Cross-virtual private cloud interconnection access method and device for private network NAT (Network Address Translation)

Abstract

The invention relates to a cloud computing network, and discloses a private network NAT cross-virtual private cloud interconnection access method and device, and the method is executed by a target NAT gateway. The target NAT gateway corresponds to a first tenant, and the method comprises the following steps: obtaining a binding request of a second tenant; the binding request is used for binding the port of the second tenant to the target NAT gateway; if the first tenant allows the binding request of the second tenant, recording a binding relationship; the binding relationship is used for indicating that the first tenant allows to select the port of the second tenant when configuring the access rule. According to the method and the system, flexible concurrent access among the tenants is realized, meanwhile, security isolation among private clouds is kept, and the network performance and expansibility are improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing network technology, and in particular to a private network NAT cross-virtual private cloud interconnection access method and device. Background Art

[0002] In the current technical status, the local VPC is accessed through cross-tenant access to the subnet IP in the central VPC. Although this solves the IP address conflict problem, it is impossible to directly use the IP of the VPC in the remote private network for SNAT and DNAT. It needs to rely on peer-to-peer connection, which increases network latency, reduces network bandwidth, affects network high availability, increases operation and maintenance difficulty, and may bring security risks. Peer connection provides high-speed point-to-point connection in the private network, does not require address translation, and has good security, but the number of connections is limited, requires a large bandwidth, is complex to configure, and cannot communicate without direct connection to the VPC. Private network NAT realizes one-to-many dynamic connection, is simple to configure, consumes little bandwidth, and achieves communication under VPC isolation, but does not support point-to-point static connection. Therefore, the existing technology has technical defects such as increased network latency, reduced network bandwidth, affected network high availability, increased operation and maintenance difficulty, increased security risks, and increased investment costs. Summary of the invention

[0003] In view of this, the present invention provides a private network NAT cross-virtual private cloud interconnection access method and device, which realizes flexible concurrent access across tenants, while maintaining secure isolation between private clouds, and improving network performance and scalability.

[0004] In the first aspect, the present invention provides a private network NAT cross-virtual private cloud interconnection access method, which is executed by a target NAT gateway; the target NAT gateway corresponds to a first tenant, and the method includes: obtaining a binding request from a second tenant; the binding request is used to bind the second tenant's port to the target NAT gateway; if the first tenant allows the second tenant's binding request, the binding relationship is recorded; the binding relationship is used to indicate that the first tenant is allowed to select the second tenant's port when configuring access rules.

[0005] In an optional implementation, the binding request includes: a local port and a remote NAT identifier.

[0006] In an optional implementation, if the first tenant allows the second tenant's binding request, then recording the binding relationship includes:

[0007] Send a port binding message to the first tenant; the port binding message includes a binding task ID and a policy ID;

[0008] A result message returned by the first tenant is received; the result message includes an allow / reject instruction and a corresponding reason code.

[0009] In an optional embodiment, the method further includes:

[0010] Establish a first mapping relationship; the first mapping relationship is used to indicate that the target port is mapped to the first port of the first host; the target port is the port of the second host; the first host is a host in the private network of the target NAT gateway;

[0011] Obtaining a first request message for accessing a target port;

[0012] According to the first mapping relationship, the target address of the first request message is converted to the first port of the first host, so as to forward the request message to the first host.

[0013] In an optional implementation, the source IP and source MAC in the outer Underlay header of the first request message are the physical network card information of the host sending the first request message; the source IP and source MAC in the inner Overlay header of the first request message are the gateway information of the subnet of the host sending the first request message.

[0014] In an optional embodiment, the method further includes:

[0015] Establishing a second mapping relationship; the second mapping relationship is used to map the source address from the third host to the external address;

[0016] Obtaining a second request message initiated by a third host to access an external network;

[0017] According to the second request message, the source IP and source MAC in the Overlay of the second request message are converted to an external address;

[0018] The converted source address is used and the virtual link of the host of the tenant where the target NAT gateway is located is encapsulated to forward the second request message.

[0019] In an optional implementation, the outer Underlay source address of the second request message after encapsulation is the physical network card information of the third host; the inner Overlay source address is the logical network card information of the third host.

[0020] In a second aspect, the present invention provides a private network NAT cross-virtual private cloud interconnection access device, the device comprising:

[0021] A request acquisition module, used to obtain a binding request of the second tenant; the binding request is used to bind the port of the second tenant to the target NAT gateway;

[0022] The binding record module is used to record the binding relationship if the first tenant allows the binding request of the second tenant; the binding relationship is used to indicate that the first tenant is allowed to select the port of the second tenant when configuring the access rule.

[0023] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute a private network NAT cross-virtual private cloud interconnection access method according to the first aspect or any corresponding implementation method thereof.

[0024] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute a private network NAT cross-virtual private cloud interconnection access method according to the first aspect or any corresponding implementation manner thereof.

[0025] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute a private network NAT cross-virtual private cloud interconnection access method according to the first aspect or any corresponding implementation method thereof.

[0026] The technical solution provided by the present invention may include the following beneficial effects:

[0027] A private network NAT cross-virtual private cloud interconnection access method provided by the present invention is executed by a target NAT gateway; the target NAT gateway corresponds to the first tenant. Obtaining the binding request of the second tenant, the binding request is used to bind the port of the second tenant to the target NAT gateway, which is the first step of cross-tenant access, laying the foundation for subsequent SNAT and DNAT operations, and realizing flexible resource allocation and dynamic network expansion. The first tenant approves the binding request of the second tenant to avoid unauthorized access and ensure the security of cross-tenant access. Recording the binding relationship provides a selection basis for the first tenant when configuring access rules. Through the binding relationship, the above scheme allows the first tenant to select the port of the second tenant when configuring the access rules, thereby realizing flexible concurrent access between tenants, while maintaining secure isolation between private clouds, and improving network performance and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 This is a flow chart of a private network NAT cross-virtual private cloud interconnection access method provided by an embodiment of the present invention;

[0030] Figure 2It is a flow chart showing binding of a port of a remote vpc of a control plane to a private network NAT of a local vpc according to an exemplary embodiment;

[0031] Figure 3 is a flow chart of a DNAT implementation method according to an exemplary embodiment;

[0032] Figure 4 is a flow chart of a SNAT implementation method according to an exemplary embodiment;

[0033] Figure 5 It is a structural diagram of a private network NAT cross-virtual private cloud interconnection access device provided by an embodiment of the present invention;

[0034] Figure 6 It is a structural schematic diagram of a computer device provided by an optional embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0036] It should be understood that the "indication" mentioned in the embodiments of the present invention can be a direct indication, an indirect indication, or an indication of an association relationship. For example, A indicating B can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association relationship between A and B.

[0037] In the description of the embodiments of the present invention, the term "corresponding" may indicate that there is a direct or indirect correspondence between two things, or an association relationship between the two things, or a relationship of indication and being indicated, configuration and being configured, and the like.

[0038] In an embodiment of the present invention, "predefinition" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in a device (for example, including a terminal device and a network device), and the present invention does not limit its specific implementation method.

[0039] According to an embodiment of the present invention, an embodiment of a private network NAT cross-virtual private cloud interconnection access method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0040] In this embodiment, a private network NAT cross-virtual private cloud interconnection access method is provided. Figure 1 is a flow chart of a private network NAT cross-virtual private cloud interconnection access method according to an embodiment of the present invention, such as Figure 1 As shown, the method is executed by the target NAT gateway; the target NAT gateway corresponds to the first tenant, and the process of the method includes the following steps:

[0041] Step S101, obtaining a binding request of a second tenant; the binding request is used to bind a port of the second tenant to a target NAT gateway.

[0042] A NAT (Network Address Translation) gateway is a network device used to perform address translation between a private network and a public network. NAT allows devices in an internal network (private network) to use private IP addresses, while translating these private IP addresses into public IP addresses when communicating with an external network (such as the Internet). In this embodiment, the target NAT gateway refers to the NAT gateway corresponding to the first tenant, which is used to process network address translation and access control related to the first tenant, and perform operations related to the first tenant.

[0043] The target NAT gateway receives a binding request from the second tenant. The binding request is used to bind the second tenant's port to the target NAT gateway. The first tenant can access the second tenant through the target NAT gateway without going through additional network elements or performing complex routing configuration. Among them, the first tenant refers to an independent entity that has its own private resources (such as virtual machines, servers, storage, etc.) in a network environment. The second tenant is another independent entity. Unlike the first tenant, the second tenant's resources may be located in a different virtual private cloud. The second tenant's port refers to the specific interface in the second tenant's private resources used for network communication.

[0044] Step S102: If the first tenant allows the second tenant's binding request, the binding relationship is recorded; the binding relationship is used to indicate that the first tenant is allowed to select the second tenant's port when configuring the access rule.

[0045] If the first tenant allows the second tenant's binding request, the target NAT gateway will record this binding relationship. A binding relationship is an association or mapping relationship established between the two after the first tenant allows the second tenant's binding request. The binding relationship indicates that when configuring access rules, the target NAT gateway allows the first tenant to select the second tenant's port as the access target, providing a secure and controllable channel for cross-tenant communication, clearly defining which ports can be accessed, as well as the permissions and conditions for access. The binding relationship helps maintain the security and stability of the network.

[0046] In summary, through the binding relationship, the first tenant can select the port of the second tenant when configuring the access rules, realizing flexible concurrent access across tenants, while maintaining the security isolation between private clouds and improving network performance and scalability.

[0047] Optionally, before the above step S101, based on the policy name, tenant ID and target NAT ID, confirm the policy ID. Wherein, the policy name is an identifier for identifying the target NAT gateway access policy. The tenant ID is an identifier for uniquely identifying the tenant requesting binding, ensuring that which tenant has initiated the binding request can be accurately identified. The target NAT ID is an identifier for uniquely identifying the target NAT gateway, indicating which NAT gateway is the target of the request for binding. The policy ID is a unique identifier generated after verifying and accepting the binding request, representing the record of this binding operation at the policy control level. This implementation method determines which tenants have the authority to bind to the target NAT gateway, and returns a policy ID to identify this binding operation, ensuring the security of network resources.

[0048] In an optional implementation, the binding request in the above step S101 includes: a local port and a remote NAT identifier.

[0049] The local port refers to the specific port that the second tenant wants to bind to the first tenant's NAT gateway. In network communications, a port is a logical address used to distinguish different services and applications. The remote NAT identifier is an identifier used to uniquely identify the first tenant's NAT gateway, including the NAT gateway's IP address, name, or other attributes that can uniquely identify the NAT gateway.

[0050] In this implementation, the local port specifies the specific port that the second tenant wishes to bind, and the remote NAT identifier is used to uniquely identify the NAT gateway of the first tenant, which is the basis for establishing a private network NAT binding relationship across tenants.

[0051] In an optional implementation, if the first tenant allows the second tenant's binding request in the above step S102, recording the binding relationship includes:

[0052] Step S1021, sending a port binding message to the first tenant; the port binding message includes a binding task ID and a policy ID.

[0053] The binding task ID is a unique identifier used to identify the current binding request and related processing flow. The policy ID is a unique identifier for the private network NAT access policy set by the first tenant. By providing the policy ID, it is possible to verify whether the second tenant's binding request complies with the access rules and security policies set by the first tenant. By providing the binding task ID and policy ID, the accuracy of the request is ensured.

[0054] Step S1022, receiving a result message returned by the first tenant; the result message includes an allow / reject instruction and a corresponding reason code.

[0055] The allow / reject instruction indicates whether the first tenant agrees to the second tenant's binding request. If the first tenant rejects the binding request, the reason code will provide the specific reason for the rejection. The second tenant can understand the reason for the rejection based on the reason code and may take corresponding measures to solve the problem or adjust the request. By receiving the allow / reject instruction and reason code, the validity of the binding relationship can be ensured and provide a basis for subsequent network communication.

[0056] like Figure 2 As shown in the figure, the process of binding the port of the remote vpc (private cloud) of the control plane to the local vpc private network NAT is as follows:

[0057] Tenant A and Tenant B are located in two VPCs respectively. Tenant A has private network NAT resources. Tenant B calls the private network NAT binding interface and requests to bind the port to Tenant A's NAT. The binding interface first verifies the policy and obtains policy information from Tenant A. It determines whether to accept the binding request legally based on the policy. If the verification and judgment pass, Tenant A is prompted to accept or reject the port binding to the private network NAT; if accepted, the binding relationship is recorded. Based on the recorded binding relationship, B's port can be selected when configuring access rules on Tenant A's NAT.

[0058] In an optional embodiment, the method further includes:

[0059] Step S201, establish a first mapping relationship; the first mapping relationship is used to indicate mapping the target port to the first port of the first host; the target port is the port of the second host; the first host is a host in the private network of the target NAT gateway.

[0060] A DNAT translation rule is defined, i.e., Destination Network Address Translation, which is a technology that converts the destination address of a data packet from an external address to an internal address. A first mapping relationship is established to guide the forwarding and address translation of data packets. This mapping relationship maps the destination port (i.e., the port of the second host) to the first port of the first host. The first host refers to the host in the private network of the target NAT gateway, and the destination port originally belongs to the port of the second host, but after mapping, the request to access the port will be redirected to the first port of the first host.

[0061] Step S202: Acquire a first request message for accessing a target port.

[0062] Gets network requests attempting to access a previously defined target port.

[0063] Step S203: According to the first mapping relationship, the target address of the first request message is converted to the first port of the first host, so as to forward the request message to the first host.

[0064] According to the mapping relationship established previously, the obtained request message is address translated and forwarded to the correct host. Specifically, the target address of the request message is modified from the original target port (the port of the second host) to the first port of the first host, and then the modified message is forwarded to the first host.

[0065] For example, Figure 3 As shown in the figure, a DNAT rule is established on the private network NAT-A instance, for example, mapping the target port Port-B:8080 to the internal host A:8080. Any request to access Port-B:8080 will be redirected by the NAT device to port 8080 of the internal host A. When host A (or other external host) initiates an access request to Port-B:8080, the request message will be obtained by the NAT device. On the NAT-A instance, according to the predefined DNAT rule (such as mapping Port-B:8080 to the internal host A:8080), the target address of the request message to access Port-B:8080 is converted to port 8080 of the internal host A. NAT-A then forwards the modified message to the internal host A, completing the end-to-end access request.

[0066] This implementation method is a complete process of DNAT conversion: first, a mapping relationship is established, then the access request is captured, and finally the address is converted and the request is forwarded according to the mapping relationship, so that external users can indirectly access the host in the private network of the NAT gateway by accessing a specific external port (target port) without directly exposing the real address of the internal host.

[0067] In an optional implementation, the source IP and source MAC in the outer Underlay header of the first request message are the physical network card information of the host sending the first request message; the source IP and source MAC in the inner Overlay header of the first request message are the gateway information of the subnet of the host sending the first request message.

[0068] The first request message is encapsulated into two layers during transmission: an outer layer (Underlay header) and an inner layer (Overlay header).

[0069] The source IP and source MAC of the outer layer (Underlay header) contain the physical network card information of the host that sent the first request message. The physical network card is the physical interface that the host directly connects to the network, with a unique MAC address and an IP address usually assigned by a subnet. This information is used for routing and forwarding at the bottom layer of the network (Underlay network) to ensure that the message can reach the correct next-hop device.

[0070] The source IP and source MAC in the inner layer (Overlay header) contain the gateway information of the subnet where the host that sent the first request message is located. In the Overlay network, messages are usually routed through logical gateways, which may not directly correspond to physical network devices. Therefore, the source IP and source MAC in the inner header are actually the logical representation of the subnet where the host is located in the Overlay network, which is used for routing and forwarding at the Overlay level.

[0071] The source IP and source MAC information in the outer Underlay header and inner Overlay header of the request message of this implementation mode are important identifiers when the message is transmitted and routed in the network. They together determine how the message is correctly processed and forwarded.

[0072] In an optional embodiment, the method further includes:

[0073] Step S301, establish a second mapping relationship; the second mapping relationship is used to map the source address from the third host to the external address.

[0074] SNAT, or Source Network Address Translation, is a technology that converts the source address of a data packet from an internal address to an external address. A second mapping relationship is recommended, mapping the source address from a third host (internal host) to an external address. When the third host accesses the external network, its real internal IP address is hidden and replaced by a public or external IP address, thereby achieving address translation and hiding.

[0075] Step S302: Acquire a second request message for accessing an external network initiated by a third host.

[0076] When the third host needs to access the external network, it sends a second request message, which includes the source IP address and source MAC address of the third host, as well as the target IP address and target MAC address.

[0077] Step S303: Convert the source IP and source MAC in the Overlay of the second request message to an external address according to the second request message.

[0078] After receiving the request message from the third host, the source IP address and source MAC address of the Overlay part of the request message are converted into an external address according to the second mapping relationship established previously. When the request message reaches the external network, the external network obtains the converted external address instead of the real internal address of the third host.

[0079] Step S304: Use the converted source address and encapsulate the virtual link of the host of the tenant where the target NAT gateway is located to forward the second request message.

[0080] After the address translation is completed, the converted request message is encapsulated with the virtual link information of the host of the tenant where the target NAT gateway is located, and the message is forwarded to ensure that the request message can correctly reach the target network or server through the virtual link.

[0081] For example, Figure 4 As shown in the figure, SNAT rule SNAT-1 is created on the private network NAT-A instance to map the source address from the internal host B (the third host) to the external address Port-C. Host B (the third host) initiates a request message to access the Internet. After the message reaches NAT-A, the source IP and MAC in the Overlay are converted to Port-C according to the SNAT-1 rule. NAT-A uses the converted source address Port-C and encapsulates the VLAN of host A to send the message across the VPC. The server on the Internet receives the request with the source address of Port-C and sends a response. The response message arrives at the public network interface of NAT-A, searches the session table, restores the original Overlay source address, and sends it to the internal host B. Host B receives the response message after SNAT conversion and completes the access.

[0082] This implementation is a SNAT process, which realizes the hiding and conversion of the source address when the internal host accesses the external network, and at the same time ensures the correct forwarding and reception of the request message.

[0083] In an optional implementation, the outer Underlay source address of the second request message after encapsulation is the physical network card information of the third host; the inner Overlay source address is the logical network card information of the third host.

[0084] The outer Underlay source address is used to identify the physical source of the message in the network. The outer Underlay source address is the physical network card information of the third host. The physical network card is the interface that the host directly connects to the physical network (such as Ethernet), and its address is usually the unique identifier of the host in the physical network.

[0085] The inner Overlay source address is used to logically identify the source of the message. In a cloud environment, an Overlay network is usually used to build a virtual network on top of a physical network to achieve VPC interconnection across physical networks. The inner Overlay source address is the logical network card information of the third host. The logical network card is the virtual interface of the host in the Overlay network. Its address is allocated within the Overlay network and is used to logically distinguish different VPCs and hosts.

[0086] This implementation reflects the address information of the message during encapsulation and transmission, as well as the role of this address information at the physical and logical network layers, to ensure secure and efficient transmission of messages between VPCs.

[0087] In the embodiment of the present invention, a download process control device is also provided, which is used to implement the above-mentioned embodiment and preferred implementation mode, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceivable.

[0088] The embodiment of the present invention provides a download process control device, Figure 5 : is a schematic diagram of a download process control device provided by an embodiment of the present invention, the device comprising:

[0089] The request acquisition module 501 is used to obtain the binding request of the second tenant; the binding request is used to bind the port of the second tenant to the target NAT gateway;

[0090] The binding recording module 502 is used to record the binding relationship if the first tenant allows the binding request of the second tenant; the binding relationship is used to indicate that the first tenant is allowed to select the port of the second tenant when configuring the access rule.

[0091] In an optional implementation, the request acquisition module 501 is further used to:

[0092] Local port and remote NAT identifier.

[0093] In an optional implementation, the binding record module 502 includes:

[0094] A first binding recording unit, configured to send a port binding message to the first tenant; the port binding message includes a binding task ID and a policy ID;

[0095] The second binding recording unit is used to receive a result message returned by the first tenant; the result message includes an allow / reject instruction and a corresponding reason code.

[0096] In an optional implementation, the device further includes a target mapping module, the target mapping module includes:

[0097] A first target mapping unit is used to establish a first mapping relationship; the first mapping relationship is used to indicate that the target port is mapped to the first port of the first host; the target port is the port of the second host; the first host is a host in the private network of the target NAT gateway;

[0098] A second target mapping unit, used for acquiring a first request message for accessing a target port;

[0099] The third target mapping unit is used to convert the target address of the first request message to the first port of the first host according to the first mapping relationship, so as to forward the request message to the first host.

[0100] In an optional implementation, the target mapping module is further configured to:

[0101] The source IP and source MAC in the outer Underlay header of the first request message are the physical network card information of the host sending the first request message; the source IP and source MAC in the inner Overlay header of the first request message are the gateway information of the subnet of the host sending the first request message.

[0102] In an optional implementation, the device further includes a source mapping module, the source mapping module including:

[0103] A first source mapping unit is used to establish a second mapping relationship; the second mapping relationship is used to map a source address from a third host to an external address;

[0104] A second source mapping unit, used for acquiring a second request message initiated by a third host to access an external network;

[0105] A third source mapping unit, configured to convert a source IP and a source MAC in the Overlay of the second request message to an external address according to the second request message;

[0106] The fourth source mapping unit is used to use the converted source address and encapsulate the virtual link of the host of the tenant where the target NAT gateway is located to forward the second request message.

[0107] In an optional implementation, the source mapping module is further configured to:

[0108] The outer Underlay source address of the second request message after encapsulation is the physical network card information of the third host; the inner Overlay source address is the logical network card information of the third host.

[0109] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0110] The download process control device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0111] The embodiment of the present invention also provides a computer device having the above Figure 5 A private network NAT cross-virtual private cloud interconnection access device is shown.

[0112] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display graphic information in a graphical user interface on an external input / output device (such as a display device coupled to the interface). In an optional embodiment, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0113] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0114] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0115] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required by at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In an optional embodiment, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0116] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0117] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0118] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0119] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0120] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A private network NAT cross-virtual private cloud interconnection access method, characterized in that: The method is performed by the target NAT gateway; The target NAT gateway corresponds to the first tenant, and the method includes: Obtaining a binding request of a second tenant; the binding request is used to bind the port of the second tenant to the target NAT gateway; If the first tenant allows the binding request of the second tenant, the binding relationship is recorded; the binding relationship is used to indicate that the first tenant is allowed to select the port of the second tenant when configuring the access rule.

2. The method according to claim 1, characterized in that The binding request includes: a local port and a remote NAT identifier.

3. The method according to claim 2, characterized in that If the first tenant allows the binding request of the second tenant, recording the binding relationship includes: Sending a port binding message to the first tenant; the port binding message includes a binding task ID and a policy ID; Receive a result message returned by the first tenant; the result message includes an allow / reject instruction and a corresponding reason code.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Establishing a first mapping relationship; the first mapping relationship is used to indicate mapping the target port to the first port of the first host; the target port is the port of the second host; the first host is a host in the private network of the target NAT gateway; Obtaining a first request message for accessing the target port; According to the first mapping relationship, the target address of the first request message is converted to the first port of the first host, so as to forward the request message to the first host.

5. The method according to claim 4, characterized in that The source IP and source MAC in the outer Underlay header of the first request message are the physical network card information of the host sending the first request message; the source IP and source MAC in the inner Overlay header of the first request message are the gateway information of the subnet of the host sending the first request message.

6. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Establishing a second mapping relationship; the second mapping relationship is used to map the source address from the third host to the external address; Obtaining a second request message initiated by a third host to access an external network; According to the second request message, convert the source IP and source MAC in the Overlay of the second request message to the external address; The converted source address is used and the virtual link of the host of the tenant where the target NAT gateway is located is encapsulated to forward the second request message.

7. The method according to claim 6, characterized in that The outer Underlay source address of the second request message after encapsulation is the physical network card information of the third host; the inner Overlay source address is the logical network card information of the third host.

8. A private network NAT cross-virtual private cloud interconnection access device, characterized in that: The device comprises: A request acquisition module, used to obtain a binding request of a second tenant; the binding request is used to bind the port of the second tenant to a target NAT gateway; A binding record module is used to record a binding relationship if the first tenant allows the second tenant's binding request; the binding relationship is used to indicate that the first tenant is allowed to select the second tenant's port when configuring access rules.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the private network NAT cross-virtual private cloud interconnection access method described in any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the private network NAT cross-virtual private cloud interconnection access method according to any one of claims 1 to 7.

Images