded to the virtual machine.

[0054] Step 105 : In response to the downlink data traffic to be forwarded, determine the destination downlink virtual physical address of the downlink data traffic.

[0055] Among them, the destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic; the downlink data traffic is generated based on the uplink data traffic sent by the virtual service execution device, and is the return data traffic of the uplink data traffic.

[0056] In some embodiments of the present application, in response to the downlink data traffic to be forwarded, the destination downlink virtual physical address of the downlink data traffic is determined. The reason for performing this step is to ensure that the downlink data traffic can accurately reach its corresponding virtual service execution device. The process of performing this step includes determining its destination downlink virtual physical address based on the downlink data traffic to be forwarded. The destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic. The downlink data traffic is the return data traffic generated based on the uplink data traffic sent by the virtual service execution device. After performing this step, it can be ensured that the downlink data traffic can be accurately forwarded to its corresponding virtual service execution device during the sending process, thereby improving the accuracy and reliability of data transmission.

[0057] In a specific example, a user receives a downlink data flow on a cloud platform, and the data flow is a return data flow generated based on the uplink data flow. The user first determines the destination downlink virtual physical address based on the downlink data flow, and the address is the virtual physical address of the virtual service execution device corresponding to the downlink data flow. Then, the user sends the data flow to the corresponding virtual service execution device.

[0058] Step 106, forwarding the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic, so that when the security verification result of the virtual firewall on the downlink data traffic is characterized as verification passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address.

[0059] Among them, the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0060] In some embodiments of the present application, the downlink data traffic is forwarded to the virtual firewall according to the downlink forwarding rule of the downlink data traffic. The reason for performing this step is to ensure that the downlink data traffic can be security verified during the transmission process to prevent unverified data from posing a security threat to the system. The process of performing this step includes forwarding the downlink data traffic according to the destination downlink virtual physical address when the security verification result of the virtual firewall on the downlink data traffic is characterized as verification passed. The downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located. After performing this step, it can ensure that the downlink data traffic is accurately forwarded to its terminal receiving virtual device after security verification, thereby improving the security of the system and the accuracy of data transmission.

[0061] In a specific example, a user receives a downlink data flow on the cloud platform, and the data flow needs to be forwarded to a specific virtual device. The user sends the data flow to the virtual firewall for security verification according to the downlink forwarding rule of the downlink data flow. After the virtual firewall verifies the downlink data flow, it forwards the data flow according to the destination downlink virtual physical address.

[0062] Step 107 : when the security verification result of the downlink data traffic indicates that the verification is passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address of the downlink data traffic.

[0063] The destination downlink virtual physical address is a virtual physical address of a virtual service execution device corresponding to the downlink data traffic.

[0064] In some embodiments of the present application, when the security verification result of the downlink data traffic is characterized as verification passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address of the downlink data traffic. The reason for performing this step is to ensure that the downlink data traffic can be accurately forwarded to its corresponding virtual service execution device after passing the security verification, thereby ensuring the security and accuracy of data transmission. The process of performing this step includes forwarding the downlink data traffic that has passed the security verification according to its destination downlink virtual physical address. The destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic. After performing this step, the accuracy of data transmission can be effectively improved, and the security of data during transmission can be ensured.

[0065] In a specific example, a user receives a downlink data flow on the cloud platform, and the data flow needs to be forwarded to a specific virtual device. After the virtual firewall performs security verification on the downlink data flow, if the verification passes, the data flow is forwarded to the corresponding virtual service execution device according to the destination downlink virtual physical address of the downlink data flow. For example, if the destination downlink virtual physical address is the address of a virtual machine, the data flow will be accurately forwarded to the virtual machine.

[0066] Step 108, obtaining the downlink data traffic corresponding to the uplink data traffic sent from the virtual firewall.

[0067] Among them, the downlink data traffic is the terminal receiving virtual device of the uplink data traffic, based on the return data traffic of the uplink data traffic.

[0068] In some embodiments of the present application, a downlink data flow corresponding to the uplink data flow is obtained and sent from the virtual firewall. The reason for performing this step is to ensure that the uplink data flow can smoothly complete the round trip process and improve the integrity and reliability of data transmission. The process of performing this step includes obtaining the downlink data flow corresponding to the uplink data flow from the virtual firewall. The downlink data flow is the return data flow of the uplink data flow according to the terminal receiving virtual device of the uplink data flow. After performing this step, it can ensure that the uplink and downlink data flows maintain consistency and integrity during the transmission process, thereby improving the reliability of the system and the security of data transmission.

[0069] In a specific example, a user sends an uplink data flow on the cloud platform, and the data flow is forwarded to the terminal receiving virtual device after security verification by the virtual firewall. At this time, the user needs to obtain the downlink data flow corresponding to the uplink data flow. The user obtains the downlink data flow from the virtual firewall and ensures that it corresponds to the uplink data flow.

[0070] In summary, in the embodiment of the present application, by adding a dedicated uplink forwarding rule to the virtual business execution device, and adding a dedicated downlink forwarding rule to the virtual cloud platform gateway, during the data exchange process, the customer is unaware of the process of data traffic passing through the firewall. At the same time, by executing the uplink data traffic sending process on the virtual business execution device, and executing the downlink data traffic forwarding process on the virtual cloud platform gateway, the routing settings of the local device do not need to consider the conflict with the global routing, which simplifies the setting of the data forwarding rules. Therefore, based on the method of the embodiment of the present application, when configuring a virtual network with a firewall, there is no need to make complex designs and verifications in order to maintain an overall security routing table, which solves the problem that the configuration complexity and granularity cannot be taken into account when the traffic data of the virtual network passes through the firewall.

[0071] Figure 3 Another method for transmitting data traffic through a virtual firewall in a cloud platform is provided in an embodiment of the present application.

[0072] Among them, step 203, step 204, and step 210 are applied to the virtual business execution device, step 205, step 206, and step 209 are applied to the virtual firewall, and step 201, step 202, step 207, and step 208 are applied to the virtual cloud platform gateway.

[0073] Step 201, add an uplink forwarding rule for uplink data traffic in the execution subnet route of the business execution virtual subnet, and add a downlink forwarding rule for downlink data traffic in the gateway route of the virtual cloud platform gateway.

[0074] The service execution virtual subnet is a virtual subnet of the cloud platform where the virtual service execution device is located.

[0075] In some embodiments of the present application, in the execution subnet route of the business execution virtual subnet, an uplink forwarding rule for the uplink data traffic is added, and in the gateway route of the virtual cloud platform gateway, a downlink forwarding rule for the downlink data traffic is added. The reason for performing this step is to ensure that both the uplink and downlink data traffic can be forwarded according to the predetermined rules during the transmission process, thereby ensuring the stability and security of data transmission. The process of performing this step includes adding an uplink forwarding rule in the business execution virtual subnet to ensure that the uplink data traffic can be forwarded to the virtual firewall according to the rules; adding a downlink forwarding rule in the virtual cloud platform gateway to ensure that the downlink data traffic can be forwarded to the subnet where the virtual firewall is located according to the rules. The business execution virtual subnet is the virtual subnet of the cloud platform where the virtual business execution device is located. After performing this step, it can be ensured that both the uplink and downlink data traffic can be forwarded according to the predetermined rules during the transmission process, thereby improving the efficiency and security of data transmission.

[0076] In a specific example, a new virtual service execution device needs to be configured on the cloud platform. First, an uplink forwarding rule for uplink data traffic is added to the execution subnet route of the service execution virtual subnet to ensure that the data traffic can be forwarded to the virtual firewall. Then, a downlink forwarding rule for downlink data traffic is added to the gateway route of the virtual cloud platform gateway to ensure that the downlink data traffic returned from the virtual firewall can be correctly forwarded to the corresponding service execution device.

[0077] Step 202: Send the execution subnet route to the business execution virtual subnet, and send the gateway route to the firewall virtual subnet.

[0078] The firewall virtual subnet is a virtual subnet of the cloud platform where the virtual firewall is located.

[0079] In some embodiments of the present application, the execution subnet route is sent to the business execution virtual subnet, and the gateway route is sent to the firewall virtual subnet. The reason for performing this step is to ensure that the upstream and downstream data traffic can be transmitted according to the predetermined routing rules, thereby improving the stability and security of data transmission. The process of performing this step includes sending the execution subnet route of the upstream data traffic to the business execution virtual subnet, and sending the gateway route of the downstream data traffic to the firewall virtual subnet. The firewall virtual subnet is the virtual subnet of the cloud platform where the virtual firewall is located. After performing this step, it can be ensured that the data traffic can be forwarded according to the predetermined routing rules during the transmission process, thereby improving the efficiency and security of data transmission.

[0080] In a specific example, a new virtual firewall is configured on the cloud platform. During the configuration process, the execution subnet route of the upstream data traffic has been sent to the business execution virtual subnet to ensure that the data traffic can be forwarded to the virtual firewall. At the same time, the gateway route of the downstream data traffic is also sent to the firewall virtual subnet to ensure that the downstream data traffic returned from the virtual firewall can be correctly forwarded to the corresponding business execution device.

[0081] Step 203: In response to the uplink data traffic to be sent, determine the destination uplink virtual physical address of the uplink data traffic.

[0082] The destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device for uplink data traffic.

[0083] The method shown in this step has been explained in step 101 and will not be repeated here.

[0084] Step 204, according to the uplink forwarding rule of the uplink data traffic, the uplink data traffic is sent to the virtual firewall, so that when the security verification result of the virtual firewall on the uplink data traffic is characterized as verification passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address.

[0085] Among them, the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0086] The method shown in this step has been explained in step 102 and will not be repeated here.

[0087] Optionally, step 204 includes the following sub-steps:

[0088] Sub-step 2041, determining an uplink forwarding rule for uplink data traffic in the execution subnet routing of the service execution virtual subnet according to the destination uplink virtual physical address.

[0089] The service execution virtual subnet is a virtual subnet of the cloud platform where the virtual service execution device is located.

[0090] In some embodiments of the present application, an uplink forwarding rule for uplink data traffic is determined in the execution subnet routing of the business execution virtual subnet according to the destination uplink virtual physical address. The reason for performing this step is to ensure that the uplink data traffic can be forwarded according to a predetermined rule, thereby ensuring the efficiency and accuracy of data transmission. The process of performing this step includes determining the uplink forwarding rule for uplink data traffic in the execution subnet routing of the business execution virtual subnet according to the destination uplink virtual physical address. The business execution virtual subnet is a virtual subnet of the cloud platform where the virtual business execution device is located. After performing this step, it can be ensured that the uplink data traffic is forwarded according to a predetermined rule during the transmission process, thereby improving the reliability and accuracy of data transmission.

[0091] In a specific example, a new virtual service execution device has been configured on the cloud platform. First, the uplink forwarding rules for the uplink data traffic will be determined in the execution subnet routing of the service execution virtual subnet according to the destination uplink virtual physical address. These rules ensure that the data traffic can be correctly forwarded to the virtual firewall.

[0092] Sub-step 2042, forwarding the uplink data traffic according to the uplink forwarding rule.

[0093] In some embodiments of the present application, the uplink data traffic is forwarded according to the uplink forwarding rule. The reason for performing this step is to ensure that the uplink data traffic can be accurately transmitted to the destination according to the predetermined rules, thereby improving the security and efficiency of data transmission. The process of performing this step includes forwarding the uplink data traffic from the business execution virtual subnet to the virtual firewall for processing according to the determined uplink forwarding rules. The uplink forwarding rules are rules for guiding the transmission path of the uplink data traffic. After performing this step, it can be ensured that the uplink data traffic is forwarded according to the predetermined path during the transmission process, thereby ensuring the reliability and security of data transmission.

[0094] In a specific example, a new virtual service execution device has been configured on the cloud platform. According to the determined uplink forwarding rule, the uplink data traffic can be forwarded from the service execution virtual subnet to the virtual firewall for processing. The uplink forwarding rule specifies the transmission path of the data traffic to ensure that the data can accurately reach the virtual firewall.

[0095] Step 205: In response to the uplink data traffic and / or downlink data traffic to be forwarded, perform security verification on the uplink data traffic and / or downlink data traffic.

[0096] Among them, the uplink data traffic is the data traffic sent by the virtual business execution device according to the uplink forwarding rules of the uplink data traffic; the downlink data traffic is the return data traffic of the uplink data traffic generated according to the uplink data traffic and forwarded by the virtual cloud platform gateway according to the downlink forwarding rules of the downlink data traffic; the uplink forwarding rules are used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; the downlink forwarding rules are used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0097] The method shown in this step has been explained in step 103 and will not be repeated here.

[0098] Step 206: When the security verification result of the uplink data traffic indicates that the verification is passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address of the uplink data traffic.

[0099] The destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device for uplink data traffic.

[0100] The method shown in this step has been described in step 104 and will not be repeated here.

[0101] Optionally, step 206 includes the following sub-steps:

[0102] Sub-step 2061, when the security verification result of the uplink data traffic is characterized as verification passed, determining the source virtual physical address of the uplink data traffic.

[0103] The source virtual physical address is a virtual physical address of a virtual service execution device that sends uplink data traffic.

[0104] In some embodiments of the present application, when the security verification result of the uplink data traffic is characterized as passed verification, the source virtual physical address of the uplink data traffic is determined. The reason for performing this step is to accurately identify the sending source of the data traffic during the data transmission process, thereby ensuring the integrity and traceability of the data. The process of performing this step includes determining the source virtual physical address of the data traffic after the uplink data traffic passes the security verification. The source virtual physical address is the virtual physical address of the virtual service execution device that sends the uplink data traffic. After performing this step, it can ensure that the source address information of the data traffic remains consistent during the transmission process, thereby improving the security and traceability of the data.

[0105] In a specific example, in order to configure a new virtual service execution device on the cloud platform, after the uplink data traffic passes the security verification of the virtual firewall, it is necessary to determine the source virtual physical address of the data traffic. The source virtual physical address is the address information of the virtual device that sends the uplink data traffic.

[0106] Sub-step 2062 encapsulates the source virtual physical address and the uplink data traffic, and forwards the encapsulated uplink data traffic according to the uplink virtual physical address, so that when the terminal receiving virtual device of the uplink data traffic sends the downlink data traffic corresponding to the uplink data traffic, the source virtual physical address is used as the downlink virtual physical address of the downlink data traffic.

[0107] In some embodiments of the present application, the source virtual physical address is encapsulated with the uplink data traffic, and the encapsulated uplink data traffic is forwarded according to the uplink virtual physical address. The reason for performing this step is to ensure that the data traffic can carry complete source address information during the transmission process, so that its source address can be accurately identified when the data traffic returns. The process of performing this step includes encapsulating the source virtual physical address with the uplink data traffic, and forwarding the encapsulated data traffic according to the uplink virtual physical address. The source virtual physical address is the virtual physical address of the virtual service execution device that sends the uplink data traffic. After performing this step, it can be ensured that after the uplink data traffic is encapsulated and forwarded, its source address information can be used as the downlink virtual physical address of the downlink data traffic during the return trip, thereby improving the accuracy and traceability of data transmission.

[0108] In a specific example, a new virtual service execution device will be configured on the cloud platform. When the uplink data traffic passes the security verification of the virtual firewall, the source virtual physical address will be encapsulated with the uplink data traffic, and the encapsulated data traffic will be forwarded according to the uplink virtual physical address. At this time, when the terminal receiving the uplink data traffic sends the corresponding downlink data traffic, the source virtual physical address will be used as the downlink virtual physical address of the downlink data traffic.

[0109] Step 207: In response to the downlink data traffic to be forwarded, determine the destination downlink virtual physical address of the downlink data traffic.

[0110] Among them, the destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic; the downlink data traffic is generated based on the uplink data traffic sent by the virtual service execution device, and is the return data traffic of the uplink data traffic.

[0111] The method shown in this step has been explained in step 105 and will not be repeated here.

[0112] Step 208, forwarding the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic, so as to forward the downlink data traffic according to the destination downlink virtual physical address when the security verification result of the virtual firewall on the downlink data traffic is characterized as verification passed.

[0113] Among them, the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

[0114] The method shown in this step has been described in step 106 and will not be repeated here.

[0115] Optionally, step 208 includes the following sub-steps:

[0116] Sub-step 2081, according to the destination downlink virtual physical address, determine the downlink forwarding rule of the downlink data traffic in the gateway routing of the virtual cloud platform gateway.

[0117] In some embodiments of the present application, a downlink forwarding rule for downlink data traffic is determined in the gateway routing of the virtual cloud platform gateway according to the destination downlink virtual physical address. The reason for performing this step is to ensure that the downlink data traffic can be accurately transmitted to its target device according to predetermined rules, thereby improving the efficiency and security of data transmission. The process of performing this step includes determining the downlink forwarding rule for downlink data traffic according to the destination downlink virtual physical address in the gateway routing of the virtual cloud platform gateway. The destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic. After performing this step, it can be ensured that the downlink data traffic is forwarded according to predetermined rules, thereby improving the accuracy and reliability of data transmission.

[0118] In a specific example, a new virtual service execution device needs to be configured on the cloud platform. When downlink data traffic is received, the downlink forwarding rules will be determined in the gateway routing of the virtual cloud platform gateway according to the destination downlink virtual physical address of the data traffic. These rules ensure that the downlink data traffic can be correctly transmitted to the target device.

[0119] Sub-step 2082, forwarding the downlink data traffic according to the downlink forwarding rule.

[0120] In some embodiments of the present application, the downlink data traffic is forwarded according to the downlink forwarding rule. The reason for performing this step is to ensure that the downlink data traffic can be accurately transmitted to its destination according to the predetermined rules, thereby improving the efficiency and security of data transmission. The process of performing this step includes forwarding the downlink data traffic from the virtual cloud platform gateway to its destination virtual device according to the determined downlink forwarding rules. The downlink forwarding rules are rules for guiding the transmission path of the downlink data traffic. After performing this step, it can be ensured that the downlink data traffic is forwarded according to the predetermined path during the transmission process, thereby ensuring the reliability and security of data transmission.

[0121] In a specific example, a new virtual service execution device needs to be configured on the cloud platform. According to the determined downlink forwarding rules, the downlink data traffic will be forwarded from the virtual cloud platform gateway to the destination virtual device. The downlink forwarding rules specify the transmission path of the data traffic to ensure that the data can accurately reach the target device.

[0122] Step 209 : when the security verification result of the downlink data traffic indicates that the verification is passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address of the downlink data traffic.

[0123] The destination downlink virtual physical address is a virtual physical address of a virtual service execution device corresponding to the downlink data traffic.

[0124] The method shown in this step has been described in step 107 and will not be repeated here.

[0125] Step 210, obtaining the downlink data traffic corresponding to the uplink data traffic sent from the virtual firewall.

[0126] Among them, the downlink data traffic is the terminal receiving virtual device of the uplink data traffic, based on the return data traffic of the uplink data traffic.

[0127] The method shown in this step has been explained in step 108 and will not be repeated here.

[0128] Optionally, in some embodiments of the present application,

[0129] like Figure 3 As shown, in a specific embodiment of the present application, the solution is shown in the same network to forward data traffic to the business execution virtual machine of the business execution subnet after passing through the virtual firewall (path 1), and to send it directly to the business execution virtual machine (path 2).

[0130] like Figure 4 As shown, for path 1, during the uplink of data traffic ( Figure 4 The virtual service execution device will first query the uplink forwarding rule in the execution subnet route, and then forward it to the virtual firewall virtual subnet, and then determine the destination of the uplink data based on the gateway route of the firewall virtual subnet. For example, Figure 4 As shown in , the data is sent to the terminal receiving virtual device of the Internet Data Center (Idc).

[0131] At this time, assuming that the terminal receiving virtual device generates downlink data traffic based on the uplink data traffic, it needs to send it back to the virtual service execution device along the same path. Figure 4The solid line direction in the figure first forwards the downlink data traffic to the virtual firewall according to the downlink forwarding rules stored in the gateway route, and then returns the data after security verification by the virtual firewall.

[0132] It should be emphasized that since the function of the firewall is to verify the security of data, in this solution, if the uplink data traffic / downlink data traffic fails to pass the data security verification process when passing through the virtual firewall, the data will be recycled or discarded to ensure the security of data communication.

[0133] like Figure 5 As shown, through the complete sending process of the uplink data traffic, that is, step S1 to step S7, the data finally arrives at the terminal receiving virtual device;

[0134] Step S1: The service execution virtual machine sends data to the virtual switch (Open vSwitch, OVS) of the service execution virtual subnet. The data starts from the virtual machine and enters the switch of the service execution subnet.

[0135] Step S2: The virtual switch of the service execution virtual subnet sends the data to the virtual firewall, and the data is forwarded between subnets and enters the firewall virtual subnet.

[0136] Step S3: After the virtual firewall completes the security verification, it sends the data to the virtual firewall subnet virtual switch, and the data is forwarded within the firewall virtual subnet.

[0137] Step S4: The firewall subnet virtual switch sends the data to the private cloud virtual gateway.

[0138] Step S5: The data is transmitted from the gateway of the private cloud to the gateway of the data center, and the data now enters the global network.

[0139] Step S6: Data enters the dedicated channel from the gateway of the data center.

[0140] Step S7: The data passes through the dedicated line channel and finally reaches the terminal receiving device.

[0141] In the complete transmission process of downlink data traffic, that is, step R1 to step R7, the downlink data is returned to the service execution virtual machine:

[0142] Step R1: The terminal receives the virtual device based on the previously received uplink traffic data, and starts transmission of the downlink data, and the data enters the dedicated channel.

[0143] Step R2: Data enters the gateway of the data center from the dedicated line channel.

[0144] Step R3: Data is transmitted from the gateway of the data center to the gateway of the private cloud, that is, the return data enters the private cloud at this time.

[0145] Step R4: The private cloud virtual gateway sends the data to the virtual switch of the firewall virtual subnet, and the data enters the firewall virtual subnet.

[0146] Step R5: The virtual switch of the firewall virtual subnet sends the data to the virtual firewall. After the data passes the security verification of the firewall, it will be sent out again.

[0147] Step R6: The virtual firewall sends the data to the virtual switch of the service execution virtual subnet, and the data is forwarded between subnets and enters the service execution virtual subnet.

[0148] Step R7: The virtual switch of the service execution virtual subnet sends the data to the service execution virtual machine, completing the transmission of the downlink data, that is, completing the final return of the data.

[0149] In the above process, in order to achieve the same source and same destination of data, in a further embodiment, the uplink and downlink data traffic may be encapsulated according to the pattern data structure in Table 1, and the data may be processed according to the encapsulation in the corresponding steps:

[0150] Table 1 Comparison table of data flow encapsulation structure and interaction steps

[0151]

[0152] According to the encapsulation structure in Table 1, the encapsulation structure is divided into the following parts: destination physical address (Destination MAC Address), source physical address (Source MAC Address), sender network address (Source IP Address), destination network address (Destination IP Address), virtual network identifier (VNI) (Virtual Network Identifier), virtual private cloud network identifier (VPC VNI) (Virtual Private Cloud VNI), virtual machine physical address (VM MAC) (Virtual Machine MAC Address) and other necessary identifiers and header information.

[0153] In this way, the data can be kept intact during the transmission process, and data transmission failure will not occur due to loss or misidentification. At the same time, the encapsulation structure contains detailed address information and identifiers, which can ensure that the data is accurately transmitted to the target device. In the process of data return, the same source and same destination requirements can be achieved by simply reversing the target physical address and the source physical address. In addition, through the clear data encapsulation and decapsulation process, the efficiency of data transmission can be improved, and delays and errors can be reduced. In addition, multi-layer encapsulation helps to perform effective security verification and filtering during the data transmission process to prevent unauthorized data access and transmission. Through such encapsulation structures and steps, the efficiency, security and reliability of data transmission can be improved while achieving the same source and same destination of data.

[0154] Through such encapsulation structure and steps, the efficiency, security and reliability of data transmission can be improved while achieving the same source and destination of data.

[0155] In summary, in the embodiment of the present application, by adding a dedicated uplink forwarding rule to the virtual business execution device, and adding a dedicated downlink forwarding rule to the virtual cloud platform gateway, during the data exchange process, the customer is unaware of the process of data traffic passing through the firewall. At the same time, by executing the uplink data traffic sending process on the virtual business execution device, and executing the downlink data traffic forwarding process on the virtual cloud platform gateway, the routing settings of the local device do not need to consider the conflict with the global routing, which simplifies the setting of the data forwarding rules. Therefore, based on the method of the embodiment of the present application, when configuring a virtual network with a firewall, there is no need to make complex designs and verifications in order to maintain an overall security routing table, which solves the problem that the configuration complexity and granularity cannot be taken into account when the traffic data of the virtual network passes through the firewall.

[0156] refer to Figure 6 , which shows a cloud platform 30 for data traffic passing through a virtual firewall provided by an embodiment of the present application, including:

[0157] Virtual service execution device 301, virtual cloud platform gateway 302 and virtual firewall 303;

[0158] The virtual service execution device 301 is used to determine the destination uplink virtual physical address of the uplink data traffic in response to the uplink data traffic to be sent, and send the uplink data traffic to the virtual firewall according to the uplink forwarding rule of the uplink data traffic, so as to forward the uplink data traffic according to the destination uplink virtual physical address when the security verification result of the virtual firewall on the uplink data traffic is characterized as passed verification, and obtain the downlink data traffic sent from the virtual firewall and corresponding to the uplink data traffic; the destination uplink virtual physical address is the virtual physical address of the terminal receiving virtual device of the uplink data traffic; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located;

[0159] The virtual cloud platform gateway 302 is used to determine the destination downlink virtual physical address of the downlink data traffic in response to the downlink data traffic to be forwarded, and forward the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic, so as to forward the downlink data traffic according to the destination downlink virtual physical address when the security verification result of the virtual firewall on the downlink data traffic is characterized as passed verification; the destination downlink virtual physical address is the virtual physical address of the virtual business execution device corresponding to the downlink data traffic; the downlink data traffic is generated according to the uplink data traffic sent by the virtual business execution device, and is the return data traffic of the uplink data traffic; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located;

[0160] The virtual firewall 303 is used to perform security verification on the uplink data traffic and / or the downlink data traffic in response to the uplink data traffic and / or the downlink data traffic to be forwarded, and when the security verification result of the uplink data traffic is characterized as verification passed, forward the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic, and when the security verification result of the downlink data traffic is characterized as verification passed, forward the downlink data traffic according to the destination downlink virtual physical address of the downlink data traffic.

[0161] Optionally, when the virtual business execution device 301 sends the uplink data traffic to the virtual firewall according to the uplink forwarding rule of the uplink data traffic, it is specifically used to determine the uplink forwarding rule of the uplink data traffic in the execution subnet routing of the business execution virtual subnet according to the destination uplink virtual physical address, and forward the uplink data traffic according to the uplink forwarding rule; the business execution virtual subnet is the virtual subnet of the cloud platform where the virtual business execution device is located.

[0162] Optionally, when the virtual cloud platform gateway 302 forwards the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic, it is specifically used to determine the downlink forwarding rule of the downlink data traffic in the gateway routing of the virtual cloud platform gateway according to the destination downlink virtual physical address, and forward the downlink data traffic according to the downlink forwarding rule.

[0163] Optionally, the virtual cloud platform gateway 302 is also used to add uplink forwarding rules for uplink data traffic in the execution subnet route of the business execution virtual subnet, and to add downlink forwarding rules for downlink data traffic in the gateway route of the virtual cloud platform gateway, as well as to send the execution subnet route to the business execution virtual subnet, and to send the gateway route to the firewall virtual subnet; the business execution virtual subnet is the virtual subnet of the cloud platform where the virtual business execution device is located; the firewall virtual subnet is the virtual subnet of the cloud platform where the virtual firewall is located.

[0164] Optionally, when the security verification result of the uplink data traffic is characterized as passed verification, the virtual firewall 303 forwards the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic. It is specifically used to determine the source virtual physical address of the uplink data traffic, encapsulate the source virtual physical address with the uplink data traffic, and forward the encapsulated uplink data traffic according to the uplink virtual physical address, so that when the terminal receiving virtual device of the uplink data traffic sends the downlink data traffic corresponding to the uplink data traffic, the source virtual physical address is used as the downlink virtual physical address of the downlink data traffic; the source virtual physical address is the virtual physical address of the virtual service execution device that sends the uplink data traffic.

[0165] In summary, in the embodiment of the present application, by adding a dedicated uplink forwarding rule to the virtual business execution device, and adding a dedicated downlink forwarding rule to the virtual cloud platform gateway, during the data exchange process, the customer is unaware of the process of data traffic passing through the firewall. At the same time, by executing the uplink data traffic sending process on the virtual business execution device, and executing the downlink data traffic forwarding process on the virtual cloud platform gateway, the routing settings of the local device do not need to consider the conflict with the global routing, which simplifies the setting of the data forwarding rules. Therefore, based on the method of the embodiment of the present application, when configuring a virtual network with a firewall, there is no need to make complex designs and verifications in order to maintain an overall security routing table, which solves the problem that the configuration complexity and granularity cannot be taken into account when the traffic data of the virtual network passes through the firewall.

[0166] Reference Figure 7, the electronic device 500 may include one or more of the following components: a processing component 502 , a memory 504 , a power component 506 , a multimedia component 508 , an audio component 510 , an input / output (I / O) interface 512 , a sensor component 514 , and a communication component 516 .

[0167] The processing component 502 generally controls the overall operation of the electronic device 500, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 502 may include one or more processors 520 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 502 may include one or more modules to facilitate the interaction between the processing component 502 and other components. For example, the processing component 502 may include a multimedia module to facilitate the interaction between the multimedia component 508 and the processing component 502.

[0168] The memory 504 is used to store various types of data to support the operation of the electronic device 500. Examples of such data include instructions for any application or method operating on the electronic device 500, contact data, phone book data, messages, pictures, multimedia, etc. The memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0169] The power supply component 506 provides power to the various components of the electronic device 500. The power supply component 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 500.

[0170] The multimedia component 508 includes an interface that provides an output interface between the electronic device 500 and the user. In some embodiments, the interface may include a liquid crystal display (LCD) and a touch panel (TP). If the interface includes a touch panel, the interface may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 508 includes a front camera and / or a rear camera. When the electronic device 500 is in an operating mode, such as a shooting mode or a multimedia mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0171] The audio component 510 is used to output and / or input audio signals. For example, the audio component 510 includes a microphone (MIC), and when the electronic device 500 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive an external audio signal. The received audio signal can be further stored in the memory 504 or sent via the communication component 516. In some embodiments, the audio component 510 also includes a speaker for outputting audio signals.

[0172] The input / output I / O interface 512 provides an interface between the processing component 502 and the peripheral interface module, which may be a keyboard, a click wheel, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0173] The sensor assembly 514 includes one or more sensors for providing various aspects of status assessment for the electronic device 500. For example, the sensor assembly 514 can detect the open / closed state of the electronic device 500, the relative positioning of components, such as the display and keypad of the electronic device 500, and the sensor assembly 514 can also detect the position change of the electronic device 500 or a component of the electronic device 500, the presence or absence of user contact with the electronic device 500, the orientation or acceleration / deceleration of the electronic device 500, and the temperature change of the electronic device 500. The sensor assembly 514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 514 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 514 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0174] The communication component 516 is used to facilitate wired or wireless communication between the electronic device 500 and other devices. The electronic device 500 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 516 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 516 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0175] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to implement the methods provided in the embodiments of the present application.

[0176] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, and the instructions can be executed by a processor 520 of an electronic device 500 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0177] Figure 8 FIG. 6 is a block diagram of an electronic device 600 according to another embodiment of the present invention. For example, the electronic device 600 may be provided as a server.

[0178] Reference Figure 8 , the electronic device 600 includes a processing component 622, which further includes one or more processors, and a memory resource represented by a memory 632, for storing instructions that can be executed by the processing component 622, such as an application. The application stored in the memory 632 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 622 is configured to execute instructions to perform the method provided in the embodiment of the present application.

[0179] The electronic device 600 may also include a power supply component 626 configured to perform power management of the electronic device 600, a wired or wireless network interface 650 configured to connect the electronic device 600 to a network, and an input / output (I / O) interface 658. The electronic device 600 may operate based on an operating system stored in the memory 632, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0180] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0181] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for transmitting data traffic through a virtual firewall in a cloud platform, characterized in that: Applied to virtual service execution equipment, including: In response to the uplink data traffic to be sent, determining a destination uplink virtual physical address of the uplink data traffic; the destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device of the uplink data traffic; According to the uplink forwarding rule of the uplink data traffic, the uplink data traffic is sent to the virtual firewall, so that when the security verification result of the uplink data traffic by the virtual firewall is characterized as verification passed, the uplink data traffic is forwarded according to the destination uplink virtual physical address; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; Acquire downlink data traffic corresponding to the uplink data traffic and sent from the virtual firewall; the downlink data traffic is a terminal receiving virtual device of the uplink data traffic, based on the return data traffic of the uplink data traffic.

2. The method according to claim 1, characterized in that The step of sending the uplink data traffic to the virtual firewall according to the uplink forwarding rule of the uplink data traffic comprises: Determining an uplink forwarding rule for the uplink data traffic in an execution subnet route of a service execution virtual subnet according to the destination uplink virtual physical address; the service execution virtual subnet is a virtual subnet of the cloud platform where the virtual service execution device is located; The uplink data traffic is forwarded according to the uplink forwarding rule.

3. A method for transmitting data traffic through a virtual firewall in a cloud platform, characterized in that: Applied to virtual cloud platform gateway, including: In response to the downlink data traffic to be forwarded, determining a destination downlink virtual physical address of the downlink data traffic; the destination downlink virtual physical address is a virtual physical address of a virtual service execution device corresponding to the downlink data traffic; the downlink data traffic is generated according to the uplink data traffic sent by the virtual service execution device, and is the return data traffic of the uplink data traffic; According to the downlink forwarding rule of the downlink data traffic, the downlink data traffic is forwarded to the virtual firewall, so that when the security verification result of the virtual firewall on the downlink data traffic is characterized as passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located.

4. The method according to claim 3, characterized in that The forwarding of the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic includes: Determining a downlink forwarding rule for the downlink data traffic in a gateway route of the virtual cloud platform gateway according to the destination downlink virtual physical address; The downlink data traffic is forwarded according to the downlink forwarding rule.

5. The method according to claim 3, characterized in that The method further comprises: In the execution subnet route of the service execution virtual subnet, an uplink forwarding rule of the uplink data traffic is added, and in the gateway route of the virtual cloud platform gateway, a downlink forwarding rule of the downlink data traffic is added; the service execution virtual subnet is a virtual subnet of the cloud platform where the virtual service execution device is located; The execution subnet route is sent down to the business execution virtual subnet, and the gateway route is sent down to the firewall virtual subnet; the firewall virtual subnet is the virtual subnet of the cloud platform where the virtual firewall is located.

6. A method for transmitting data traffic through a virtual firewall in a cloud platform, characterized in that: Applicable to virtual firewalls, including: In response to the uplink data traffic and / or downlink data traffic to be forwarded, security verification is performed on the uplink data traffic and / or the downlink data traffic; the uplink data traffic is the data traffic sent by the virtual business execution device according to the uplink forwarding rule of the uplink data traffic; the downlink data traffic is the return data traffic of the uplink data traffic generated according to the uplink data traffic and forwarded by the virtual cloud platform gateway according to the downlink forwarding rule of the downlink data traffic; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; When the security verification result of the uplink data traffic is characterized as passed, forwarding the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic; the destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device of the uplink data traffic; When the security verification result of the downlink data traffic is characterized as verification passed, the downlink data traffic is forwarded according to the destination downlink virtual physical address of the downlink data traffic; the destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic.

7. The method according to claim 6, characterized in that When the security verification result of the uplink data traffic is characterized as passed, forwarding the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic includes: When the security verification result of the uplink data traffic is characterized as passed, determining a source virtual physical address of the uplink data traffic; the source virtual physical address is a virtual physical address of a virtual service execution device that sends the uplink data traffic; The source virtual physical address is encapsulated with the uplink data traffic, and the encapsulated uplink data traffic is forwarded according to the uplink virtual physical address, so that when the terminal receiving virtual device of the uplink data traffic sends the downlink data traffic corresponding to the uplink data traffic, the source virtual physical address is used as the downlink virtual physical address of the downlink data traffic.

8. A cloud platform with data traffic passing through a virtual firewall, characterized in that: include: Virtual business execution device, virtual cloud platform gateway and virtual firewall; The virtual service execution device is used to determine the destination uplink virtual physical address of the uplink data traffic in response to the uplink data traffic to be sent, and send the uplink data traffic to the virtual firewall according to the uplink forwarding rule of the uplink data traffic, so as to forward the uplink data traffic according to the destination uplink virtual physical address when the security verification result of the uplink data traffic by the virtual firewall is characterized as verification passed, and obtain the downlink data traffic sent from the virtual firewall and corresponding to the uplink data traffic; The destination uplink virtual physical address is a virtual physical address of a terminal receiving virtual device of the uplink data traffic; the uplink forwarding rule is used to forward the uplink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; The virtual cloud platform gateway is used to determine the destination downlink virtual physical address of the downlink data traffic in response to the downlink data traffic to be forwarded, and forward the downlink data traffic to the virtual firewall according to the downlink forwarding rule of the downlink data traffic, so as to forward the downlink data traffic according to the destination downlink virtual physical address when the security verification result of the downlink data traffic by the virtual firewall is characterized as verification passed; the destination downlink virtual physical address is the virtual physical address of the virtual service execution device corresponding to the downlink data traffic; The downlink data traffic is generated according to the uplink data traffic sent by the virtual service execution device, and is the return data traffic of the uplink data traffic; the downlink forwarding rule is used to forward the downlink data traffic to the virtual subnet of the cloud platform where the virtual firewall is located; The virtual firewall is used to perform security verification on the uplink data traffic and / or the downlink data traffic in response to the uplink data traffic and / or the downlink data traffic to be forwarded, and when the security verification result of the uplink data traffic is characterized by verification passing, forward the uplink data traffic according to the destination uplink virtual physical address of the uplink data traffic, and when the security verification result of the downlink data traffic is characterized by verification passing, forward the downlink data traffic according to the destination downlink virtual physical address of the downlink data traffic.

9. An electronic device, characterized in that: include: A processor, a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 7.

Images