Data access method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a data access method and device, electronic equipment and a storage medium. The method comprises the following steps: initiating a first data access request message to a storage node of a cloud resource pool through a cloud host; the method comprises the following steps: receiving a first data access request message through a virtual switch, converting a first IP address of a cloud host in the first data access request message into a second IP address according to a data flow table, and converting the second IP address of the cloud host into a computing intranet IP address of a computing node to obtain a second data access request message; the second data access request message is sent to a computing intranet gateway; sending the second data access request message to a storage node of a cloud resource pool indicated by the first target address through a computing intranet gateway; sending a response message for the second data access request message to a store-and-forward network gateway through a storage node of the cloud resource pool; and sending the response message to the cloud host through the store-and-forward network gateway.

Description

Technical Field

[0001] The present application belongs to the field of Internet technology, and in particular, relates to a data access method, device, electronic device and storage medium. Background Art

[0002] In a cloud computing environment, the forwarding model for cloud host intranet access to storage usually involves multiple intermediate network element devices, which increases network costs and latency. The traditional cloud host access storage implementation solution relies on storage network element devices (Internet Gateway, IGW), and the cloud host access storage traffic needs to be forwarded through the IGW network element device. Although this architecture can realize basic storage access functions, it has the following significant problems:

[0003] Since storage traffic needs to pass through multiple intermediate network elements, including IGW network elements, the network path becomes longer, increasing the data transmission delay. The forwarding process of multi-layer network elements introduces additional processing overhead. As a centralized forwarding point for storage traffic, IGW network elements can easily become a network bottleneck. The deployment and maintenance of multi-layer network elements require additional hardware and software resources, increasing network costs.

[0004] Therefore, how to achieve more efficient and reliable data access is an urgent problem that needs to be solved. Summary of the invention

[0005] The embodiments of the present application provide a data access method, apparatus, device and storage medium, which can solve the problem of achieving efficient and reliable data access.

[0006] In a first aspect, an embodiment of the present application provides a data access method, the method comprising:

[0007] Initiate a first data access request message to a storage node in a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address;

[0008] A first data access request message is received through a virtual switch, and a first IP address of a cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of a computing node through connection tracking and network address translation NAT to obtain a second data access request message, and the second data access request message is sent to a computing intranet gateway; the data flow table is generated according to a preset access control rule table;

[0009] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected;

[0010] Sending a response message to the second data access request message to the storage and forwarding network gateway through the storage node of the cloud resource pool;

[0011] The response message is sent to the cloud host through the store-and-forward network gateway.

[0012] In a second aspect, an embodiment of the present application provides a data access device, the data access device comprising:

[0013] A first sending module, configured to initiate a first data access request message to a storage node in a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address;

[0014] The conversion module is used to receive the first data access request message through the virtual switch, and convert the first IP address of the cloud host in the first data access request message into the second IP address according to the data flow table, and then convert the second IP address of the cloud host into the computing intranet IP address of the computing node through connection tracking and network address translation NAT to obtain the second data access request message, and send the second data access request message to the computing intranet gateway; the data flow table is generated according to the preset access control rule table;

[0015] A second sending module is used to send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected;

[0016] A third sending module, configured to send a response message to the second data access request message to a storage and forwarding network gateway through a storage node of the cloud resource pool;

[0017] The fourth sending module is used to send the response message to the cloud host through the storage and forwarding network gateway.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the method in the first aspect or any possible implementation of the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the method in the first aspect or any possible implementation of the first aspect is implemented.

[0020] In an embodiment of the present application, a first data access request message is initiated to a storage node of a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address; the first data access request message is received through a virtual switch, and the first IP address of the cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of a computing node through connection tracking and network address translation NAT to obtain a second data access request message, and the second data access request message is sent to a computing intranet gateway; the data flow table is generated according to a pre-set access control rule table; IP address conversion and NAT are performed through a virtual switch, thereby improving IO performance and avoiding the IGW network element from becoming a link bottleneck.

[0021] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected; data is directly forwarded through the virtual switch and the computing intranet gateway, which reduces the number of intermediate network element devices and reduces network latency and costs.

[0022] The data access request message is directly sent to the storage node through the computing intranet gateway, further reducing the network latency. The response message for the second data access request message is sent to the storage forwarding network gateway through the storage node of the cloud resource pool; the response message is directly sent to the cloud host through the storage forwarding network gateway, further reducing the network latency and improving the IO performance. The response message is sent to the cloud host through the storage forwarding network gateway. In this way, more efficient and reliable storage access can be achieved, meeting the requirements for high performance and high availability in the cloud computing environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 is a flow chart of a data access method provided by an embodiment of the present application;

[0025] Figure 2is a schematic diagram of a data access architecture provided in an embodiment of the present application;

[0026] Figure 3 It is a structural diagram of a data access device provided in an embodiment of the present application;

[0027] Figure 4 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0029] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0030] The following is a brief introduction to the technical terms involved in this application.

[0031] Open vSwitch (OVS) is an open source virtual switch software specifically designed to manage multi-tenant public cloud computing environments. It provides network administrators with traffic visibility and control between and within virtual machines (VMs). OVS can create and manage virtual switches in a virtualized environment to enable network communication between virtual machines. It supports multiple virtualization platforms, such as KVM, Xen, VMware, etc.

[0032] OVS supports multi-tenant environments and can create independent virtual networks for different tenants to ensure network isolation between tenants. It provides a variety of network functions, such as VLAN, tunnels (such as VXLAN, GRE), etc., and supports complex network topologies. OVS provides detailed traffic monitoring and control functions, and network administrators can view and control the traffic between virtual machines through OVS.

[0033] OVS supports the OpenFlow protocol and can remotely manage and configure virtual switches through the OpenFlow controller.

[0034] OpenFlow is a network communication protocol that belongs to the data link layer and can control the forwarding plane of a network switch or router to change the network path taken by network packets. OpenFlow controls the packet forwarding behavior of network devices through the flow table mechanism. Each entry in the flow table defines the matching conditions and corresponding actions, such as forwarding, discarding, modifying, etc.

[0035] The OpenFlow controller can remotely manage and configure network devices that support OpenFlow to achieve centralized network management. The controller can dynamically adjust the flow table to achieve flexible network policies and automated management. OpenFlow supports network virtualization and can create multiple logical networks on a physical network to achieve flexible allocation of network resources.

[0036] Connection Tracking (CONNTRACK, CT) Connection tracking is a module in the Linux kernel that is used to track and record connection status. It generates a new connection record entry for each data packet passing through the network stack.

[0037] IGW network element is a key component in cloud computing and network architecture, mainly used to connect private networks with the public Internet. IGW network element plays a bridge role in the cloud environment, enabling cloud resources to communicate with external networks.

[0038] The data access method provided in the embodiment of the present application can be applied to at least the following application scenarios, which are described below.

[0039] In a cloud computing environment, a cloud resource pool usually includes multiple components, such as computing resources, storage resources, and network resources. In order to achieve efficient resource management and flexible resource allocation, cloud platforms usually design complex network architectures. Among them, cloud hosts need to access storage resources through the intranet to achieve efficient reading, writing, and sharing of data.

[0040] In order to achieve high availability, load balancing and security, cloud platforms usually introduce multiple layers of network devices into the network architecture, such as routers, switches, load balancers, etc. These devices play a key role in the data transmission process, but also increase the complexity and cost of the network.

[0041] When a cloud host accesses storage resources, data usually needs to pass through multiple intermediate forwarding nodes. These nodes may be physical devices or virtual devices, and they play a role in routing and forwarding during data transmission.

[0042] The introduction of multi-layer network equipment requires the purchase and maintenance of a large number of hardware devices, such as routers, switches, load balancers, etc. The procurement, deployment and maintenance costs of these devices are high. As the amount of data increases, the demand for network bandwidth also increases. In order to ensure the efficiency and stability of data transmission, more bandwidth resources need to be purchased, which also increases network costs. Complex network architecture requires a professional network management team to maintain and manage, which also increases labor costs.

[0043] Since data needs to pass through multiple intermediate forwarding nodes, the transmission path becomes longer, resulting in increased data transmission delay. This is a disadvantage for application scenarios that require low latency. The bandwidth limitation of the intermediate forwarding nodes will become a performance bottleneck, especially in the case of high concurrent access, which may cause the data transmission speed to decrease.

[0044] Specifically, because storage traffic needs to pass through multiple intermediate network element devices, including IGW network element devices, the network path becomes longer, increasing the latency of data transmission. This is a serious performance bottleneck for application scenarios that require low latency and high throughput.

[0045] The forwarding process of multi-layer network element devices will introduce additional processing overhead, resulting in a decrease in IO performance. This performance degradation will be more obvious in high-concurrency access scenarios, affecting the response speed and throughput of the overall system.

[0046] As a centralized forwarding point for storage traffic, IGW network element devices can easily become a network bottleneck. Under high load conditions, the processing capacity of IGW network elements cannot meet a large number of concurrent requests, resulting in network congestion and performance degradation.

[0047] The deployment and maintenance of multi-layer network element devices requires additional hardware and software resources, increasing network costs. In addition, in order to ensure the reliability and performance of the network, more management and operation resources are required.

[0048] Currently, the implementation solution for cloud hosts to access storage needs to rely on storage IGW network element devices. The cloud host access storage traffic passes through the IGW network element devices, which increases network latency and reduces IO performance. At the same time, the IGW network element will become a link bottleneck.

[0049] Figure 1 It is a flow chart of a data access method provided in an embodiment of the present application.

[0050] like Figure 1 As shown, the data access method may include steps 110 to 150, and the method is applied to a data access device, as shown below:

[0051] Step 110, initiating a first data access request message to a storage node of a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address;

[0052] A cloud host refers to a virtual machine or physical server running in a cloud computing environment, providing computing resources and services.

[0053] First IP address: The initial IP address of the cloud host, usually the IP address of the cloud host in the virtual network.

[0054] First target address: The IP address of the target storage node when the cloud host initiates a data access request.

[0055] A virtual switch is a software switch that runs in a virtualized environment and is used to forward packets between virtual machines or between a virtual machine and the external network.

[0056] By directly initiating data access requests to storage nodes, the forwarding links of intermediate network element devices are reduced, the data transmission path is shortened, and network latency is reduced.

[0057] Step 120, receiving a first data access request message through a virtual switch, and converting a first IP address of a cloud host in the first data access request message into a second IP address according to a data flow table, and then converting the second IP address of the cloud host into a computing intranet IP address of a computing node through connection tracking and network address translation NAT, obtaining a second data access request message, and sending the second data access request message to a computing intranet gateway; the data flow table is generated according to a preset access control rule table;

[0058] A data flow table is a table used to define packet forwarding rules in Open vSwitch or other network devices. Each flow table entry contains a matching condition and a corresponding action.

[0059] Secondary IP address: After the data packet passes through the virtual switch, the IP address of the cloud host is converted to the secondary IP address.

[0060] Connection Tracking (CT): Connection tracking is a network function used to track the status of network connections, usually used in firewalls and NAT (Network Address Translation).

[0061] Network Address Translation (NAT): used to convert private IP addresses to public IP addresses, or convert IP addresses between different networks.

[0062] Compute intranet IP address: The internal network IP address of the compute node, usually used for internal communication.

[0063] Second data access request message: the data access request message after IP address conversion.

[0064] Using virtual switches to perform IP address translation and NAT reduces the forwarding overhead of multi-layer network element devices and improves IO performance. The efficient processing capabilities of virtual switches can better cope with high-concurrency access scenarios. Using virtual switches to perform IP address translation and NAT avoids dependence on IGW network element devices and eliminates the risk of IGW network elements becoming link bottlenecks.

[0065] Step 130, sending the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage-forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage-forwarding network on the core switch are connected;

[0066] Computing intranet gateway: The computing intranet gateway is used to forward data packets to the external network or receive data packets from the external network.

[0067] By directly sending data access request messages to storage nodes through the computing intranet gateway, the intermediate forwarding links are reduced, further reducing network latency. By optimizing the network architecture, the number of intermediate network element devices is reduced, reducing the cost of network deployment and maintenance.

[0068] Step 140: sending a response message to the second data access request message to the storage and forwarding network gateway through the storage node of the cloud resource pool;

[0069] The storage node directly sends the response message to the storage and forwarding network gateway, reducing the intermediate forwarding links and improving IO performance.

[0070] Step 150, sending the response message to the cloud host through the store-and-forward network gateway.

[0071] Store-and-forward network gateway: The gateway of a store-and-forward network is used to forward data packets to storage nodes or receive data packets from storage nodes.

[0072] The response message is sent directly to the cloud host through the storage and forwarding network gateway, which reduces the intermediate forwarding links and further reduces the network latency. The response message is forwarded through the storage and forwarding network gateway, avoiding the reliance on IGW network element equipment and eliminating the risk of IGW network element becoming a link bottleneck.

[0073] Direct data forwarding through virtual switches and computing intranet gateways reduces the number of intermediate network element devices, reduces network latency and costs. IP address conversion and NAT through virtual switches improve IO performance and prevent IGW network elements from becoming link bottlenecks. Data access request messages are sent directly to storage nodes through computing intranet gateways, further reducing network latency. Response messages are sent directly to cloud hosts through storage and forwarding network gateways, further reducing network latency and improving IO performance. This enables more efficient and reliable storage access, meeting the requirements for high performance and high availability in cloud computing environments.

[0074] In a possible embodiment, before step 130, the method further includes:

[0075] Configure the computing intranet gateway and storage-and-forwarding network gateway on the core switch;

[0076] Configure the routes from the computing intranet to the storage-and-forwarding network and from the storage-and-forwarding network to the computing intranet so that the computing intranet and the storage-and-forwarding network can communicate with each other.

[0077] The core switch is a key device in the network, responsible for forwarding data packets between different networks. The gateway is configured to enable the core switch to identify and manage data flows between different networks.

[0078] Computing intranet gateway: The computing intranet gateway is the egress of the computing intranet and is responsible for forwarding the traffic of the computing intranet to other network areas.

[0079] Store-and-forward network gateway: The store-and-forward network gateway is the egress of the store-and-forward network and is responsible for forwarding the traffic of the store-and-forward network to other network areas.

[0080] By configuring routing, the computing intranet and the storage and forwarding network are connected at Layer 3 (i.e., the network layer), allowing the two network areas to communicate with each other. By configuring gateways and routing on the core switch, the computing intranet and the storage and forwarding network can be interconnected, ensuring that the cloud host can access storage resources.

[0081] Assume that the IP address segment of the computing intranet is 192.168.1.0 / 24 and the gateway address is 192.168.1.1. On the core switch, configure a virtual LAN interface for the computing intranet and set its IP address to 192.168.1.1.

[0082] Assume that the IP address segment of the storage and forwarding network is 192.168.2.0 / 24 and the gateway address is 192.168.2.1. On the core switch, configure another virtual LAN interface for the storage and forwarding network and set its IP address to 192.168.2.1.

[0083] The purpose of configuring routing is to let the core switch know how to forward data packets from one network to another. On the core switch, add a static route, specifying the target network as 192.168.2.0 / 24 and the next hop as the gateway 192.168.2.1 of the storage and forwarding network.

[0084] On the core switch, add another static route, specifying the target network as 192.168.1.0 / 24 and the next hop as the computing intranet gateway 192.168.1.1.

[0085] To ensure that the routing and gateway configurations are correct and the network can communicate normally, you can check the routing table on the core switch to confirm whether the static routes are added correctly.

[0086] By configuring the computing intranet gateway and the storage-and-forwarding network gateway on the core switch and configuring routing so that the computing intranet and the storage-and-forwarding network can communicate with each other, it can be ensured that data packets can be correctly forwarded between different networks.

[0087] In a possible embodiment, before step 130, the method further includes:

[0088] Add the route of the network segment of the storage and forwarding network on the computing node of the cloud resource pool so that the computing node can route the traffic accessing the storage and forwarding network to the computing intranet gateway, and the computing intranet gateway can forward the traffic to the storage and forwarding network.

[0089] Add the route of the computing intranet segment on the storage node of the cloud resource pool so that the storage node can route the traffic accessing the computing intranet to the storage and forwarding network gateway, and the storage and forwarding network gateway can forward the traffic to the computing intranet.

[0090] On the computing node in the cloud resource pool, add the route of the storage and forwarding network segment: ip route add <storage and forwarding network CIDR> via <computing intranet gateway>.

[0091] Compute node: A compute node is a physical or virtual server in a cloud resource pool that runs a cloud host instance.

[0092] Store-and-forward network CIDR: The IP address range of a store-and-forward network, usually expressed in CIDR (such as 192.168.2.0 / 24).

[0093] Compute intranet gateway: The IP address of the computing intranet gateway, used to forward traffic to the storage and forwarding network.

[0094] Add routes for the storage-and-forward network segment on the compute nodes so that the compute nodes can correctly route traffic accessing the storage-and-forward network to the computing intranet gateway and then forward it to the storage-and-forward network.

[0095] The computing nodes need to know how to route traffic to the storage-and-forward network to the computing intranet gateway, which then forwards the traffic to the storage-and-forward network. Assume that the IP address segment of the storage-and-forward network is 192.168.2.0 / 24, and the IP address of the computing intranet gateway is 192.168.1.1.

[0096] On the computing node, add a static route, specify the target network as 192.168.2.0 / 24, and the next hop as the computing intranet gateway 192.168.1.1.

[0097] On the cloud resource pool storage node, add the route of the computing intranet segment ip route add <computing intranet CIDR> via <storage and forwarding network gateway>.

[0098] A storage node is a physical or virtual server in a cloud resource pool that provides storage services.

[0099] Calculate the intranet CIDR: Calculate the IP address range of the intranet, usually expressed in CIDR (such as 192.168.1.0 / 24).

[0100] Store-and-forward network gateway: The IP address of the store-and-forward network gateway, used to forward traffic to the computing intranet.

[0101] Add the route of the computing intranet segment on the storage node so that the storage node can correctly route the traffic accessing the computing intranet to the storage forwarding network gateway and then forward it to the computing intranet.

[0102] The storage node needs to know how to route the traffic accessing the computing intranet to the storage-forwarding network gateway, which then forwards the traffic to the computing intranet. Assume that the IP address segment of the computing intranet is 192.168.1.0 / 24, and the IP address of the storage-forwarding network gateway is 192.168.2.1.

[0103] On the storage node, add a static route, specify the target network as 192.168.1.0 / 24, and the next hop as the storage and forwarding network gateway 192.168.2.1.

[0104] By adding corresponding routing configurations to the computing nodes and storage nodes in the cloud resource pool, it can be ensured that the computing nodes and storage nodes can correctly route traffic to each other's networks and ensure that data access requests and responses can be transmitted smoothly.

[0105] In a possible embodiment, step 150 includes:

[0106] The response message is forwarded to the computing node through the store-and-forward network gateway;

[0107] The response message is forwarded to the cloud host through the computing node.

[0108] The storage and forwarding network gateway is responsible for forwarding the response messages from the storage nodes to the computing nodes. The computing nodes need to know how to process these response messages and forward them to the cloud host.

[0109] The store-and-forward network gateway forwards the response message:

[0110] Assume that the IP address of the storage and forwarding network gateway is 192.168.2.1 and the IP address of the computing node is 192.168.2.10. After receiving the response message from the storage node, the storage and forwarding network gateway forwards the response message to the computing node according to the routing configuration.

[0111] After receiving the response message from the storage and forwarding network gateway, the computing node needs to forward it to the cloud host. The computing node needs to know the IP address of the cloud host and forward the response message to the cloud host according to the routing configuration.

[0112] The computing node forwards the response message:

[0113] Assume that the IP address of the cloud host is 192.168.1.10 and the IP address of the computing node is 192.168.2.10. After receiving the response message, the computing node forwards the response message to the cloud host according to the routing configuration.

[0114] The response message is forwarded to the computing node through the storage and forwarding network gateway, and then forwarded to the cloud host through the computing node, which ensures that the response message can be correctly transmitted from the storage node to the cloud host. Through these configurations, the response message can be smoothly transmitted from the storage node to the cloud host, completing the entire data access process.

[0115] The step of forwarding the response message to the cloud host through the computing node may specifically include the following steps:

[0116] By computing the node, the second destination address in the response message is replaced with the IP address of the NAT port, where the IP address of the NAT port is an IP address converted by a preset conversion algorithm according to the port number of the virtual machine network card;

[0117] According to the data flow table, replace the IP address of the NAT port with the IP address of the cloud host;

[0118] According to the data flow table, the MAC address of the storage node is replaced with the MAC address of the cloud host;

[0119] Based on the cloud host's IP address and cloud host's MAC address, the response message is forwarded to the cloud host.

[0120] After receiving the response message, the computing node replaces the second destination address in the response message with the IP address of the NAT port according to a preset conversion algorithm.

[0121] The data flow table is a table in Open vSwitch or other network devices that defines packet forwarding rules. According to the rules in the data flow table, the compute node replaces the IP address of the NAT port with the IP address of the cloud host.

[0122] The computing node replaces the IP address of the NAT port in the response message with the IP address of the cloud host according to the rules in the data flow table. To ensure that the response message can be correctly forwarded to the cloud host, the computing node also needs to replace the MAC address of the storage node in the response message with the MAC address of the cloud host. The computing node replaces the MAC address of the storage node in the response message with the MAC address of the cloud host according to the rules in the data flow table.

[0123] After the above steps, the target IP address and target MAC address in the response message have been replaced with the IP address and MAC address of the cloud host. Based on this information, the computing node forwards the response message to the cloud host. The response message can be smoothly transmitted from the storage node to the cloud host, completing the entire data access process.

[0124] In a possible embodiment, a cloud host access storage module is created in a cloud resource pool console, and the cloud host access storage module is used to control the cloud host to access storage resources through a specified storage service port; an access control rule table is stored in a database of the cloud host access storage module;

[0125] The access control rule table includes the following fields:

[0126] The name of the access control rule;

[0127] The Classless Inter-Domain Routing CIDR of the target network, which is used to indicate the target network range that is allowed to be accessed;

[0128] Destination port, used to indicate the destination port number that is allowed to be accessed;

[0129] IP version, used to indicate the IP version to which the access control rule applies;

[0130] Protocol type, which indicates the protocol to which the access control rule applies.

[0131] Cloud resource pool console: The management console of the cloud resource pool, used to configure and manage various resources in the cloud resource pool.

[0132] By writing a custom cloud host access storage module, we control the traffic of cloud hosts accessing storage resources, ensure that only designated storage service ports can be accessed by cloud hosts, and improve security. The purpose is to achieve intranet access and traffic forwarding between cloud hosts and storage resources in the cloud resource pool. By configuring gateways and routes on the core switch, and adding corresponding routes on the computing nodes and storage nodes, we ensure that the two network areas can communicate with each other. Finally, by writing a custom module, we control the traffic of cloud hosts accessing storage resources, ensuring the security and smoothness of data transmission.

[0133] The cloud host access storage module is a control module used to manage and control the cloud host's access to storage resources. Through this module, administrators can define access control rules to ensure that the cloud host can only access storage resources through the specified storage service port.

[0134] The access control rule table is used to store access control rules. Each rule defines the conditions and restrictions for a cloud host to access storage resources.

[0135] Field description of the access control rule table:

[0136] Access control rule name: used to identify the name of the access control rule, which is convenient for administrators to identify and manage.

[0137] Classless Inter-Domain Routing CIDR of the destination network: Used to indicate the range of destination networks that are allowed to be accessed. CIDR notation (such as 192.168.1.0 / 24) is used to define the IP address range.

[0138] Destination Port: Used to indicate the destination port number that is allowed to access. For example, port number 80 indicates HTTP access.

[0139] IP Version: Used to indicate the IP version to which the access control rule applies, such as IPv4 or IPv6.

[0140] Protocol Type: Used to indicate the protocol to which the access control rule applies, such as TCP, UDP, or ICMP.

[0141] The cloud host access storage module controls the cloud host's access to storage resources according to the rules in the access control rule table. Only access requests that meet the rules will be allowed. The cloud host access storage module loads the access control rule table from the database. When the cloud host initiates an access request, the cloud host access storage module checks the target network, target port, IP version, and protocol type of the request according to the rules in the access control rule table. If the request meets a certain rule, access is allowed; otherwise, access is denied.

[0142] The access control rule table may be an access table, which is a database table used to store access control rules. It includes the following fields:

[0143] Create a database table to store access control rules to facilitate subsequent add, delete, modify and query operations.

[0144] On the one hand, write and create an eaccess interface, and insert information into the database according to the parameters passed in by the interface. Create an eaccess interface: Write an API interface for creating new access control rules. Insert the received parameters into the eaccess table. Provide an interface that allows users to create new access control rules through the API and store the rule information in the database.

[0145] On the other hand, write a delete eaccess interface to delete the data from the database based on the parameters passed in the interface. Delete eaccess interface: Write an API interface to delete existing access control rules. The interface needs to receive one or more parameters (such as name or dst_cidr) to query the rules to be deleted. According to the passed parameters, query the matching rules from the eaccess table. Delete data: Delete the queried rules from the database. It can provide an interface that allows users to delete existing access control rules through the API to ensure the flexibility of rule management.

[0146] On the other hand, write an eaccess query interface to obtain all current eaccess rules. Query eaccess interface: Write an API interface to query all current access control rules. Query all records from the eaccess table and return them to the user. Provide an interface that allows users to query all current access control rules through the API for easy management and monitoring.

[0147] The purpose is to manage and operate access control rules in the database, and to implement the addition, deletion, modification and query operations on the eaccess table through the creation, deletion and query interfaces. Through these interfaces, users can flexibly manage access control rules to ensure the security and controllability of network access.

[0148] By creating a cloud host access storage module in the cloud resource pool console and defining an access control rule table, you can effectively control the cloud host's access to storage resources. This ensures that the cloud host can only access storage resources through the specified storage service port, improving the security and management efficiency of storage resources.

[0149] Specifically, you can create eaccess rules in the cloud resource pool console. The rules are as follows:

[0150] In the cloud resource pool console, take creating an eaccess rule named NFS-2049 as an example:

[0151] Log in to the cloud resource pool console using an administrator account or an account with corresponding permissions. Find and click the "Access Control" or "Security Group" related options in the console to enter the eaccess rule management page. Click the "Create Rule" button: In the eaccess rule management page, click the "Create Rule" button. Enter a name for the rule, such as NFS-2049. Enter the CIDR of the target network, such as 55.243.4.20 / 32. Enter the target port number, such as 2049. Select the IP version, such as IPv4. Select the protocol type, such as TCP. Click the "OK" or "Create" button: After completing the rule information, click the "OK" or "Create" button to complete the creation of the eaccess rule.

[0152] Example of eaccess rules:

[0153] Name: NFS-2049;

[0154] Destination CIDR: 55.243.4.20 / 32

[0155] Destination port: 2049

[0156] IP version: IPv4;

[0157] Protocol: TCP;

[0158] In the cloud resource pool console, it is used to define access control policies. Through the above steps, users can create an eaccess rule named NFS-2049 to allow TCP traffic access from a specific IP address and port.

[0159] In a possible embodiment, a flow table generation and delivery module is created in a computing node, the flow table generation and delivery module is used to generate a flow table according to an access control rule table stored in a database, and deliver the generated flow table to Open vSwitch through an OpenFlow protocol;

[0160] The flow table contains the following fields:

[0161] The port number of the virtual machine network card on the virtual switch;

[0162] MAC address of the storage node;

[0163] The IP address of the NAT port;

[0164] The computing intranet IP address of the computing node;

[0165] The IP address of the cloud host;

[0166] The MAC address of the cloud host.

[0167] The flow table generation and delivery module is a software module that generates a flow table based on the access control rule table and delivers the flow table to Open vSwitch through the OpenFlow protocol. Open vSwitch is an open source virtual switch that supports the OpenFlow protocol.

[0168] The flow table is used to define the forwarding rules for data packets. Each flow table entry contains multiple fields, which are used to match data packets and perform corresponding actions.

[0169] Field description of the flow table:

[0170] Port number of the virtual machine network card on the virtual switch: used to identify the port number of the virtual machine network card on the virtual switch, usually an integer.

[0171] MAC address of the storage node: used to identify the MAC address of the storage node, usually a 48-bit binary number.

[0172] NAT port IP address: The IP address used to identify the NAT port, usually a 32-bit binary number (IPv4) or a 128-bit binary number (IPv6).

[0173] Compute node intranet IP address: used to identify the compute node intranet IP address, usually a 32-bit binary number (IPv4) or a 128-bit binary number (IPv6).

[0174] Cloud host IP address: The IP address used to identify the cloud host, usually a 32-bit binary number (IPv4) or a 128-bit binary number (IPv6).

[0175] MAC address of the cloud host: used to identify the MAC address of the cloud host, usually a 48-bit binary number.

[0176] The flow table generation and delivery module reads the access control rule table from the database. According to the rules in the access control rule table, the corresponding flow table entries are generated. Each flow table entry contains the port number of the virtual machine network card on the virtual switch, the MAC address of the storage node, the IP address of the NAT port, the computing intranet IP address of the computing node, the IP address of the cloud host, and the MAC address of the cloud host.

[0177] The generated flow table is sent to Open vSwitch through the OpenFlow protocol. Open vSwitch matches the data packets and performs corresponding actions according to the rules in the flow table.

[0178] Specifically, collect information from the eaccess table in the database;

[0179] eaccess table: A database table that stores access control rules. Get all rule information from the eaccess table, including dst_cidr, dst_port, ip_version, protocol, etc.

[0180] Obtain all current access control rules to provide a data basis for subsequent flow table generation. Then send the flow table to Open vSwitch through the OpenFlow protocol.

[0181] Forwarding flow table: Generates the corresponding forwarding flow table based on the collected eaccess table information.

[0182] OpenFlow protocol: The generated flow table is sent to Open vSwitch through the OpenFlow protocol.

[0183] According to the access control rule table, a flow table is generated and issued to control and forward network traffic.

[0184] The relationship between the access control rule table and the flow table is mainly reflected in rule conversion, dynamic update, and data packet processing. The access control rule table defines the access control policy, and the flow table generates corresponding entries based on the rules in the access control rule table to control the forwarding behavior of data packets. Through this relationship, flexible access control and efficient network management can be achieved.

[0185] Exemplarily, the format of the core flow table may be as follows:

[0186] (a)"table=30,priority=10,tcp,nw_dst=<dst_cidr> ,tp_dst=<dst_port>

[0187] actions=goto_table:36".

[0188] table=30: The flow table number is 30.

[0189] priority=10: The priority of the flow table is 10.

[0190] tcp: matches TCP protocol. (protocol: indicates the protocol type)

[0191] nw_dst=<dst_cidr> : Match the CIDR of the target network (such as 192.168.1.0 / 24).

[0192] tp_dst=<dst_port> : Match the target port (such as 8080).

[0193] actions=goto_table:36: After a successful match, jump to the flow table with table number 36.

[0194] Matches traffic with TCP protocol, destination network CIDR, and destination port, and forwards it to flow table 36.

[0195] (b)"table=36,priority=10,ip,in_port="vm_ofport"

[0196] actions=set_field:<storage_mac> ->eth_dst,set_field:<nat_port_ip> -

[0197] >ip_src,goto_table:38"

[0198] table=36: The table number of the flow table is 36.

[0199] priority=10: The priority of the flow table is 10.

[0200] ip: matches the IP protocol.

[0201] in_port = "vm_ofport": matches the input port as the port number of the VM NIC on OVS.

[0202] actions=set_field:<storage_mac> ->eth_dst,set_field:<nat_port_ip> -

[0203] >ip_src,goto_table:38:

[0204] set_field:<storage_mac> ->eth_dst: Set the destination MAC address to the storage MAC.

[0205] set_field:<nat_port_ip> ->ip_src: Set the source IP address to the NAT port IP.

[0206] goto_table:38: After a successful match, jump to the flow table with table number 38.

[0207] By matching the IP protocol and the traffic whose input port is the virtual machine network card, the destination MAC address and source IP address are modified, and then forwarded to the flow table with table number 38.

[0208] (c)"table=38,priority=10,ct_state=+new-est-rel-inv+trk,ip actions=ct(commit,table=73,nat(src=<host_compute_ip> ,random))"

[0209] table=38: The table number of the flow table is 38.

[0210] priority=10: The priority of the flow table is 10.

[0211] ct_state=+new-est-rel-inv+trk: matches traffic with connection tracking states of new, established, related, invalid, and tracking.

[0212] ip: matches the IP protocol.

[0213] actions=ct(commit,table=73,nat(src=<host_compute_ip> ,random)):

[0214] ct(commit,table=73,nat(src=<host_compute_ip> , random)): Submit connection tracking information and perform source NAT translation, convert the source IP address to the computing intranet IP of the computing node, and then jump to the flow table with table number 73.

[0215] By matching the IP traffic whose connection tracking status is new, established, related, invalid, and tracked, and performing source NAT translation, it is forwarded to the flow table with table number 73.

[0216] (d)"table=37,priority=200,ip,nw_dst=<nat_port_ip>

[0217] actions=set_field:<vm_mac> ->eth_dst,set_field:<vm_ip> -

[0218] >ip_dst,goto_table:83"

[0219] table=37: The table number of the flow table is 37.

[0220] priority=200: The priority of the flow table is 200.

[0221] ip: matches the IP protocol.

[0222] nw_dst=<nat_port_ip> : Match the target IP address as the NAT port IP.

[0223] actions=set_field:<vm_mac> ->eth_dst,set_field:<vm_ip> -

[0224] >ip_dst,goto_table:83:

[0225] set_field:<vm_mac> ->eth_dst: Set the destination MAC address to the cloud host's MAC.

[0226] set_field:<vm_ip> ->ip_dst: Set the destination IP address to the IP of the cloud host.

[0227] goto_table:83: After a successful match, jump to the flow table with table number 83.

[0228] By matching the IP traffic whose target IP address is the NAT port IP, modifying the target MAC address and target IP address, and then forwarding it to the flow table with table number 83.

[0229] The purpose is to write a flow table generation and distribution module in the computing node, and distribute the flow table in Open vSwitch according to the eaccess table information in the database. By generating and distributing these flow tables, network traffic control and forwarding can be achieved to ensure that the cloud host can access storage resources according to the access control rules.

[0230] By creating a flow table generation and delivery module in the computing node and defining the structure of the flow table, the forwarding rules of the data packet can be effectively controlled. This ensures that Open vSwitch can correctly forward data packets according to the rules in the flow table, improving the flexibility and management efficiency of the network.

[0231] In addition, in the Network Address Translation (NAT) scenario, TCP timestamps (tcp_timestamps) may cause the three-way handshake to fail. To avoid this, you can turn off tcp_timestamps on the storage node.

[0232] tcp_timestamps: A kernel parameter used to enable or disable TCP timestamps. TCP timestamps are used to calculate round trip time (RTT) and prevent sequence number wraparound attacks. Turn off tcp_timestamps: Set / proc / sys / net / ipv4 / tcp_timestamps to 0 to disable TCP timestamps.

[0233] In addition, it is a common operation to create virtual private cloud (VPC), subnet, and cloud virtual machine (VM) resources in the cloud resource pool console.

[0234] VPC is a logically isolated virtual network in which users can create and manage their own network resources.

[0235] A subnet is an IP address range in a VPC that is used to divide network resources.

[0236] A cloud host (Cloud Virtual Machine, VM) is a virtual machine instance in a cloud resource pool where users can deploy and run applications. Creating a cloud host provides users with a virtual computing environment where they can deploy and run applications.

[0237] In the cloud resource pool console, creating VPC, subnet, and cloud host resources is a common operation. Through these steps, users can create a logically isolated virtual network environment and deploy and manage cloud hosts in it to meet different application requirements.

[0238] In an embodiment of the present application, a first data access request message is initiated to a storage node of a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address; the first data access request message is received through a virtual switch, and the first IP address of the cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of a computing node through connection tracking and network address translation NAT to obtain a second data access request message, and the second data access request message is sent to a computing intranet gateway; the data flow table is generated according to a pre-set access control rule table; IP address conversion and NAT are performed through a virtual switch, thereby improving IO performance and avoiding the IGW network element from becoming a link bottleneck.

[0239] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected; data is directly forwarded through the virtual switch and the computing intranet gateway, which reduces the number of intermediate network element devices and reduces network latency and costs.

[0240] The data access request message is directly sent to the storage node through the computing intranet gateway, further reducing the network latency. The response message for the second data access request message is sent to the storage forwarding network gateway through the storage node of the cloud resource pool; the response message is directly sent to the cloud host through the storage forwarding network gateway, further reducing the network latency and improving the IO performance. The response message is sent to the cloud host through the storage forwarding network gateway. In this way, more efficient and reliable storage access can be achieved, meeting the requirements for high performance and high availability in the cloud computing environment.

[0241] Combine the following Figure 2 , the data access architecture involved in the embodiment of the present application is described:

[0242] A virtual machine (VM) is a virtual operating system instance that runs on physical hardware. It allows multiple independent operating system instances to run on the same physical server. It provides an isolated computing environment and supports multi-tenancy and resource sharing.

[0243] The Down Interface (Dn-int) of the network interface is used to send data from the network device to the terminal device. It is responsible for the downlink transmission of data packets.

[0244] User-space: User space refers to the memory area where applications and user processes run, which is opposite to kernel space. It provides an application running environment and interacts with kernel space.

[0245] The external bridge br-ext (Bridge External) is usually used to connect a virtual network and an external network. It enables communication between the virtual network and the external network.

[0246] Virtual Host User (VHU) refers to a user or administrator in the virtualization platform. It is used to manage and operate virtual hosts.

[0247] 5. Erase-top-options refers to the top-level options in a certain configuration or setting, which are used to control global behavior or advanced functions. Provide global configuration and advanced function settings.

[0248] Patch: A patch is a piece of code that repairs or improves software or systems.

[0249] Network Address Translation (NAT) is used to convert private IP addresses to public IP addresses, or convert IP addresses between different networks, to achieve address translation and network isolation.

[0250] Storage services refer to systems or platforms that provide data storage and management functions. They provide data storage, backup, and recovery services.

[0251] Isolate: Isolation is to separate different entities or resources to prevent mutual interference, thereby improving security and reliability.

[0252] Connection Tracking Limit (Ct-limit) is used to control the size and performance of the connection tracking table. It optimizes connection tracking performance and prevents resource exhaustion.

[0253] DPDK bonding technology (Data Plane Development Kit Bonding, Dpdkbond) is used to bond multiple network interfaces together to increase bandwidth and reliability. Improve network performance and reliability.

[0254] Internal bridge (br-int) is usually used to connect virtual machines in a virtual network and implement communication between virtual machines.

[0255] Physical Network Interface Card (Physical Network Interface Card, Phy-nic) is used to connect to the physical network and provide physical network connection.

[0256] Kernel-space: Kernel space refers to the memory area where the operating system kernel runs, which is responsible for managing hardware resources and providing system services. It provides low-level system services and resource management.

[0257] Three-layer underlay: refers to a certain network architecture or protocol, providing network architecture or protocol support.

[0258] The data access architecture involved in the embodiments of the present application is used to provide an application running environment, communication between virtual networks and external networks, an isolated computing environment, global configuration, vulnerability repair, address translation, data storage and management, security and reliability, connection tracking performance optimization, network performance improvement, communication between virtual machines, physical network connections, underlying system services and resource management, etc.

[0259] Based on the above Figure 1 The data access method shown in the embodiment of the present application also provides a data access device, such as Figure 3 As shown, the data access device 300 may include:

[0260] The first sending module 310 is used to initiate a first data access request message to a storage node in a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address;

[0261] The conversion module 320 is used to receive the first data access request message through the virtual switch, and convert the first IP address of the cloud host in the first data access request message into the second IP address according to the data flow table, and then convert the second IP address of the cloud host into the computing intranet IP address of the computing node through connection tracking and network address translation NAT to obtain the second data access request message, and send the second data access request message to the computing intranet gateway; the data flow table is generated according to the preset access control rule table;

[0262] The second sending module 330 is used to send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected;

[0263] A third sending module 340 is used to send a response message to the second data access request message to the storage and forwarding network gateway through the storage node of the cloud resource pool;

[0264] The fourth sending module 350 is used to send the response message to the cloud host through the storage and forwarding network gateway.

[0265] In a possible embodiment, the data access device 300 may further include:

[0266] Configuration module, used to configure computing intranet gateway and storage-and-forwarding network gateway on the core switch;

[0267] The configuration module is also used to configure the routing from the computing intranet to the storage and forwarding network and the routing from the storage and forwarding network to the computing intranet, so that the computing intranet and the storage and forwarding network can communicate with each other.

[0268] In a possible embodiment, the data access device 300 may further include:

[0269] An additional module is used to add the routing of the network segment of the storage and forwarding network on the computing node of the cloud resource pool, so that the computing node can route the traffic accessing the storage and forwarding network to the computing intranet gateway, and forward the traffic from the computing intranet gateway to the storage and forwarding network.

[0270] An additional module is used to add the routing of the network segment of the computing intranet on the storage node of the cloud resource pool, so that the storage node routes the traffic accessing the computing intranet to the storage forwarding network gateway, and the storage forwarding network gateway forwards it to the computing intranet.

[0271] In a possible embodiment, the fourth sending module 350 is specifically configured to:

[0272] The response message is forwarded to the computing node through the store-and-forward network gateway;

[0273] The response message is forwarded to the cloud host through the computing node.

[0274] In a possible embodiment, the fourth sending module 350 is specifically configured to:

[0275] By computing the node, the second destination address in the response message is replaced with the IP address of the NAT port, where the IP address of the NAT port is an IP address converted by a preset conversion algorithm according to the port number of the virtual machine network card;

[0276] According to the data flow table, replace the IP address of the NAT port with the IP address of the cloud host;

[0277] According to the data flow table, the MAC address of the storage node is replaced with the MAC address of the cloud host;

[0278] Based on the cloud host's IP address and cloud host's MAC address, the response message is forwarded to the cloud host.

[0279] In a possible embodiment, the data access device 300 may further include:

[0280] A creation module is used to create a cloud host access storage module in the cloud resource pool console. The cloud host access storage module is used to control the cloud host to access storage resources through a specified storage service port. An access control rule table is stored in the database of the cloud host access storage module.

[0281] The access control rule table includes the following fields:

[0282] The name of the access control rule;

[0283] The Classless Inter-Domain Routing CIDR of the target network, which is used to indicate the target network range that is allowed to be accessed;

[0284] Destination port, used to indicate the destination port number that is allowed to be accessed;

[0285] IP version, used to indicate the IP version to which the access control rule applies;

[0286] Protocol type, which indicates the protocol to which the access control rule applies.

[0287] In a possible embodiment, the data access device 300 may further include:

[0288] A creation module is used to create a flow table generation and delivery module in a computing node, where the flow table generation and delivery module is used to generate a flow table according to an access control rule table stored in a database, and deliver the generated flow table to Open vSwitch through the OpenFlow protocol;

[0289] The flow table contains the following fields:

[0290] The port number of the virtual machine network card on the virtual switch;

[0291] MAC address of the storage node;

[0292] The IP address of the NAT port;

[0293] The computing intranet IP address of the computing node;

[0294] The IP address of the cloud host;

[0295] The MAC address of the cloud host.

[0296] In an embodiment of the present application, a first data access request message is initiated to a storage node of a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address; the first data access request message is received through a virtual switch, and the first IP address of the cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of a computing node through connection tracking and network address translation NAT to obtain a second data access request message, and the second data access request message is sent to a computing intranet gateway; the data flow table is generated according to a pre-set access control rule table; IP address conversion and NAT are performed through a virtual switch, thereby improving IO performance and avoiding the IGW network element from becoming a link bottleneck.

[0297] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected; data is directly forwarded through the virtual switch and the computing intranet gateway, which reduces the number of intermediate network element devices and reduces network latency and costs.

[0298] The data access request message is directly sent to the storage node through the computing intranet gateway, further reducing the network latency. The response message for the second data access request message is sent to the storage forwarding network gateway through the storage node of the cloud resource pool; the response message is directly sent to the cloud host through the storage forwarding network gateway, further reducing the network latency and improving the IO performance. The response message is sent to the cloud host through the storage forwarding network gateway. In this way, more efficient and reliable storage access can be achieved, meeting the requirements for high performance and high availability in the cloud computing environment.

[0299] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0300] The electronic device may include a processor 401 and a memory 402 storing computer program instructions.

[0301] Specifically, the processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0302] The memory 402 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 402 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 402 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 402 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 402 is a non-volatile solid-state memory. In a specific embodiment, the memory 402 includes a read-only memory (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.

[0303] The processor 401 reads and executes the computer program instructions stored in the memory 402 to implement Figure 1 Any data access method in the illustrated embodiments.

[0304] In one example, the electronic device may further include a communication interface 404 and a bus 410. Figure 4As shown, the processor 401, the memory 402, and the communication interface 404 are connected via a bus 410 and communicate with each other.

[0305] The communication interface 404 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0306] Bus 410 includes hardware, software or both, and the parts of electronic equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 410 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0307] The electronic device can execute the data access method in the embodiment of the present application, thereby realizing the combination Figure 2 Describes the data access methods.

[0308] In addition, in combination with the data access method in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium to implement. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, the Figure 1 Data access methods.

[0309] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0310] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0311] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0312] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A data access method, characterized in that: The method comprises: Initiate a first data access request message to a storage node in a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address; A first data access request message is received through a virtual switch, and a first IP address of a cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of a computing node through connection tracking and network address translation NAT to obtain a second data access request message, and the second data access request message is sent to a computing intranet gateway; the data flow table is generated according to a preset access control rule table; The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected; Sending a response message to the second data access request message to the storage and forwarding network gateway through the storage node of the cloud resource pool; The response message is sent to the cloud host through the store-and-forward network gateway.

2. The method according to claim 1, characterized in that Before sending the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway, the method further includes: Configure the computing intranet gateway and storage-and-forwarding network gateway on the core switch; Configure the routes from the computing intranet to the storage-and-forwarding network and from the storage-and-forwarding network to the computing intranet so that the computing intranet and the storage-and-forwarding network can communicate with each other.

3. The method according to claim 1, characterized in that Before sending the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway, the method further includes: Add the route of the network segment of the storage and forwarding network on the computing node of the cloud resource pool, so that the computing node can route the traffic accessing the storage and forwarding network to the computing intranet gateway, and the computing intranet gateway can forward the traffic to the storage and forwarding network. Add the route of the computing intranet segment on the storage node of the cloud resource pool so that the storage node can route the traffic accessing the computing intranet to the storage and forwarding network gateway, and the storage and forwarding network gateway can forward the traffic to the computing intranet.

4. The method according to claim 1, characterized in that The step of forwarding the response message to the cloud host through the store-and-forward network gateway includes: The response message is forwarded to the computing node through the store-and-forward network gateway; The response message is forwarded to the cloud host through the computing node.

5. The method according to claim 4, characterized in that The step of forwarding the response message to the cloud host through the computing node includes: By computing the node, the second destination address in the response message is replaced with the IP address of the NAT port, where the IP address of the NAT port is an IP address converted by a preset conversion algorithm according to the port number of the virtual machine network card; According to the data flow table, replace the IP address of the NAT port with the IP address of the cloud host; According to the data flow table, the MAC address of the storage node is replaced with the MAC address of the cloud host; Based on the cloud host's IP address and cloud host's MAC address, the response message is forwarded to the cloud host.

6. The method according to claim 1, characterized in that The method further comprises: Create a cloud host access storage module in the cloud resource pool console. The cloud host access storage module is used to control the cloud host to access storage resources through the specified storage service port. The database of the cloud host access storage module stores an access control rule table. The access control rule table includes the following fields: The name of the access control rule; The Classless Inter-Domain Routing CIDR of the target network, which is used to indicate the target network range that is allowed to be accessed; Destination port, used to indicate the destination port number that is allowed to be accessed; IP version, used to indicate the IP version to which the access control rule applies; Protocol type, which indicates the protocol to which the access control rule applies.

7. The method according to claim 6, characterized in that The method further comprises: A flow table generation and delivery module is created in the computing node. The flow table generation and delivery module is used to generate a flow table according to the access control rule table stored in the database, and deliver the generated flow table to OpenvSwitch through the OpenFlow protocol. The flow table contains the following fields: The port number of the virtual machine network card on the virtual switch; MAC address of the storage node; The IP address of the NAT port; The computing intranet IP address of the computing node; The IP address of the cloud host; The MAC address of the cloud host.

8. A data access device, characterized in that: The data access device comprises: A first sending module, configured to initiate a first data access request message to a storage node in a cloud resource pool through a cloud host; the first data access request message includes: a first IP address of the cloud host and a first target address; The conversion module is used to receive the first data access request message through the virtual switch, and convert the first IP address of the cloud host in the first data access request message into the second IP address according to the data flow table, and then convert the second IP address of the cloud host into the computing intranet IP address of the computing node through connection tracking and network address translation NAT to obtain the second data access request message, and send the second data access request message to the computing intranet gateway; the data flow table is generated according to the preset access control rule table; A second sending module is used to send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network on the core switch are connected; A third sending module, configured to send a response message to the second data access request message to a storage and forwarding network gateway through a storage node of the cloud resource pool; The fourth sending module is used to send the response message to the cloud host through the storage and forwarding network gateway.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the data access method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the data access method according to any one of claims 1 to 7 is implemented.

Images