A data access method and device, electronic equipment and storage medium

Abstract

Embodiments of the application disclose a data access method and device, electronic equipment and storage medium, the method comprising: initiating a first data access request message to a storage node of a cloud resource pool through a cloud host; receiving the first data access request message through a virtual switch, converting a first IP address of the cloud host in the first data access request message into a second IP address according to a data flow table, converting the second IP address of the cloud host into a computing intranet IP address of a computing node, obtaining a second data access request message, and sending the second data access request message to a computing intranet gateway; sending the second data access request message to the storage node of the cloud resource pool indicated by a first target address through the computing intranet gateway; sending a response message to the second data access request message to the storage forwarding network gateway through the storage node of the cloud resource pool; and sending the response message to the cloud host through the storage forwarding network gateway.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of Internet, and particularly relates to a data access method and device, electronic equipment and storage medium. BACKGROUND

[0002] In a cloud computing environment, the forwarding model of cloud host internal network access to storage usually involves multiple intermediate network element devices, which increases network cost and latency. The traditional cloud host access to storage implementation scheme relies on an Internet Gateway (IGW), and cloud host access to storage traffic needs to be forwarded through the IGW network element device. Although this architecture can realize basic storage access functions, it has the following problems:

[0003] Because the storage traffic needs to pass through multiple intermediate network element devices, including the IGW network element device, the network path becomes longer, increasing the data transmission latency. The forwarding process of multiple layers of network element devices introduces additional processing overhead. The IGW network element device, as a centralized forwarding point of storage traffic, is prone to become a network bottleneck. The deployment and maintenance of multiple layers of network element devices require additional hardware and software resources, increasing network costs.

[0004] Therefore, how to realize more efficient and reliable data access is a problem that needs to be solved. SUMMARY

[0005] The embodiments of the present application provide a data access method, device, equipment and storage medium, which can solve the problem of realizing efficient and reliable data access.

[0006] In a first aspect, the embodiments of the present application provide a data access method, which comprises:

[0007] initiating a first data access request message from a cloud host to a storage node of a cloud resource pool; the first data access request message comprises a first IP address of the cloud host and a first target address;

[0008] receiving the first data access request message through a virtual switch, converting the first IP address of the cloud host in the first data access request message into a second IP address according to a data flow table, converting the second IP address of the cloud host into a computing internal network IP address of a computing node through connection tracking and network address translation (NAT), obtaining a second data access request message, and sending the second data access request message to a computing internal network gateway; the data flow table is generated according to a pre-set access control rule table;

[0009] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing internal network gateway; the computing internal network gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing internal network and the storage forwarding network are connected on the core switch;

[0010] The response message for the second data access request message is sent to the storage forwarding network gateway through the storage node of the cloud resource pool;

[0011] The response message is sent to the cloud host through the storage forwarding network gateway.

[0012] In a second aspect, an embodiment of the present application provides a data access device, and the data access device comprises:

[0013] The first sending module is configured to initiate a first data access request message to the storage node of the cloud resource pool through the cloud host; the first data access request message comprises a first IP address of the cloud host and a first target address;

[0014] The conversion module is configured to receive the first data access request message through the virtual switch, convert the first IP address of the cloud host in the first data access request message into a second IP address according to a data flow table, convert the second IP address of the cloud host into a computing internal network IP address of the computing node through connection tracking and network address translation (NAT), obtain a second data access request message, and send the second data access request message to the computing internal network gateway; the data flow table is generated according to a pre-set access control rule table;

[0015] The second sending module is configured to send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing internal network gateway; the computing internal network gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing internal network and the storage forwarding network are connected on the core switch;

[0016] The third sending module is configured to send a response message for the second data access request message to the storage forwarding network gateway through the storage node of the cloud resource pool;

[0017] The fourth sending module is configured to send the response message to the cloud host through the storage forwarding network gateway.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, which comprises a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the method in the first aspect or any possible implementation manner of the first aspect is implemented.

[0019] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium, which stores computer program instructions. The computer program instructions are executed by a processor to implement the method in the first aspect or any possible implementation manner of the first aspect.

[0020] In the embodiments of the present application, a first data access request message is initiated to a storage node of a cloud resource pool by a cloud host; the first data access request message comprises a first IP address of the cloud host and a first target address; the first data access request message is received by a virtual switch, and the first IP address of the cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of a computing node by connection tracking and network address translation (NAT), to obtain a second data access request message, and the second data access request message is sent to a computing intranet gateway; the data flow table is generated according to a pre-set access control rule table; the IP address conversion and the NAT are performed by the virtual switch, which improves the IO performance and avoids the IGW network element from becoming a link bottleneck.

[0021] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address by the computing intranet gateway; the computing intranet gateway and a storage forwarding network gateway are configured on a core switch of the cloud resource pool, and the computing intranet and the storage forwarding network are connected on the core switch; the data forwarding is directly performed by the virtual switch and the computing intranet gateway, which reduces the number of intermediate network element devices and reduces the network delay and cost.

[0022] The data access request message is directly sent to the storage node by the computing intranet gateway, which further reduces the network delay. The response message to the second data access request message is sent to the storage forwarding network gateway by the storage node of the cloud resource pool; the response message is directly sent to the cloud host by the storage forwarding network gateway, which further reduces the network delay and improves the IO performance. The response message is sent to the cloud host by the storage forwarding network gateway. In this way, more efficient and more reliable storage access can be realized, and the demand for high performance and high availability in the cloud computing environment can be met. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced. For those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0024] Figure 1 is a flowchart of a data access method provided by the embodiments of the present application;

[0025] Figure 2is a schematic diagram of a data access architecture provided by an embodiment of the present application.

[0026] Figure 3 is a structural schematic diagram of a data access device provided by an embodiment of the present application.

[0027] Figure 4 is a hardware structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] The features and exemplary embodiments of various aspects of the present application will be described in detail below with reference to the drawings. To make the purposes, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. The present application can be implemented without some of the specific details by those skilled in the art. The following description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application.

[0029] It should be noted that, in this paper, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the elements defined by the statement "include" do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0030] The technical terms involved in the present application are briefly introduced as follows.

[0031] Open Virtual Switch (OVS) is an open-source virtual switch software designed for managing multi-tenant public cloud computing environments. It provides network administrators with traffic visibility and control between and within virtual machines (VMs). OVS can create and manage virtual switches in virtualized environments, enabling network communication between virtual machines. It supports multiple virtualization platforms such as KVM, Xen, VMware, etc.

[0032] OVS supports multi-tenant environments, allowing independent virtual networks to be created for different tenants, ensuring network isolation between tenants. It provides rich network functions such as VLAN, tunnel (such as VXLAN, GRE), etc., supporting complex network topologies. OVS provides detailed traffic monitoring and control functions, allowing network administrators to view and control traffic between virtual machines through OVS.

[0033] OVS supports the OpenFlow protocol, allowing virtual switches to be remotely managed and configured by OpenFlow controllers.

[0034] OpenFlow is a network communication protocol that belongs to the data link layer and can control the forwarding plane of network switches or routers, thereby changing the network path that network packets take. OpenFlow controls the packet forwarding behavior of network devices through the flow table mechanism. Each entry in the flow table defines a matching condition and corresponding actions such as forwarding, discarding, modifying, etc.

[0035] OpenFlow controllers can remotely manage and configure network devices that support OpenFlow, enabling centralized network management. Controllers can dynamically adjust flow tables to implement flexible network policies and automated management. OpenFlow supports network virtualization, allowing multiple logical networks to be created on a physical network, enabling flexible allocation of network resources.

[0036] Connection tracking (CONNTRACK, CT) is a module in the Linux kernel that tracks and records connection states. It generates a new connection record for each packet that passes through the network stack.

[0037] IGW is a key component in cloud computing and network architecture, mainly used to connect private networks with public Internet. IGW plays a bridge role in the cloud environment, enabling cloud resources to communicate with external networks.

[0038] The data access method provided by the embodiments of the present application can be applied to at least the following application scenarios, which will be described below.

[0039] In a cloud computing environment, a cloud resource pool usually includes multiple components such as computing resources, storage resources, and network resources. In order to achieve efficient resource management and flexible resource allocation, cloud platforms usually design complex network architectures. Among them, cloud hosts need to access storage resources through an internal network to achieve efficient read and write and sharing of data.

[0040] To achieve high availability, load balancing, and security, cloud platforms often introduce multiple layers of network devices such as routers, switches, load balancers, etc. These devices play a crucial role in data transmission but also increase the complexity and cost of the network.

[0041] In the process of cloud host accessing storage resources, data usually needs to pass through multiple intermediate forwarding nodes. These nodes may be physical devices or virtual devices, which play a role in routing and forwarding during data transmission.

[0042] The introduction of multiple layers of network devices requires the purchase and maintenance of a large number of hardware devices such as routers, switches, load balancers, etc. The procurement, deployment, and maintenance of these devices are costly. As data volume increases, the demand for network bandwidth also increases. To ensure the efficiency and stability of data transmission, more bandwidth resources need to be purchased, which also increases network costs. Complex network architecture requires a professional network management team for maintenance and management, which also increases labor costs.

[0043] Because data needs to pass through multiple intermediate forwarding nodes, the transmission path becomes longer, resulting in increased data transmission delay. This is a disadvantage for application scenarios that require low latency. The bandwidth limitation of intermediate forwarding nodes can become a performance bottleneck, especially in high-concurrency access scenarios, which can cause data transmission speed to decrease.

[0044] Specifically, because storage traffic needs to pass through multiple intermediate network element devices, including IGW network element devices, the network path becomes longer, increasing the latency of data transmission. This is a serious performance bottleneck for application scenarios that require low latency and high throughput.

[0045] The forwarding process of multiple layers of network element devices introduces additional processing overhead, resulting in decreased IO performance. This performance degradation is more pronounced in high-concurrency access scenarios, affecting the overall system's response speed and throughput.

[0046] IGW network element devices, as centralized forwarding points for storage traffic, are prone to becoming network bottlenecks. In high-load situations, the processing capacity of IGW network elements cannot meet the large number of concurrent requests, leading to network congestion and performance degradation.

[0047] The deployment and maintenance of multiple layers of network element devices require additional hardware and software resources, increasing network costs. In addition, to ensure network reliability and performance, more management and operation resources need to be invested.

[0048] Current implementation schemes for cloud host access to storage require reliance on storage IGW network element devices. Cloud host access to storage traffic passes through IGW network element devices, increasing network latency and decreasing IO performance, and IGW network elements become link bottlenecks.

[0049] Figure 1 is a flowchart of a data access method provided by an embodiment of the present application.

[0050] As shown in Figure 1 , the data access method can include steps 110-150, and the method is applied to a data access device, as follows:

[0051] Step 110, initiating a first data access request message to a storage node of a cloud resource pool through a cloud host; the first data access request message includes a first IP address of the cloud host and a first target address;

[0052] The cloud host refers to a virtual machine or a physical server running in a cloud computing environment, providing computing resources and services.

[0053] The first IP address is the initial IP address of the cloud host, which is usually the IP address of the cloud host in the virtual network.

[0054] The first target address is the IP address of the target storage node when the cloud host initiates a data access request.

[0055] The virtual switch is a software switch running in a virtualized environment, used to forward data packets between virtual machines or between virtual machines and external networks.

[0056] By directly initiating a data access request to the storage node, the forwarding link of the intermediate network element device is reduced, the data transmission path is shortened, and the network latency is reduced.

[0057] Step 120, receiving the first data access request message through the virtual switch, and converting the first IP address of the cloud host in the first data access request message to a second IP address according to a data flow table, and then converting the second IP address of the cloud host to a computing intranet IP address of the computing node through connection tracking and network address translation (NAT), to obtain a second data access request message, and sending the second data access request message to a computing intranet gateway; the data flow table is generated according to a pre-set access control rule table;

[0058] The data flow table is a table in Open vSwitch or other network devices for defining data packet forwarding rules. Each flow table entry contains a matching condition and a corresponding action.

[0059] The second IP address is the IP address of the cloud host after the data packet passes through the virtual switch.

[0060] Connection Tracking (CT): Connection Tracking is a network function that tracks the state of network connections, typically used in firewalls and NAT (Network Address Translation).

[0061] Network Address Translation (NAT): A function used to convert private IP addresses to public IP addresses or convert IP addresses between different networks.

[0062] Compute Intranet IP Address: The internal network IP address of a compute node, typically used for internal communication.

[0063] Second Data Access Request Message: Data access request message after IP address conversion.

[0064] IP address conversion and NAT through virtual switch reduces the forwarding overhead of multi-layer network element devices and improves IO performance. The efficient processing capability of virtual switch can better cope with high concurrency access scenarios. IP address conversion and NAT through virtual switch avoid relying on IGW network element devices and eliminate the risk of IGW network element becoming a link bottleneck.

[0065] Step 130, send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the compute intranet gateway; the compute intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the compute intranet and the storage forwarding network are connected on the core switch;

[0066] Compute Intranet Gateway: Gateway of the compute intranet, used to forward data packets to external networks or receive data packets from external networks.

[0067] Directly send the data access request message to the storage node through the compute intranet gateway, reducing the intermediate forwarding links and further reducing the network latency. By optimizing the network architecture, the number of intermediate network element devices is reduced, and the cost of network deployment and maintenance is reduced.

[0068] Step 140, send the response message for the second data access request message to the storage forwarding network gateway through the storage node of the cloud resource pool;

[0069] The storage node directly sends the response message to the storage forwarding network gateway, reducing the intermediate forwarding links and improving the IO performance.

[0070] Step 150, send the response message to the cloud host through the storage forwarding network gateway.

[0071] Storage Forwarding Network Gateway: Gateway of the storage forwarding network, used to forward data packets to storage nodes or receive data packets from storage nodes.

[0072] The response message is directly sent to the cloud host through the store-and-forward network gateway, reducing the intermediate forwarding link and further reducing the network delay. The forwarding of the response message is performed through the store-and-forward network gateway, avoiding the dependence on the IGW network element device and eliminating the risk of the IGW network element becoming a link bottleneck.

[0073] Data forwarding is directly performed through the virtual switch and the computing internal network gateway, reducing the number of intermediate network element devices and reducing network delay and cost. IP address conversion and NAT are performed through the virtual switch, improving IO performance and avoiding the IGW network element becoming a link bottleneck. The data access request message is directly sent to the storage node through the computing internal network gateway, further reducing the network delay. The response message is directly sent to the cloud host through the store-and-forward network gateway, further reducing the network delay and improving the IO performance. Thus, more efficient and reliable storage access can be achieved to meet the demand for high performance and high availability in a cloud computing environment.

[0074] In a possible embodiment, before step 130, the method further comprises:

[0075] configuring the computing internal network gateway and the store-and-forward network gateway on the core switch;

[0076] configuring the route from the computing internal network to the store-and-forward network and the route from the store-and-forward network to the computing internal network to enable the computing internal network and the store-and-forward network to communicate with each other.

[0077] The core switch is a key device in the network, responsible for forwarding data packets between different networks. The gateway is configured to enable the core switch to identify and manage data streams of different networks.

[0078] The computing internal network gateway is the exit of the computing internal network, responsible for forwarding the traffic of the computing internal network to other network areas.

[0079] The store-and-forward network gateway is the exit of the store-and-forward network, responsible for forwarding the traffic of the store-and-forward network to other network areas.

[0080] By configuring the route, the computing internal network and the store-and-forward network are connected on the third layer (i.e., the network layer), enabling the two network areas to communicate with each other. By configuring the gateway and the route on the core switch, intercommunication between the computing internal network and the store-and-forward network is achieved, ensuring that the cloud host can access the storage resources.

[0081] Suppose the IP address segment of the computing internal network is 192.168.1.0 / 24, and the gateway address is 192.168.1.1. On the core switch, a virtual local area network interface is configured for the computing internal network, and the IP address of the interface is set to 192.168.1.1.

[0082] Assuming the IP address range of the store-and-forward network is 192.168.2.0 / 24, and the gateway address is 192.168.2.1. On the core switch, configure another virtual LAN interface for the store-and-forward network and set its IP address to 192.168.2.1.

[0083] Configure the route to let the core switch know how to forward packets from one network to another. On the core switch, add a static route specifying the target network as 192.168.2.0 / 24 and the next hop as the gateway of the store-and-forward network, 192.168.2.1.

[0084] On the core switch, add another static route specifying the target network as 192.168.1.0 / 24 and the next hop as the gateway of the compute internal network, 192.168.1.1.

[0085] To ensure that the route and gateway configurations are correct and that the network can communicate normally, you can view the routing table on the core switch to confirm that the static routes have been added correctly.

[0086] By configuring the compute internal network gateway and the store-and-forward network gateway on the core switch and configuring the route, the compute internal network and the store-and-forward network can communicate with each other, ensuring that packets can be correctly forwarded between different networks.

[0087] In one possible embodiment, before step 130, it further includes:

[0088] Add the route of the store-and-forward network segment on the compute nodes of the cloud resource pool to make the compute nodes route traffic accessing the store-and-forward network to the compute internal network gateway and then to the store-and-forward network by the compute internal network gateway.

[0089] Add the route of the compute internal network segment on the storage nodes of the cloud resource pool to make the storage nodes route traffic accessing the compute internal network to the store-and-forward network gateway and then to the compute internal network by the store-and-forward network gateway.

[0090] Add the route of the store-and-forward network segment on the compute nodes of the cloud resource pool ip route add<store-and-forward network CIDR> via<compute internal network gateway>.

[0091] Compute node: A compute node is a physical or virtual server in the cloud resource pool that runs a cloud host instance.

[0092] Store-and-forward network CIDR: The IP address range of the store-and-forward network, usually represented in CIDR (such as 192.168.2.0 / 24).

[0093] Compute Intranet Gateway: The gateway IP address of the compute intranet, used to forward traffic to the storage forwarding network.

[0094] Add a route for the compute intranet segment on the compute nodes, enabling them to correctly route traffic accessing the storage forwarding network to the compute intranet gateway, which then forwards to the storage forwarding network.

[0095] Compute nodes need to know how to route traffic accessing the storage forwarding network to the compute intranet gateway, which then forwards to the storage forwarding network. Assume the storage forwarding network IP address segment is 192.168.2.0 / 24, and the compute intranet gateway IP address is 192.168.1.1.

[0096] On the compute nodes, add a static route specifying the target network as 192.168.2.0 / 24 and the next hop as the compute intranet gateway 192.168.1.1.

[0097] Add a route for the compute intranet segment on the cloud resource pool storage nodes: ip route add <compute intranet CIDR> via <storage forwarding network gateway>.

[0098] Storage nodes are physical or virtual servers in the cloud resource pool, providing storage services.

[0099] Compute Intranet CIDR: The IP address range of the compute intranet, usually expressed in CIDR (such as 192.168.1.0 / 24).

[0100] Storage Forwarding Network Gateway: The gateway IP address of the storage forwarding network, used to forward traffic to the compute intranet.

[0101] Add a route for the compute intranet segment on the storage nodes, enabling them to correctly route traffic accessing the compute intranet to the storage forwarding network gateway, which then forwards to the compute intranet.

[0102] Storage nodes need to know how to route traffic accessing the compute intranet to the storage forwarding network gateway, which then forwards to the compute intranet. Assume the compute intranet IP address segment is 192.168.1.0 / 24, and the storage forwarding network gateway IP address is 192.168.2.1.

[0103] On the storage nodes, add a static route specifying the target network as 192.168.1.0 / 24 and the next hop as the storage forwarding network gateway 192.168.2.1.

[0104] By adding the corresponding route configuration on the compute nodes and storage nodes of the cloud resource pool, we can ensure that the compute nodes and storage nodes can correctly route traffic to each other's network, ensuring smooth transmission of data access requests and responses.

[0105] In one possible embodiment, step 150 comprises:

[0106] Forwarding the response message to the compute node through the storage forwarding network gateway;

[0107] Forwarding the response message to the cloud host through the compute node.

[0108] The storage forwarding network gateway is responsible for forwarding the response message from the storage node to the compute node. The compute node needs to know how to process the response message and forward it to the cloud host.

[0109] The storage forwarding network gateway forwards the response message:

[0110] Assuming that the IP address of the storage forwarding network gateway is 192.168.2.1 and the IP address of the compute node is 192.168.2.10. After the storage forwarding network gateway receives the response message from the storage node, it forwards the response message to the compute node according to the routing configuration.

[0111] After the compute node receives the response message from the storage forwarding network gateway, it needs to forward it to the cloud host. The compute node needs to know the IP address of the cloud host and forward the response message to the cloud host according to the routing configuration.

[0112] The compute node forwards the response message:

[0113] Assuming that the IP address of the cloud host is 192.168.1.10 and the IP address of the compute node is 192.168.2.10. After the compute node receives the response message, it forwards the response message to the cloud host according to the routing configuration.

[0114] Forwarding the response message to the compute node through the storage forwarding network gateway and then forwarding the response message to the cloud host through the compute node can ensure that the response message can be correctly transmitted from the storage node to the cloud host. Through these configurations, the response message can be successfully transmitted from the storage node to the cloud host, completing the entire data access process.

[0115] In the above-mentioned step of forwarding the response message to the cloud host through the compute node, the specific steps can include the following steps:

[0116] Replacing the second target address in the response message with the IP address of the NAT port through the compute node, the IP address of the NAT port being an IP address converted from the port number of the virtual machine network card through a preset conversion algorithm;

[0117] Replacing the IP address of the NAT port with the IP address of the cloud host according to the data flow table;

[0118] According to the data flow table, the MAC address of the storage node is replaced by the MAC address of the cloud host.

[0119] According to the IP address of the cloud host and the MAC address of the cloud host, the response message is forwarded to the cloud host.

[0120] After the computing node receives the response message, the second target address in the response message is replaced by the IP address of the NAT port according to a preset conversion algorithm.

[0121] The data flow table is a table in Open vSwitch or other network devices for defining packet forwarding rules. According to the rules in the data flow table, the computing node replaces the IP address of the NAT port with the IP address of the cloud host.

[0122] According to the rules in the data flow table, the computing node replaces the IP address of the NAT port in the response message with the IP address of the cloud host. In order to ensure that the response message can be correctly forwarded to the cloud host, the computing node also needs to replace the MAC address of the storage node in the response message with the MAC address of the cloud host. According to the rules in the data flow table, the computing node replaces the MAC address of the storage node in the response message with the MAC address of the cloud host.

[0123] After the above steps, the target IP address and the target MAC address in the response message have been replaced by the IP address and the MAC address of the cloud host. According to this information, the computing node forwards the response message to the cloud host. The response message can be successfully transmitted from the storage node to the cloud host, and the entire data access process is completed.

[0124] In a possible embodiment, a cloud host access storage module is created in a cloud resource pool console, and the cloud host access storage module is used to control the cloud host to access storage resources through a specified storage service port; a database of the cloud host access storage module stores an access control rule table;

[0125] The access control rule table includes the following fields:

[0126] The name of the access control rule;

[0127] The Classless Inter-Domain Routing (CIDR) of the target network, used to indicate the range of target networks allowed to access;

[0128] The target port, used to indicate the target port number allowed to access;

[0129] The IP version, used to indicate the IP version to which the access control rule applies;

[0130] The protocol type, used to indicate the protocol to which the access control rule applies.

[0131] Cloud resource pool console: The management console of the cloud resource pool, used to configure and manage various resources in the cloud resource pool.

[0132] By writing a custom cloud host access storage module, the traffic of cloud host accessing storage resources is controlled, ensuring that only specified storage service ports can be accessed by cloud hosts, improving security. The purpose is to realize the internal network access and traffic forwarding between cloud hosts and storage resources in the cloud resource pool. By configuring gateways and routes on the core switch and adding corresponding routes on the compute node and storage node, it ensures that the two network domains can communicate with each other. Finally, by writing a custom module, the traffic of cloud host accessing storage resources is controlled, ensuring the safety and smoothness of data transmission.

[0133] Cloud host access storage module is a control module used to manage and control cloud host access to storage resources. Through this module, administrators can define access control rules to ensure that cloud hosts can only access storage resources through specified storage service ports.

[0134] Access control rule table is used to store access control rules, each rule defines the conditions and restrictions of cloud host accessing storage resources.

[0135] Field description of access control rule table:

[0136] Name of access control rule: Used to identify the name of the access control rule, making it easy for administrators to identify and manage.

[0137] CIDR of target network: Used to indicate the range of target networks allowed to access. CIDR notation (such as 192.168.1.0 / 24) is used to define the IP address range.

[0138] Target port: Used to indicate the target port number allowed to access. For example, port number 80 represents HTTP access.

[0139] IP version: Used to indicate the IP version that the access control rule applies to, such as IPv4 or IPv6.

[0140] Protocol type: Used to indicate the protocol that the access control rule applies to, such as TCP, UDP or ICMP.

[0141] Cloud host access storage module controls cloud host access to storage resources according to the rules in the access control rule table. Only access requests that meet the rules will be allowed. Cloud host access storage module loads the access control rule table from the database. When a cloud host initiates an access request, cloud host access storage module checks the target network, target port, IP version and protocol type of the request according to the rules in the access control rule table. If the request meets a rule, access is allowed; otherwise, access is denied.

[0142] The access control rule table can be an access table, which is a database table used to store access control rules. It includes the following fields:

[0143] A database table is created to store access control rules, facilitating subsequent add, delete, modify, and query operations.

[0144] On the one hand, create an eaccess interface to insert information into the database according to the interface input parameters. Create an eaccess interface: write an API interface to create a new access control rule. Insert the received parameters into the eaccess table. Provide an interface that allows users to create new access control rules through API and store rule information in the database.

[0145] On the other hand, write a delete eaccess interface to delete data from the database according to the interface input parameters. Delete eaccess interface: write an API interface to delete existing access control rules. The interface needs to receive one or more parameters (such as name or dst_cidr) to query the rules to be deleted. According to the input parameters, query the matching rules from the eaccess table. Delete data: delete the queried rules from the database. Provide an interface that allows users to delete existing access control rules through API, ensuring the flexibility of rule management.

[0146] On the other hand, write a query eaccess interface to get all current eaccess rules. Query eaccess interface: write an API interface to query all current access control rules. Query all records from the eaccess table and return them to the user. Provide an interface that allows users to query all current access control rules through API, facilitating management and monitoring.

[0147] The purpose is to manage and operate access control rules in the database, and through the creation, deletion, and query interfaces, to realize the add, delete, modify, and query operations of the eaccess table. Through these interfaces, users can flexibly manage access control rules to ensure the security and controllability of network access.

[0148] By creating a cloud host access storage module in the cloud resource pool console and defining an access control rule table, cloud host access to storage resources can be effectively controlled. It can ensure that cloud hosts can only access storage resources through specified storage service ports, improving the security and management efficiency of storage resources.

[0149] Specifically, an eaccess rule can be created in the cloud resource pool console, and the rule is as follows:

[0150] In the cloud resource pool console, take creating an eaccess rule named NFS-2049 as an example:

[0151] Log in to the cloud resource pool console with an administrator account or an account with corresponding permissions. In the console, find and click the "Access Control" or "Security Group" related option to enter the eaccess rule management page. Click the "Create Rule" button: In the eaccess rule management page, click the "Create Rule" button. Enter the name of the rule, for example, NFS-2049. Enter the CIDR of the target network, for example, 55.243.4.20 / 32. Enter the target port number, for example, 2049. Select the IP version, for example, IPv4. Select the protocol type, for example, TCP. Click the "OK" or "Create" button: After filling in the rule information, click the "OK" or "Create" button to complete the creation of the eaccess rule.

[0152] eaccess rule example:

[0153] Name: NFS-2049;

[0154] Target CIDR: 55.243.4.20 / 32;

[0155] Target port: 2049;

[0156] IP version: IPv4;

[0157] Protocol: TCP;

[0158] In the cloud resource pool console, used to define access control policies. Through the above steps, users can create an eaccess rule named NFS-2049, allowing TCP traffic from specific IP addresses and ports to access.

[0159] In one possible embodiment, a flow table generation and delivery module is created in the compute node, which is used to generate a flow table according to the access control rule table stored in the database, and to deliver the generated flow table to the Open vSwitch through the OpenFlow protocol;

[0160] The flow table includes the following fields:

[0161] Port number of the virtual machine network card on the virtual switch;

[0162] MAC address of the storage node;

[0163] IP address of the NAT port;

[0164] Compute node's compute intranet IP address;

[0165] IP address of the cloud host;

[0166] MAC address of the cloud host.

[0167] The flow table generation and delivery module is a software module that generates flow tables according to the access control rule table and delivers the flow tables to the Open vSwitch through the OpenFlow protocol. The Open vSwitch is an open-source virtual switch that supports the OpenFlow protocol.

[0168] The flow table is used to define the forwarding rules of data packets, and each flow table entry contains multiple fields for matching data packets and performing corresponding actions.

[0169] Explanation of the fields of the flow table:

[0170] Port number of the virtual machine network card on the virtual switch: used to identify the port number of the virtual machine network card on the virtual switch, usually an integer.

[0171] MAC address of the storage node: used to identify the MAC address of the storage node, usually a 48-bit binary number.

[0172] IP address of the NAT port: used to identify the IP address of the NAT port, usually a 32-bit binary number (IPv4) or a 128-bit binary number (IPv6).

[0173] Computing intranet IP address of the computing node: used to identify the computing intranet IP address of the computing node, usually a 32-bit binary number (IPv4) or a 128-bit binary number (IPv6).

[0174] IP address of the cloud host: used to identify the IP address of the cloud host, usually a 32-bit binary number (IPv4) or a 128-bit binary number (IPv6).

[0175] MAC address of the cloud host: used to identify the MAC address of the cloud host, usually a 48-bit binary number.

[0176] The flow table generation and delivery module reads the access control rule table from the database. According to the rules in the access control rule table, corresponding flow table entries are generated. Each flow table entry contains the port number of the virtual machine network card on the virtual switch, the MAC address of the storage node, the IP address of the NAT port, the computing intranet IP address of the computing node, the IP address of the cloud host, and the MAC address of the cloud host.

[0177] The generated flow tables are delivered to the Open vSwitch through the OpenFlow protocol. The Open vSwitch matches data packets according to the rules in the flow table and performs corresponding actions.

[0178] Specifically, information in the eaccess table in the database is collected;

[0179] eaccess table: a database table that stores access control rules. All rule information, including dst_cidr, dst_port, ip_version, protocol, etc., is obtained from the eaccess table.

[0180] All current access control rules are obtained, providing a data basis for subsequent generation of flow tables. Then, the flow tables are sent to Open vSwitch through the OpenFlow protocol

[0181] Forwarding flow table: according to the collected eaccess table information, the corresponding forwarding flow table is generated.

[0182] OpenFlow protocol: through the OpenFlow protocol, the generated flow table is sent to Open vSwitch.

[0183] According to the access control rule table, the flow table is generated and sent, realizing the control and forwarding of network traffic.

[0184] The relationship between the access control rule table and the flow table mainly reflects in rule conversion, dynamic update and packet processing, etc. The access control rule table defines the access control policy, and the flow table generates corresponding entries according to the rules in the access control rule table to control the forwarding behavior of the packet. Through this relationship, flexible access control and efficient network management can be realized.

[0185] Exemplarily, the format of the core flow table can be as follows:

[0186] (a) "table = 30, priority = 10, tcp, nw_dst = <dst_cidr>, tp_dst = <dst_port>

[0187] actions = goto_table:36".

[0188] table = 30: the table number of the flow table is 30.

[0189] priority = 10: the priority of the flow table is 10.

[0190] tcp: match TCP protocol. (protocol: indicated protocol type)

[0191] nw_dst = <dst_cidr>: match the CIDR of the target network (such as 192.168.1.0 / 24).

[0192] tp_dst=<dst_port>: Match the destination port (e.g. 8080).

[0193] actions=goto_table:36: After matching, jump to the flow table with table number 36.

[0194] Match traffic with TCP protocol, destination network CIDR, and destination port, and forward it to the flow table with table number 36.

[0195] (b) "table=36, priority=10, ip, in_port="vm_ofport"

[0196] actions=set_field:<storage_mac>->eth_dst, set_field:<nat_port_ip>-

[0197] >ip_src, goto_table:38"

[0198] table=36: The table number of the flow table is 36.

[0199] priority=10: The priority of the flow table is 10.

[0200] ip: Match the IP protocol.

[0201] in_port="vm_ofport": Match the input port as the port number of the virtual machine network card on OVS.

[0202] actions=set_field:<storage_mac>->eth_dst, set_field:<nat_port_ip>-

[0203] >ip_src, goto_table:38:

[0204] set_field:<storage_mac>->eth_dst: Set the destination MAC address to the storage MAC.

[0205] set_field:<nat_port_ip>->ip_src: Set the source IP address to the NAT port IP.

[0206] goto_table:38: After matching, jump to the flow table with table number 38.

[0207] Match the IP protocol, the input port is the virtual machine network card traffic, and modify the target MAC address and source IP address, and then forward to the flow table number 38.

[0208] (c) "table=38, priority=10, ct_state=+new-est-rel-inv+trk, ip actions=ct(commit, table=73, nat(src=<host_compute_ip>, random))"

[0209] table=38: The table number where the flow table is located is 38.

[0210] priority=10: The priority of the flow table is 10.

[0211] ct_state=+new-est-rel-inv+trk: Match the traffic with connection tracking state as new, established, related, invalid and tracking.

[0212] ip: Match the IP protocol.

[0213] actions=ct(commit, table=73, nat(src=<host_compute_ip>, random)):

[0214] ct(commit, table=73, nat(src=<host_compute_ip>, random)): Submit connection tracking information, and perform source NAT conversion to convert the source IP address to the compute node's compute internal IP, and then jump to the flow table number 73.

[0215] Match the IP traffic with connection tracking state as new, established, related, invalid and tracking, and perform source NAT conversion, and then forward to the flow table number 73.

[0216] (d) "table=37, priority=200, ip, nw_dst=<nat_port_ip>

[0217] actions=set_field:<vm_mac>->eth_dst, set_field:<vm_ip>

[0218] >ip_dst, goto_table:83"

[0219] table=37: The table number where the flow table is located is 37.

[0220] priority=200: the priority of the flow table is 200.

[0221] ip: match IP protocol.

[0222] nw_dst=<nat_port_ip>: match target IP address as NAT port IP.

[0223] actions=set_field:<vm_mac>->eth_dst,set_field:<vm_ip>->

[0224] >ip_dst,goto_table:83:

[0225] set_field:<vm_mac>->eth_dst: set target MAC address as cloud host's MAC.

[0226] set_field:<vm_ip>->ip_dst: set target IP address as cloud host's IP.

[0227] goto_table:83: after matching, jump to flow table with table number 83.

[0228] By matching IP traffic with target IP address as NAT port IP, and modifying target MAC address and target IP address, then forward to flow table with table number 83.

[0229] The purpose is to write a flow table generation and delivery module in the computing node, according to the eaccess table information in the database, to perform flow table delivery in Open vSwitch. By generating and delivering these flow tables, the control and forwarding of network traffic are realized, and it is ensured that cloud hosts can access storage resources according to access control rules.

[0230] By creating a flow table generation and delivery module in the computing node and defining the structure of the flow table, the forwarding rules of data packets can be effectively controlled. It can be ensured that Open vSwitch can correctly forward data packets according to the rules in the flow table, improving the flexibility and management efficiency of the network

[0231] In addition, in the network address translation (NAT) scenario, TCP timestamp (tcp_timestamps) may cause three-way handshake failure. In order to avoid this situation, tcp_timestamps can be turned off on the storage node.

[0232] tcp_timestamps: A kernel parameter to enable or disable TCP timestamps. TCP timestamps are used to calculate round-trip time (RTT) and prevent sequence number wraparound attacks. To disable TCP timestamps, set / proc / sys / net / ipv4 / tcp_timestamps to 0.

[0233] In addition, in the cloud resource pool console, creating a Virtual Private Cloud (VPC), a Subnet, and a Cloud Virtual Machine (VM) resource is a common operation.

[0234] A VPC is a logically isolated virtual network where users can create and manage their own network resources.

[0235] A Subnet is an IP address range within a VPC, used to divide network resources.

[0236] A Cloud Virtual Machine (VM) is a virtual machine instance in the cloud resource pool, where users can deploy and run applications. Creating a cloud host provides a virtual computing environment for users to deploy and run applications.

[0237] In the cloud resource pool console, creating a VPC, a Subnet, and a cloud host resource is a common operation. Through these steps, users can create a logically isolated virtual network environment and deploy and manage cloud hosts to meet different application requirements.

[0238] In the embodiment of the application, the cloud host initiates a first data access request message to the storage node of the cloud resource pool; the first data access request message includes a first IP address of the cloud host and a first target address; the virtual switch receives the first data access request message, and converts the first IP address of the cloud host in the first data access request message to a second IP address according to a data flow table, and then converts the second IP address of the cloud host to a computing internal network IP address of the computing node through connection tracking and network address translation (NAT) to obtain a second data access request message, and sends the second data access request message to the computing internal network gateway; the data flow table is generated according to a pre-set access control rule table; IP address conversion and NAT are performed through the virtual switch, which improves IO performance and avoids the IGW network element from becoming a link bottleneck.

[0239] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the core switch of the cloud resource pool is configured with a computing intranet gateway and a storage-forwarding network gateway, and the computing intranet and storage-forwarding network on the core switch are interconnected; data forwarding is performed directly through the virtual switch and the computing intranet gateway, which reduces the number of intermediate network element devices and reduces network latency and cost.

[0240] By directly sending data access request packets to storage nodes through the internal network gateway, network latency is further reduced. The storage nodes in the cloud resource pool then send response packets to the storage-forwarding network gateway; the storage-forwarding network gateway then directly sends the response packets to the cloud host, further reducing network latency and improving IO performance. Finally, the storage-forwarding network gateway sends the response packets to the cloud host. This enables more efficient and reliable storage access, meeting the high performance and high availability requirements of cloud computing environments.

[0241] The following is combined with Figure 2 The data access architecture involved in the embodiments of this application will be described as follows:

[0242] A virtual machine (VM) is a virtual operating system instance that runs on physical hardware. It allows multiple independent operating system instances to run on the same physical server, providing an isolated computing environment and supporting multi-tenancy and resource sharing.

[0243] The down interface (Dn-int) of a network interface is used to send data from network devices to terminal devices. It is responsible for the downlink transmission of data packets.

[0244] User space refers to the memory area where applications and user processes run, as opposed to kernel space. It provides the runtime environment for applications and allows them to interact with kernel space.

[0245] An external bridge (br-ext) is typically used to connect a virtual network to an external network, enabling communication between the two.

[0246] A Virtual Host User (VHU) is a user or administrator within a virtualization platform. They are responsible for managing and operating virtual hosts.

[0247] 5. Erase-top-options refer to the top-level options in a configuration or setting, used to control global behavior or advanced features. They provide both global configuration and advanced feature settings.

[0248] Patch: A patch refers to a piece of code that fixes or improves a software or system.

[0249] Network Address Translation (NAT) is used to convert private IP addresses to public IP addresses or to convert IP addresses between different networks. It implements address translation and network isolation.

[0250] Storage service refers to a system or platform that provides data storage and management functions. It provides data storage, backup, and recovery services.

[0251] Isolate: Isolation refers to separating different entities or resources to prevent interference with each other. It improves security and reliability.

[0252] Connection Tracking Limit (Ct-limit) is used to control the size and performance of the connection tracking table. It optimizes connection tracking performance and prevents resource exhaustion.

[0253] DPDK Bonding (Data Plane Development Kit Bonding) is used to bind multiple network interfaces together to improve bandwidth and reliability. It improves network performance and reliability.

[0254] Bridge Internal (br-int) is usually used to connect virtual machines in a virtual network. It enables communication between virtual machines.

[0255] Physical Network Interface Card (Phy-nic) is used to connect physical networks and provide physical network connections.

[0256] Kernel-space: Kernel-space refers to the memory area where the operating system kernel runs, responsible for managing hardware resources and providing system services. It provides underlying system services and resource management.

[0257] Three-layer underlay refers to a certain network architecture or protocol that provides network architecture or protocol support.

[0258] The data access architecture disclosed in the embodiments of the present application is used to provide application running environment, communication between virtual network and external network, isolated computing environment, global configuration, vulnerability repair, address translation, data storage and management, security and reliability, connection tracking performance optimization, network performance improvement, communication between virtual machines, physical network connection, underlying system services and resource management, etc.

[0259] Based on the aboveFigure 1 According to the data access method, the embodiment of the present application further provides a data access device. Figure 3 As shown in the figure, the data access device 300 can include:

[0260] The first sending module 310 is configured to initiate a first data access request message to a storage node of a cloud resource pool through a cloud host; the first data access request message includes a first IP address of the cloud host and a first target address;

[0261] The conversion module 320 is configured to receive the first data access request message through a virtual switch, and convert the first IP address of the cloud host in the first data access request message into a second IP address according to a data flow table, and then convert the second IP address of the cloud host into a computing intranet IP address of a computing node through connection tracking and network address translation (NAT), to obtain a second data access request message, and send the second data access request message to a computing intranet gateway; the data flow table is generated according to a pre-set access control rule table;

[0262] The second sending module 330 is configured to send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and a storage forwarding network gateway are configured on a core switch of the cloud resource pool, and the computing intranet and the storage forwarding network are connected on the core switch;

[0263] The third sending module 340 is configured to send a response message to the second data access request message to the storage forwarding network gateway through the storage node of the cloud resource pool;

[0264] The fourth sending module 350 is configured to send the response message to the cloud host through the storage forwarding network gateway.

[0265] In a possible embodiment, the data access device 300 can further include:

[0266] The configuration module is configured to configure the computing intranet gateway and the storage forwarding network gateway on the core switch;

[0267] The configuration module is further configured to configure the route of the computing intranet to the storage forwarding network and the route of the storage forwarding network to the computing intranet, so that the computing intranet and the storage forwarding network can communicate with each other.

[0268] In a possible embodiment, the data access device 300 can further include:

[0269] The increasing module is configured to increase the route of the network segment of the storage forwarding network on the computing node of the cloud resource pool, so that the computing node routes the traffic accessing the storage forwarding network to the computing intranet gateway, and the computing intranet gateway forwards the traffic to the storage forwarding network.

[0270] an increasing module, configured to increase routing of a network segment of the compute intranet on a storage node of the cloud resource pool, so that the storage node routes traffic accessing the compute intranet to a storage forwarding network gateway and forwarding by the storage forwarding network gateway to the compute intranet.

[0271] In a possible embodiment, the fourth sending module 350 is specifically configured to:

[0272] forwarding the response message to the compute node through the storage forwarding network gateway;

[0273] forwarding the response message to the cloud host through the compute node.

[0274] In a possible embodiment, the fourth sending module 350 is specifically configured to:

[0275] replacing the second target address in the response message with an IP address of a NAT port through the compute node, the IP address of the NAT port being an IP address converted from a port number of the virtual machine network card through a preset conversion algorithm;

[0276] replacing the IP address of the NAT port with an IP address of the cloud host according to the data flow table;

[0277] replacing a MAC address of the storage node with a MAC address of the cloud host according to the data flow table;

[0278] forwarding the response message to the cloud host based on the IP address of the cloud host and the MAC address of the cloud host.

[0279] In a possible embodiment, the data access apparatus 300 can further include:

[0280] a creating module, configured to create a cloud host access storage module on a cloud resource pool console, the cloud host access storage module being configured to control the cloud host to access storage resources through a specified storage service port; and the cloud host access storage module having an access control rule table stored in a database thereof;

[0281] The access control rule table includes the following fields:

[0282] a name of the access control rule;

[0283] a classless inter-domain routing CIDR of a target network, configured to indicate a range of the target network allowed to access;

[0284] a target port, configured to indicate a target port number allowed to access;

[0285] an IP version, configured to indicate an IP version to which the access control rule is applicable;

[0286] Protocol type, used to indicate the protocol to which the access control rule applies.

[0287] In a possible embodiment, the data access device 300 can further include:

[0288] A creation module, configured to create a flow table generation and delivery module in the computing node, the flow table generation and delivery module being configured to generate a flow table according to the access control rule table stored in the database, and to deliver the generated flow table to the Open vSwitch through the OpenFlow protocol;

[0289] The flow table includes the following fields:

[0290] Port number of the virtual machine network card on the virtual switch;

[0291] MAC address of the storage node;

[0292] IP address of the NAT port;

[0293] Computing intranet IP address of the computing node;

[0294] IP address of the cloud host;

[0295] MAC address of the cloud host.

[0296] In the embodiment, a first data access request message is initiated by the cloud host to the storage node of the cloud resource pool; the first data access request message includes a first IP address and a first target address of the cloud host; the first data access request message is received by the virtual switch, and the first IP address of the cloud host in the first data access request message is converted into a second IP address according to a data flow table, and then the second IP address of the cloud host is converted into a computing intranet IP address of the computing node through connection tracking and network address translation (NAT), to obtain a second data access request message, and the second data access request message is sent to the computing intranet gateway; the data flow table is generated according to a pre-set access control rule table; the IP address conversion and the NAT are performed by the virtual switch, which improves the IO performance and avoids the IGW network element from becoming a link bottleneck.

[0297] The second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing intranet gateway; the computing intranet gateway and the storage forwarding network gateway are configured on the core switch of the cloud resource pool, and the computing intranet and the storage forwarding network are connected on the core switch; the data is directly forwarded through the virtual switch and the computing intranet gateway, which reduces the number of intermediate network element devices and reduces the network delay and cost.

[0298] The data access request message is directly sent to the storage node through calculation of the intranet gateway, further reducing network delay. The response message for the second data access request message is sent to the storage forwarding network gateway through the storage node of the cloud resource pool; the response message is directly sent to the cloud host through the storage forwarding network gateway, further reducing network delay and improving IO performance. The response message is sent to the cloud host through the storage forwarding network gateway. In this way, more efficient and more reliable storage access can be realized, meeting the demand for high performance and high availability in a cloud computing environment.

[0299] Figure 4 A hardware structure schematic diagram of an electronic device provided by an embodiment of the present application is shown.

[0300] The electronic device can include a processor 401 and a memory 402 storing computer program instructions.

[0301] Specifically, the processor 401 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0302] The memory 402 can include a mass storage for data or instructions. By way of example and not limitation, the memory 402 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 402 can include removable or non-removable (or fixed) media. Where appropriate, the memory 402 can be internal or external to the integrated gateway disaster recovery device. In certain embodiments, the memory 402 is a non-volatile solid-state memory. In certain embodiments, the memory 402 includes read-only memory (ROM). Where appropriate, this ROM can be mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0303] The processor 401 reads and executes the computer program instructions stored in the memory 402 to implement Figure 1 any one of the data access methods in the illustrated embodiments.

[0304] In one example, the electronic device can further include a communication interface 404 and a bus 410. Among them, as Figure 4As shown, the processor 401, the memory 402, and the communication interface 404 are connected and communicate with each other through the bus 410.

[0305] The communication interface 404 is mainly used to realize the communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0306] The bus 410 includes hardware, software or both to couple components of the electronic device to each other. By way of example, and not limitation, the bus can include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or combination of two or more of these. Where appropriate, the bus 410 can include one or more buses. Although the present embodiments describe and show a particular bus, the present application contemplates any suitable bus or interconnect.

[0307] The electronic device can perform the data access method in the embodiments of the present application, thereby realizing the data access method described in combination Figure 2 with the data access method.

[0308] In addition, in combination with the data access method in the above embodiments, the embodiments of the present application can provide a computer readable storage medium to realize. The computer readable storage medium has computer program instructions stored thereon; the computer program instructions are executed by the processor to realize the data access method. Figure 1

[0309] It needs to be clear that the present application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0310] ​The functional blocks shown in the structural block diagrams described above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, functional cards, and the like. When implemented in software, the elements of the present application are program or code segments that are used to perform the required tasks. The program or code segments can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. A "machine-readable medium" includes any medium that can store or transport information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, and the like. The code segments can be downloaded via computer networks such as the Internet, intranets, and the like.

[0311] It should also be noted that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in an order different from that in the embodiments, or several steps can be performed simultaneously.

[0312] The above description is merely a specific implementation of the present application. Those skilled in the art can clearly understand the specific working processes of the above-described systems, modules and units based on the foregoing method embodiments for the convenience and brevity of description. It should be understood that the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A data access method, characterized by, The method comprises: initiating a first data access request message to a storage node of a cloud resource pool through a cloud host; the first data access request message comprises a first IP address of the cloud host and a first target address; receiving the first data access request message through a virtual switch, converting the first IP address of the cloud host in the first data access request message into a second IP address according to a data flow table, converting the second IP address of the cloud host into a computing internal network IP address of a computing node through connection tracking and network address translation (NAT), obtaining a second data access request message, and sending the second data access request message to a computing internal network gateway; the data flow table is generated according to a pre-set access control rule table; sending the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing internal network gateway; the computing internal network gateway and a storage forwarding network gateway are configured on a core switch of the cloud resource pool, and the computing internal network and the storage forwarding network are connected on the core switch; sending a response message to the storage forwarding network gateway through the storage node of the cloud resource pool in response to the second data access request message; sending the response message to the cloud host through the storage forwarding network gateway.

2. The method of claim 1, wherein, Before the second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing internal network gateway, the method further comprises: configuring the computing internal network gateway and the storage forwarding network gateway on the core switch; configuring a route of the computing internal network to the storage forwarding network and a route of the storage forwarding network to the computing internal network to enable the computing internal network and the storage forwarding network to communicate with each other.

3. The method of claim 1, wherein, Before the second data access request message is sent to the storage node of the cloud resource pool indicated by the first target address through the computing internal network gateway, the method further comprises: adding a route of a network segment of the storage forwarding network on the computing node of the cloud resource pool to route traffic accessing the storage forwarding network to the computing internal network gateway and to the storage forwarding network through the computing internal network gateway; adding a route of a network segment of the computing internal network on the storage node of the cloud resource pool to route traffic accessing the computing internal network to the storage forwarding network gateway and to the computing internal network through the storage forwarding network gateway.

4. The method of claim 1, wherein, The response message is forwarded to the cloud host through the storage forwarding network gateway, comprising: forwarding the response message to the computing node through the storage forwarding network gateway; forwarding the response message to the cloud host through the computing node.

5. The method of claim 4, wherein, The response message is forwarded to the cloud host through the computing node, comprising: replacing the second target address in the response message with an IP address of a NAT port through the computing node, the IP address of the NAT port being an IP address converted from a port number of a virtual machine network card through a preset conversion algorithm; replacing the IP address of the NAT port with an IP address of the cloud host according to the data flow table; replacing a MAC address of the storage node with a MAC address of the cloud host according to the data flow table; forwarding the response message to the cloud host based on the IP address of the cloud host and the MAC address of the cloud host.

6. The method of claim 1, wherein, The method further comprises: A cloud host access storage module is created in a cloud resource pool console, and the cloud host access storage module is used to control the cloud host to access the storage resource through a specified storage service port; a database of the cloud host access storage module stores an access control rule table; The access control rule table includes the following fields: A name of the access control rule; A classless inter-domain routing (CIDR) of a target network, used to indicate a target network range allowed to access; A target port, used to indicate a target port number allowed to access; An IP version, used to indicate an IP version to which the access control rule is applicable; A protocol type, used to indicate a protocol to which the access control rule is applicable.

7. The method of claim 6, wherein, The method further includes: A flow table generation and delivery module is created in the computing node, and the flow table generation and delivery module is used to generate a flow table according to the access control rule table stored in the database, and to deliver the generated flow table to an OpenvSwitch through an OpenFlow protocol; The flow table includes the following fields: A port number of a virtual machine network card on a virtual switch; A MAC address of a storage node; An IP address of a NAT port; A computing internal network IP address of a computing node; An IP address of a cloud host; A mac address of the cloud host.

8. A data access device, characterized by The data access apparatus includes: A first sending module, configured to initiate a first data access request message to a storage node of a cloud resource pool through a cloud host; the first data access request message includes a first IP address and a first target address of the cloud host; A conversion module, configured to receive the first data access request message through a virtual switch, and convert the first IP address of the cloud host in the first data access request message into a second IP address according to a data flow table, and then convert the second IP address of the cloud host into a computing internal network IP address of a computing node through connection tracking and network address translation (NAT) to obtain a second data access request message, and send the second data access request message to a computing internal network gateway; the data flow table is generated according to a pre-set access control rule table; A second sending module, configured to send the second data access request message to the storage node of the cloud resource pool indicated by the first target address through the computing internal network gateway; a computing internal network gateway and a storage forwarding network gateway are configured on a core switch of the cloud resource pool, and the computing internal network and the storage forwarding network are connected on the core switch; A third sending module, configured to send a response message to the second data access request message to the storage forwarding network gateway through the storage node of the cloud resource pool; A fourth sending module, configured to send the response message to the cloud host through the storage forwarding network gateway.

9. An electronic device, comprising: The electronic device includes a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the data access method of any one of claims 1-7.

10. A computer readable storage medium characterized by The computer readable storage medium stores computer program instructions, and the computer program instructions are executed by the processor to implement the data access method of any one of claims 1-7.

Images