Service request method and device, distributed system, proxy gateway and storage medium

Abstract

The embodiment of the invention discloses a service request method and device, a distributed system, a proxy gateway and a storage medium, and relates to the technical field of cloud. Comprising the steps of receiving a first service access request sent by a switch; based on three-layer proxy configuration, performing three-layer proxy conversion on the first service access request to obtain a second service access request, the three-layer proxy configuration being used for indicating an address conversion mode of a source address and a destination address in the first service access request; and sending the second service access request to the switch, so that the switch sends the second service access request to the cloud center through the VPN channel, and the cloud center is used for performing address conversion on the second service access request through the load balancer to obtain a third service access request and forwarding the third service access request to the target cloud service. By adopting the method provided by the embodiment of the invention, the target cloud service provided by the cloud center can be accessed in the distributed cloud network mode without carrying out adaptive transformation on the service request end.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud technology, and in particular to a service request method, device, distributed system, proxy gateway and storage medium. Background Art

[0002] In the public cloud network mode, the service request end (Agent) is deployed in the cloud center, and through the three-layer direct mode, it can directly access the target cloud service (Service) provided by the cloud center.

[0003] With the development of cloud computing technology, in the distributed cloud network mode, the Agent originally deployed in the cloud center can be deployed in the customer's local computer room to improve data security. In the distributed cloud network mode, the Agent accesses the Service through VPN (Virtual Private Network). To ensure network security, the security group policy of the cloud center will restrict the access of the Agent. The Agent cannot access the Service in the three-layer direct mode, but needs to register the Service to the four-layer LB (Layer 4 Load Balancing) or seven-layer LB (Layer 7 Load Balancing) rules first, and then access the Service through VIP (Virtual IP address).

[0004] In order to apply the Agent suitable for the public cloud network model to the distributed cloud network model, in the related technology, the Agent can be adapted and modified so that the Agent can access the Service through the VIP.

[0005] However, adapting and modifying the Agent has many disadvantages. On the one hand, the modification workload and difficulty are very large because there are a large number of Agents and they cannot be omitted. On the other hand, after the modification, the Agent needs to maintain the architecture corresponding to the three-layer direct mode and VIP mode at the same time, which increases the difficulty of development and maintenance. On the other hand, the Agent needs to perceive the network differences in different cloud scenarios, which increases the coupling degree of the entire system. If a new network scenario appears, the Agent may need to be modified again. Summary of the invention

[0006] The embodiments of the present application provide a service request method, device, distributed system, proxy gateway and storage medium. The technical solution is as follows:

[0007] On the one hand, an embodiment of the present application provides a service request method applied to a distributed cloud, the method being used for a proxy gateway set in an edge node, the method comprising:

[0008] receiving a first service access request sent by a switch, wherein the switch is arranged in the edge node, and a BGP neighbor relationship is established between the switch and the proxy gateway, wherein the first service access request is sent by a service request end in the edge node and is used to request access to a target cloud service provided by a cloud center;

[0009] Based on a three-layer proxy configuration, performing a three-layer proxy conversion on the first service access request to obtain a second service access request, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request;

[0010] The second service access request is sent to the switch, so that the switch sends the second service access request to the cloud center through the VPN channel, and the cloud center is used to perform address translation on the second service access request through the load balancer to obtain a third service access request, and forward the third service access request to the target cloud service.

[0011] On the other hand, an embodiment of the present application provides a service request device applied to a distributed cloud, the device comprising:

[0012] A receiving module, configured to receive a first service access request sent by a switch, wherein the switch is arranged in an edge node and a BGP neighbor relationship is established between the switch and the proxy gateway, wherein the first service access request is sent by a service request end in the edge node and is used to request access to a target cloud service provided by a cloud center;

[0013] a conversion module, configured to perform a three-layer proxy conversion on the first service access request based on a three-layer proxy configuration to obtain a second service access request, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request;

[0014] A sending module is used to send the second service access request to the switch, so that the switch sends the second service access request to the cloud center through a VPN channel, and the cloud center is used to perform address translation on the second service access request through a load balancer to obtain a third service access request, and forward the third service access request to the target cloud service.

[0015] On the other hand, an embodiment of the present application provides a distributed system, comprising: an edge node and a cloud center, wherein the edge node is provided with a service request end, a switch and a proxy gateway, and the cloud center is deployed with a load balancer and a cloud service;

[0016] The service request end is used to send a first service access request to the switch, where the first service access request is used to request access to a target cloud service provided by the cloud center;

[0017] The switch is used to send the first service access request to the proxy gateway, wherein the switch and the proxy gateway have established a BGP neighbor relationship;

[0018] The proxy gateway is used to perform a three-layer proxy conversion on the first service access request based on a three-layer proxy configuration to obtain a second service access request, and send the second service access request to the switch, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request;

[0019] The switch is further used to send the second service access request to the load balancer of the cloud center through a VPN channel;

[0020] The load balancer is used to perform address translation on the second service access request to obtain a third service access request, and forward the third service access request to the target cloud service.

[0021] On the other hand, an embodiment of the present application provides a proxy gateway, which includes a processor and a memory; the memory stores at least one instruction, and the at least one instruction is used to be executed by the processor to implement the service request method applied to a distributed cloud as described in the above aspects.

[0022] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which at least one instruction is stored, and the instruction is loaded and executed by a processor to implement the service request method applied to a distributed cloud as described in the above aspects.

[0023] In the embodiment of the present application, the proxy gateway performs a three-layer proxy conversion on the first service access request based on the three-layer proxy configuration to obtain a second service access request, and can convert the destination address of the first service access request into the VIP corresponding to the LB rule of the target cloud service, thereby realizing the access of the service request end to the target cloud service in the distributed cloud network mode. By adopting the method of the embodiment of the present application, there is no need to adapt and transform the service request end Agent, which improves work efficiency. At the same time, the Agent does not need to perceive whether it is a public cloud network mode or a distributed cloud network mode, which ensures the uniformity of the Agent architecture. The same Agent does not need to maintain multiple sets of architectures separately, which greatly improves R&D efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 It is a schematic diagram of a service request end accessing a target cloud service through a three-layer direct mode in a public cloud network mode in the related art;

[0026] Figure 2 It is a schematic diagram of a service request end accessing a target cloud service through a VIP mode in a distributed cloud network mode in the related art;

[0027] Figure 3 is a flow chart of a service request method applied to a distributed cloud provided by an exemplary embodiment of the present application;

[0028] Figure 4 is a schematic diagram of a service request method applied to a distributed cloud provided by an exemplary embodiment of the present application;

[0029] Figure 5 is a timing diagram of a service request method provided by an exemplary embodiment of the present application;

[0030] Figure 6 is a schematic diagram of setting a timer corresponding to an access session provided by an exemplary embodiment of the present application;

[0031] Figure 7 is a schematic diagram of setting a timer corresponding to an access session provided by an exemplary embodiment of the present application;

[0032] Figure 8 is a schematic diagram of a distributed system provided by an exemplary embodiment of the present application;

[0033] Fig. 9 It is a structural block diagram of a service request device applied to a distributed cloud provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0035] Intelligent Traffic System (ITS), also known as Intelligent Transportation System, effectively and comprehensively applies advanced science and technology (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) to transportation, service control and vehicle manufacturing, strengthens the connection between vehicles, roads and users, and thus forms a comprehensive transportation system that ensures safety, improves efficiency, improves the environment and saves energy.

[0036] Cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0037] Public Cloud usually refers to a cloud provided by a third-party provider for users to use. Public Cloud is generally available through the Internet and may be free or low-cost. The core attribute of Public Cloud is shared resource services. There are many instances of this cloud, which can provide services throughout the open public network today.

[0038] Distributed Cloud is a public cloud computing service that runs public cloud infrastructure in multiple locations, such as cloud provider data centers, third-party data centers or hosting centers and local data centers, and manages everything from a single control platform.

[0039] In the related technology, in the public cloud network mode, the service request end (Agent) is deployed in the cloud center, and the service request end can directly access the target cloud service (Service) provided by the cloud center through the three-layer direct mode.

[0040] See also Figure 1 , Figure 1 It is a schematic diagram of a service request end accessing a target cloud service through a three-layer direct pass-through mode in a public cloud network mode in the related art.

[0041] like Figure 1 As shown, in the public cloud network mode, the parent machine pool 121 and the control 122 are both located in the cloud center 110. The parent machine pool 121 includes one or more service request terminals (such as Agent A and Agent B), and the control 122 includes one or more cloud services (such as Service A that provides services for Agent A, and Service B that provides services for Agent B).

[0042] In the public cloud network mode, the service request agent accesses the cloud service of the cloud center through the three-layer direct mode. Figure 1 As shown in the figure, Agent A accesses Service A through the underlay Layer 3 direct access mode, and Agent B accesses Service B through the underlay Layer 3 direct access mode.

[0043] With the development of cloud computing technology, in the distributed cloud network mode, the Agent originally deployed in the cloud center can be deployed in the customer's local computer room to improve data security.

[0044] In the distributed cloud network mode, the Agent accesses the Service through VPN (Virtual Private Network). To ensure network security, the cloud center's security group policy will restrict the Agent's access. The Agent cannot use the three-layer direct mode to access the Service. Instead, it needs to register the Service to the four-layer LB (Layer 4 Load Balancing) or seven-layer LB (Layer 7 Load Balancing) rules first, and then access the Service through VIP (Virtual IP address).

[0045] See also Figure 2 , Figure 2 It is a schematic diagram of a service request end accessing a target cloud service through a VIP mode in a distributed cloud network mode in the related art.

[0046] In the distributed cloud network mode, the service request end in the edge node 210 (such as Agent A and Agent B) cannot directly access the target cloud service (such as Service A and Service B) in the cloud center 220 using the three-layer direct mode. That is, the Agent in the public cloud network mode is not suitable for the distributed cloud network mode.

[0047] In related technologies, in order to enable the Agent to access the Service, the Agent needs to be adapted first. Specifically, the Service needs to be registered to the four-layer LB or seven-layer LB rules first, and then the Service is accessed through the VIP. The adapted Agent sends the access traffic to the security group through the VPN channel. If the security group policy is met, the load balancer (LB) distributes the access traffic to the corresponding Service according to the VIP.

[0048] However, adapting and modifying the Agent has many disadvantages. On the one hand, the modification workload and difficulty are very large because there are a large number of Agents and they cannot be omitted. On the other hand, after the modification, the Agent needs to maintain the architecture corresponding to the three-layer direct mode and VIP mode at the same time, which increases the difficulty of development and maintenance. On the other hand, the Agent needs to perceive the network differences in different cloud scenarios, which increases the coupling degree of the entire system. If a new network scenario appears, the Agent may need to be modified again.

[0049] Therefore, an embodiment of the present application proposes a service request method applied to a distributed cloud. By setting up a proxy gateway in an edge node, the target cloud service provided by the cloud center can be accessed in a distributed cloud network mode without adapting or modifying the Agent.

[0050] See also Figure 3 , Figure 3 1 is a flow chart of a service request method for a distributed cloud provided by an exemplary embodiment of the present application. In some embodiments, the method is used to set a proxy gateway in an edge node. The method includes the following steps.

[0051] Step 301, receiving a first service access request sent by a switch, the switch is set in an edge node, and a BGP neighbor relationship is established between the switch and the proxy gateway. The first service access request is sent by a service request end in the edge node to request access to a target cloud service provided by a cloud center.

[0052] A switch (SW) is a network device used for forwarding electrical (optical) signals. A switch can provide an exclusive electrical signal path for any two network nodes connected to the switch.

[0053] Optionally, the switch includes an Ethernet switch. The Ethernet switch works at the second layer (ie, data link layer) of the OSI network reference model (Open System Interconnection Reference Model), and is a network device that recognizes MAC (Media Access Control) addresses and forwards Ethernet data frames.

[0054] The first service access request is sent by a service request end in the edge node, and is used to request access to a target cloud service provided by the cloud center.

[0055] An edge node is a network node located at the edge of a distributed cloud system. An edge node can be a computer room or a physical device. The function of an edge node is to cache the source site content on the server of the edge node, thereby improving the speed and quality of end users' access to website content.

[0056] In some embodiments, the edge node includes one or more service request terminals (Agents).

[0057] Optionally, the service requester may be a client of an application.

[0058] The cloud center is a network node located in the center of a distributed cloud system, which is used to provide computing resources, storage resources and other services to edge nodes.

[0059] In some embodiments, the cloud center includes one or more cloud services.

[0060] The target cloud service refers to the cloud service that the service requester needs to access.

[0061] In some embodiments, the first service access request includes a source address (the request end address of the service request end) and a destination address (the cloud service address of the target cloud service). In some embodiments, the first service access request also includes source port, destination port, protocol and other related information.

[0062] See also Figure 4 , Figure 4 It is a schematic diagram of a service request method applied to a distributed cloud provided by an exemplary embodiment of the present application.

[0063] like Figure 4 As shown, the target cloud service that the service request end Agent A in the edge node needs to access is ServiceA, then Agent A can send a first service access request containing the address information of Service A to the switch SW; or, the target cloud service that the service request end Agent B in the edge node needs to access is Service B, then Agent B can send a first service access request containing the address information of Service B to the switch SW.

[0064] The switch and the proxy gateway have established a BGP neighbor relationship, where BGP (Border Gateway Protocol) is a distance vector routing protocol that enables reachable routes between autonomous systems and selects the best route. The BGP neighbor relationship refers to the connection relationship established between the switch and the proxy gateway by running the BGP protocol.

[0065] like Figure 4 In the example, a BGP neighbor relationship is established between the switch SW and the proxy gateway Proxy.

[0066] Step 302: Based on the three-layer proxy configuration, perform three-layer proxy conversion on the first service access request to obtain a second service access request. The three-layer proxy configuration is used to indicate the address conversion method of the source address and the destination address in the first service access request.

[0067] A layer 3 proxy refers to data exchange based on the IP address of the third layer (i.e., the network layer) in the OSI network reference model.

[0068] In some embodiments, the proxy gateway converts the destination address of the first service access request into the VIP (virtual IP address) corresponding to the LB rule (such as a four-layer or seven-layer load balancing rule) of the target cloud service based on the three-layer proxy configuration to obtain a second service access request.

[0069] The second service access request is a service access request obtained by the proxy gateway after performing a three-layer proxy conversion based on the first service access request. In some embodiments, the second service access request and the first service access request have different source addresses and destination addresses, but the data content of the access requests is the same.

[0070] The three-layer proxy configuration includes NAT configuration (Network Address Translation). In some embodiments, NAT includes DNAT (Destination Network Address Translation) and SNAT (Source Network Address Translation). DNAT is used to convert the target IP address of an external request to a specific IP address in the internal network, while SNAT is used to convert the source IP address in the internal network to an IP address routable to the public network.

[0071] In some embodiments, the address conversion mode of the source address includes the source address before conversion and the source address after conversion; the address conversion mode of the destination address includes the destination address before conversion and the destination address after conversion.

[0072] For details about the three-layer proxy configuration, see Figure 5 And the related description will not be repeated here.

[0073] Step 303, sending a second service access request to the switch, so that the switch sends the second service access request to the cloud center through the VPN channel, and the cloud center is used to perform address translation on the second service access request through the load balancer, obtain a third service access request, and forward the third service access request to the target cloud service.

[0074] A VPN tunnel sends data between two computer devices over a shared or public network in a way that simulates a point-to-point private link.

[0075] A load balancer is used to distribute the load among multiple computer devices (computer clusters), network connections, disk drives, or other resources to optimize resource usage, maximize throughput, minimize response time, and avoid overloading.

[0076] In some embodiments, the load balancer performs address translation on the second service access request based on layer-4 load balancing and layer-7 load balancing to obtain a third service access request, wherein the third service access request is a request obtained after performing address translation on the second service access request, and the destination address of the third service access request is the cloud service address of the corresponding target cloud service.

[0077] In the embodiment of the present application, the proxy gateway performs a three-layer proxy conversion on the first service access request based on the three-layer proxy configuration to obtain a second service access request, and can convert the destination address of the first service access request into the VIP corresponding to the LB rule of the target cloud service, thereby realizing the access of the service request end to the target cloud service in the distributed cloud network mode. By adopting the method of the embodiment of the present application, there is no need to adapt and transform the service request end Agent, which improves work efficiency. At the same time, the Agent does not need to perceive whether it is a public cloud network mode or a distributed cloud network mode, which ensures the uniformity of the Agent architecture. The same Agent does not need to maintain multiple sets of architectures separately, which greatly improves R&D efficiency.

[0078] To establish a BGP neighbor relationship between the proxy gateway and the switch, in some embodiments, before the proxy gateway receives the first service access request sent by the switch, it is necessary to perform BGP neighbor configuration on the proxy gateway and the switch.

[0079] In some embodiments, BGP neighbor configuration may be performed based on the neighbor gateway address of the proxy gateway in the BGP neighbor relationship, the neighbor switch address of the switch in the BGP neighbor relationship, and the neighbor authentication password.

[0080] Optionally, the neighbor gateway address is the IP address of the BGP neighbor network port established by the proxy gateway, recorded as P_IP; the neighbor switch address is the IP address of the BGP neighbor network port established by the switch, recorded as S_IP; the BGP neighbor authentication password is recorded as MY_PWD.

[0081] In some embodiments, BGP neighbor configuration may be performed on the proxy gateway and the switch based on the autonomous system S_AS corresponding to the switch, the autonomous system P_AS corresponding to the proxy gateway Proxy, and the maximum number of hops between BGP neighbors being MAX_NUM.

[0082] In some embodiments, the switch is configured as follows:

[0083] ROUTER BGPS_AS / / Configure the autonomous system S_AS corresponding to the switch;

[0084] BGP ROUTER-ID S_IP / / Configure the switch to create the IP address S_IP of the BGP neighbor network port;

[0085] NEIGHBOR P_IP REMOTE-AS P_AS / / Configure the autonomous system P_AS corresponding to the proxy gateway Proxy;

[0086] NEIGHBOR P_IP PASSWORD MY_PWD / / Configure BGP neighbor authentication password MY_PWD;

[0087] NEIGHBOR P_IP EBGP-MULTIHOP MAX_NUM / / Configure the maximum number of hops between BGP neighbors to MAX_NUM;

[0088] NEIGHBOR P_IP UPDATE-SOURCE S_IP / / Configure the proxy gateway to create a BGP neighbor network port with an IP address of P_IP, and configure the switch to create a BGP neighbor network port with an IP address of S_IP.

[0089] In some embodiments, the proxy gateway is configured as follows:

[0090] ROUTER BGP P_AS / / Configure the autonomous system P_AS corresponding to the proxy gateway;

[0091] BGP ROUTER-ID P_IP / / Configure the proxy gateway Proxy to create the IP address P_IP of the BGP neighbor network port;

[0092] NEIGHBOR S_IP REMOTE-AS S_AS / / Configure the autonomous system S_AS corresponding to the switch;

[0093] NEIGHBOR S_IP PASSWORD MY_PWD / / Configure BGP neighbor authentication password MY_PWD;

[0094] NEIGHBOR S_IP EBGP-MULTIHOP MAX_NUM / / Configure the maximum number of hops between BGP neighbors to MAX_NUM;

[0095] NEIGHBOR S_IP UPDATE-SOURCE P_IP / / Configure the switch to create a BGP neighbor network port with an IP address of S_IP, and configure the proxy gateway to create a BGP neighbor network port with an IP address of P_IP.

[0096] Through the above configuration, a BGP neighbor relationship can be established between the proxy gateway and the switch, so that the first service access request received by the switch can access the proxy gateway through BGP traffic absorption.

[0097] In some embodiments, in order to forward the first service access request to the target cloud service corresponding to the service request end, the proxy gateway needs to announce the network segment where the target cloud service is located.

[0098] In some embodiments, a network segment is declared for a target network segment, where the target network segment is a network segment where a target cloud service is located. The network segment declaration is used to instruct the switch to absorb traffic for a service access request to access the target cloud service.

[0099] For example, if the network segment of the target cloud service is XX.XX.XX.XX / XX, the configuration of network segment announcement for the target network segment in the proxy gateway Proxy is as follows:

[0100] NETWORK XX.XX.XX.XX / XX / / Announce the target network segment XX.XX.XX.XX / XX;

[0101] In this embodiment, by configuring BGP neighbors for the proxy gateway and the switch, a BGP neighbor relationship can be established between the proxy gateway and the switch; by announcing the target network segment to the proxy gateway, traffic accessing the target cloud service in the switch can be absorbed into the proxy gateway through BGP traffic absorption.

[0102] See also Figure 5 , Figure 5 It is a timing diagram of a service request method provided by an exemplary embodiment of the present application.

[0103] Figure 5 The process of Agent A accessing Service A is taken as an example, which includes 10 steps. Steps 1 to 5 are the process of Agent A sending a service access request to Service A; steps 6 to 10 are the process of Service A replying a service access response to Agent A.

[0104] Among them, the server address of Agent A is recorded as A_IP, the address of the proxy gateway Proxy is recorded as P_IP, the virtual address corresponding to the target cloud service Service A is recorded as VIP, and the cloud service address of the target cloud service Service A is recorded as RS_IP.

[0105] Step 1: Agent A sends a first service access request to the switch SW.

[0106] The source address of the first service access request is A_IP, and the target address is RS_IP.

[0107] Step 2: Since the switch SW and the proxy gateway Proxy have established a BGP neighbor relationship, and the destination address of the first service access request is within the network segment announced by the proxy gateway Proxy, the switch SW routes and forwards the first service access request to the proxy gateway Proxy.

[0108] That is, the proxy gateway Proxy performs BGP traffic absorption on the first service access request, the source address of the first service access request is A_IP, and the target address is RS_IP.

[0109] Step 3: The proxy gateway Proxy performs a three-layer proxy conversion on the first service access request based on the three-layer proxy configuration to obtain a second service access request. The three-layer proxy configuration is used to indicate the address conversion method of the source address and the destination address in the first service access request.

[0110] In some embodiments, the source address of the first service access request is a requester address of the service requester, and the destination address of the first service access request is a cloud service address of the target cloud service.

[0111] In some embodiments, the proxy gateway converts the cloud service address into a virtual address corresponding to the load balancing rule of the target cloud service based on the three-layer proxy configuration.

[0112] Optionally, the proxy gateway converts the cloud service address to a virtual address corresponding to the load balancing rule of the target cloud service through DNAT based on the three-layer proxy configuration.

[0113] In some embodiments, the proxy gateway converts the request end address into the gateway address of the proxy gateway based on the three-layer proxy configuration to obtain the second service access request.

[0114] Optionally, the proxy gateway converts the request end address into the gateway address of the proxy gateway through SNAT based on the three-layer proxy configuration to obtain the second service access request.

[0115] Assume that the cloud service address of the target cloud service is RS_IP, and the cloud service port is RS_PORT; Assume that the virtual address corresponding to the LB rule of the target cloud service is VIP; Assume that the IP address of the proxy gateway Proxy is P_IP,

[0116] In some embodiments, the following three-layer proxy configuration can be performed through iptables:

[0117] iptables -t nat -A PREROUTING -p tcp -d RS_IP --dport RS_PORT -j DNAT --to-destination VIP / / Convert the cloud service address to the virtual address corresponding to the load balancing rule of the target cloud service;

[0118] iptables -t nat -A POSTROUTING -p tcp -d VIP --dport RS_PORT -j SNAT --to-source P_IP / / Convert the request end address to the gateway address of the proxy gateway;

[0119] That is, the source address of the second service access request is P_IP, and the destination address is VIP.

[0120] The proxy gateway Proxy proposed in the embodiment of the present application needs to filter the service access request through the port, but does not convert the port, only converts the IP address, so it belongs to the three-layer network proxy.

[0121] After performing the three-layer proxy conversion, the address conversion method needs to be recorded for the subsequent corresponding reverse three-layer proxy conversion. In some embodiments, the proxy gateway can create an access session based on the five-tuple corresponding to the second service access request, and the access session includes the address conversion method of the source address and the destination address in the first service access request.

[0122] Assume that the IP of the target cloud service is RS_IP, the port of the target cloud service is RS_PORT, the virtual IP corresponding to the LB rule of the target cloud service is VIP, the IP of the proxy gateway Proxy is P_IP, the IP of the service request end Agent A is A_IP, and the port of the service request end Agent A is A_PORT;

[0123] After the Proxy completes DNAT and SNAT, it will record the access session.

[0124] For example, the five-tuple (source address, source port, destination address, destination port, protocol) is (P_IP, A_PORT, VIP, RS_PORT, TCP), and the recorded access session can be:

[0125] DNAT: RS_IP->VIP / / represents the address conversion method of the destination address in the first service access request;

[0126] SANT:A_IP->P_IP / / represents the address conversion method of the source address in the first service access request.

[0127] In step 3, the proxy gateway receives the first service access request sent by the switch SW, and performs a three-layer proxy translation (DNAT / SNAT) on the first service access request to obtain a second service access request. At the same time, the proxy gateway creates an access session to record the address translation method of the source address and the destination address in the first service access request.

[0128] In some embodiments, the proxy gateway Proxy sends the second service access request to the switch SW, so that the switch SW sends the second service access request to the cloud center through the VPN channel.

[0129] Step 4: The second service access request reaches the cloud center through the VPN channel. If the security group policy is met ( Figure 5 The security group is not shown in the figure), and is forwarded to the load balancer LB via the exchange route.

[0130] The source address of the second service access request is P_IP, and the destination address is VIP.

[0131] Step 5: After receiving the second service access request, the load balancer LB performs DNAT and SNAT on the second service access request and records the access session. In the third service access request after DNAT and SNAT, the source address is V_IP and the destination address is RS_IP.

[0132] The third service access request is forwarded by the load balancer LB to the target cloud service Service A through routing.

[0133] During the process of traffic returning, the proxy gateway receives the second service access response sent by the switch.

[0134] The second service access response is performed by the load balancer to perform address translation on the first service access response sent by the target cloud service, and is sent to the switch through the VPN channel. The first service access response is the response of the target cloud service to the third service access request.

[0135] Exemplarily, the third service access request is a calculation request, and the first service access response is a corresponding calculation result response.

[0136] Step 6: After the target cloud service Service A processes the third service access request, it forwards the first service access response to the load balancer LB.

[0137] The source address of the first service access response is RS_IP, and the destination address is V_IP.

[0138] Step 7: The load balancer LB receives the first service access response, and performs reverse DNAT and reverse SNAT on the first service access response based on the access session recorded by the load balancer LB in step 5 to obtain a second service access response.

[0139] The source address of the second service access response is V_IP, and the destination address is P_IP.

[0140] Step 8: The second service access response reaches the edge node via the VPN channel and is routed and forwarded to the proxy gateway Proxy via the switch SW.

[0141] In some embodiments, after receiving the second service access response sent by the switch, the proxy gateway determines an access session matching the second service feedback (ie, the access session created in step 3) based on the quintuple corresponding to the second service access response.

[0142] In some embodiments, the proxy gateway performs reverse layer-3 proxy conversion on the second service access response based on the access session to obtain a third service access response.

[0143] The address conversion method of the destination address and the source address in the reverse three-layer proxy conversion is opposite to the address conversion method of the source address and the destination address in the three-layer proxy conversion.

[0144] Step 9: After receiving the second service access response, the proxy gateway Proxy determines the access session created in step 3 according to the five-tuple corresponding to the second service access response, and based on the access session, performs reverse three-layer proxy conversion on the second service access response to obtain a third service access response.

[0145] The access session created in step 3 is as follows:

[0146] DNAT: RS_IP->VIP / / represents the address conversion method of the destination address in the first service access request;

[0147] SANT:A_IP->P_IP / / represents the address conversion method of the source address in the first service access request.

[0148] The five-tuple of the second service access response arriving at the proxy gateway Proxy is (VIP, RS_PORT, P_IP, A_PORT, TCP).

[0149] In some embodiments, the source address of the second service access response is a virtual address, and the destination address of the second service access response is a gateway address;

[0150] In some embodiments, the proxy gateway can convert the gateway address into the request end address based on the address conversion method contained in the access session; convert the virtual address into the cloud service address based on the address conversion method contained in the access session to obtain a third service access response.

[0151] Since the source and destination are reversed during traffic access and traffic return, after matching the above access session according to the five-tuple, reverse NAT is performed on the second service access response;

[0152] DNAT: P_IP->A_IP / / represents the address conversion method of the destination address in the second service access request;

[0153] SANT:VIP->RS_IP / / represents the address conversion method of the source address in the second service access request.

[0154] The quintuple corresponding to the third service access response obtained after conversion is: (RS_IP, RS_PORT, A_IP, A_PORT, TCP).

[0155] Among them, the source address in the third service access response is RS_IP, and the destination address is A_IP.

[0156] In some embodiments, the proxy gateway sends the third service access response to the switch, so that the switch forwards the third service access response to the service requester. That is, the proxy gateway Proxy forwards the third service access response to the switch SW.

[0157] Step 10: The switch SW routes and forwards the third service access response to Agent A.

[0158] In this embodiment, after performing address conversion, the proxy gateway Proxy and the load balancer LB can record the address conversion method by creating an access session, so that in the process of traffic return, reverse address conversion can be performed based on the access session, thereby realizing the service access response corresponding to the service access request being replied to the service request end.

[0159] In some embodiments, in order to ensure accurate and timely routing and forwarding of service access requests and service access responses, in some embodiments, after creating an access session based on the five-tuple corresponding to the second service access request, the proxy gateway can set a timer corresponding to the access session; if the second service access response is not received within the timing duration of the timer, the proxy gateway re-sends the second service access request to the switch to avoid the situation where the second service access response fails to be received.

[0160] Optionally, the timing duration of the timer may be a preset fixed value.

[0161] Optionally, the timing duration of the timer may also be determined based on the data volume of the second service access request.

[0162] See also Figure 6 , Figure 6 It is a schematic diagram of setting a timer corresponding to an access session provided by an exemplary embodiment of the present application.

[0163] like Figure 6 As shown, after creating the access session in step 3, the proxy gateway can execute step 3.1.

[0164] Step 3.1: Set the timer corresponding to the access session.

[0165] For example only, the timing duration of the timer is 1 minute.

[0166] If the second service access response is not received within the timing duration of the timer, the proxy gateway may execute step 7.1.

[0167] Step 7.1: If no second service access response is received within the timing duration of the timer, the proxy gateway resends the second service access request to the switch.

[0168] Similarly, when executing step 7.1, the second service access request is sent to the cloud center again through the VPN, and the address is re-translated by the load balancer LB when the security group policy is met, and the third service access request is obtained and sent to the target cloud service ( Figure 6 not shown).

[0169] In some embodiments, after creating an access session based on the five-tuple corresponding to the second service access request, the proxy gateway may also set a timer corresponding to the access session; upon receiving the second service access response and the timing duration of the timer is greater than the duration threshold, the proxy gateway resends the second service access request to the switch to avoid a situation where the second service access response is unreliable due to the response duration being too long.

[0170] The timer is used to record the time interval from sending the second service access request to receiving the second service access response.

[0171] See also Figure 7 , Figure 7 It is a schematic diagram of setting a timer corresponding to an access session provided by an exemplary embodiment of the present application.

[0172] like Figure 7 As shown, after creating the access session in step 3, the proxy gateway can execute step 3.2.

[0173] Step 3.2: Set a timer corresponding to the access session. The timer is used to record the time interval between sending the second service access request and receiving the second service access response, that is, the time interval between step 3 and step 8.

[0174] For example only, the timer is set to 3 minutes.

[0175] When the second service access response is received and the timing duration of the timer is greater than the duration threshold, the proxy gateway may execute step 8.1.

[0176] Step 8.1: When receiving the second service access response and the timing duration of the timer is greater than the duration threshold, the proxy gateway resends the second service access request to the switch.

[0177] Similarly, when executing step 8.1, the second service access request is sent to the cloud center again through the VPN, and the address is re-translated by the load balancer LB when the security group policy is met, and the third service access request is obtained and sent to the target cloud service ( Figure 7 not shown).

[0178] In this embodiment, after the proxy gateway creates an access session, it can avoid the situation where the second service access response cannot be received by setting a timer; by setting a timer, it can avoid the situation where the second service access response is unreliable due to the response time being too long, thereby improving the accuracy of the service request.

[0179] The present application also provides a distributed system. Figure 8 , Figure 8 It is a schematic diagram of a distributed system provided by an exemplary embodiment of the present application.

[0180] The distributed system 801 includes: an edge node 811 and a cloud center 812. The edge node 811 is provided with a service request end (such as Agent A and Agent B), a switch SW and a proxy gateway Proxy. The cloud center 812 is deployed with a load balancer LB and cloud services (such as Service A and Service B).

[0181] The service request end is used to send a first service access request to the switch, where the first service access request is used to request access to a target cloud service provided by the cloud center;

[0182] The switch SW is used to send the first service access request to the proxy gateway, wherein a BGP neighbor relationship is established between the switch and the proxy gateway;

[0183] The proxy gateway Proxy is used to perform a three-layer proxy conversion on the first service access request based on a three-layer proxy configuration to obtain a second service access request, and send the second service access request to the switch, and the three-layer proxy configuration is used to indicate the address conversion method of the source address and the destination address in the first service access request;

[0184] The switch SW is further used to send the second service access request to the load balancer of the cloud center through the VPN channel;

[0185] The load balancer LB is used to perform address translation on the second service access request to obtain a third service access request, and forward the third service access request to the target cloud service.

[0186] It should be noted that the above embodiment only illustrates the general architecture of a distributed cloud system. The system may also include more or fewer components, or combine certain components (for example, the security group and the load balancer may be merged into the same component), and this embodiment does not constitute a limitation on this.

[0187] See also Fig. 9 , Fig. 9 This is a structural block diagram of a service request device applied to a distributed cloud provided by an exemplary embodiment of the present application. The device includes:

[0188] The receiving module 901 is used to receive a first service access request sent by a switch, wherein the switch is arranged in an edge node and a BGP neighbor relationship is established between the switch and the proxy gateway, wherein the first service access request is sent by a service request end in the edge node and is used to request access to a target cloud service provided by a cloud center;

[0189] A conversion module 902 is used to perform a three-layer proxy conversion on the first service access request based on a three-layer proxy configuration to obtain a second service access request, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request;

[0190] The sending module 903 is used to send the second service access request to the switch, so that the switch sends the second service access request to the cloud center through the VPN channel, and the cloud center is used to perform address conversion on the second service access request through the load balancer to obtain a third service access request, and forward the third service access request to the target cloud service.

[0191] Optionally, the source address of the first service access request is the request end address of the service request end, and the destination address of the first service access request is the cloud service address of the target cloud service; the conversion module 902 is used to:

[0192] Based on the three-layer proxy configuration, convert the cloud service address into a virtual address corresponding to the load balancing rule of the target cloud service;

[0193] Based on the three-layer proxy configuration, the request end address is converted into the gateway address of the proxy gateway to obtain the second service access request.

[0194] Optionally, the conversion module 902 is used to:

[0195] Creating an access session based on the five-tuple corresponding to the second service access request, wherein the access session includes an address conversion mode of a source address and a destination address in the first service access request;

[0196] receiving a second service access response sent by the switch, where the second service access response is obtained by the load balancer performing address translation on the first service access response sent by the target cloud service and sending the second service access response to the switch through the VPN channel, where the first service access response is a response of the target cloud service to the third service access request;

[0197] Determining, based on the quintuple corresponding to the second service access response, the access session matching the second service feedback;

[0198] Based on the access session, performing reverse layer-3 proxy conversion on the second service access response to obtain a third service access response;

[0199] The third service access response is sent to the switch, so that the switch forwards the third service access response to the service request end.

[0200] Optionally, the source address of the second service access response is the virtual address, and the destination address of the second service access response is the gateway address. The conversion module 902 is used to:

[0201] Based on the address conversion mode included in the access session, convert the gateway address into the request end address;

[0202] Based on the address conversion mode included in the access session, the virtual address is converted into the cloud service address to obtain the third service access response.

[0203] Optionally, the device further includes a resending module, the resending module being configured to:

[0204] Setting a timer corresponding to the access session;

[0205] If the second service access response is not received within the timing duration of the timer, the second service access request is resent to the switch.

[0206] Optional, resend module for:

[0207] Setting a timer corresponding to the access session; the timer is used to record the time interval from sending the second service access request to receiving the second service access response;

[0208] When the second service access response is received and the timing duration of the timer is greater than the duration threshold, the second service access request is resent to the switch.

[0209] Optionally, the device further includes a configuration module, the configuration module being configured to:

[0210] Perform BGP neighbor configuration based on the neighbor gateway address of the proxy gateway in the BGP neighbor relationship, the neighbor switch address of the switch in the BGP neighbor relationship, and the neighbor authentication password;

[0211] A network segment is declared for a target network segment, where the target network segment is a network segment where the target cloud service is located, and the network segment declaration is used to instruct the switch to absorb traffic for a service access request to access the target cloud service.

[0212] An embodiment of the present application provides a proxy gateway, which includes a processor and a memory; the memory stores at least one instruction, and the at least one instruction is used to be executed by the processor to implement the service request method applied to a distributed cloud as described in the above aspects.

[0213] In some embodiments, the proxy gateway is arranged in the edge node. In some embodiments, the proxy gateway is used to receive a first service access request sent by the switch, and based on the three-layer proxy configuration, perform a three-layer proxy conversion on the first service access request to obtain a second service access request.

[0214] An embodiment of the present application provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor to implement the service request method applied to a distributed cloud as described in the above aspects.

[0215] Optionally, the computer readable storage medium may include: ROM, RAM, solid state drives (SSD) or optical disks, etc. Among them, RAM may include resistance random access memory (ReRAM) and dynamic random access memory (DRAM).

[0216] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A service request method applied to a distributed cloud, characterized in that: The method is used to set a proxy gateway in an edge node, and the method includes: receiving a first service access request sent by a switch, wherein the switch is arranged in the edge node, and a BGP neighbor relationship is established between the switch and the proxy gateway, wherein the first service access request is sent by a service request end in the edge node and is used to request access to a target cloud service provided by a cloud center; Based on a three-layer proxy configuration, performing a three-layer proxy conversion on the first service access request to obtain a second service access request, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request; The second service access request is sent to the switch, so that the switch sends the second service access request to the cloud center through the VPN channel, and the cloud center is used to perform address translation on the second service access request through the load balancer to obtain a third service access request, and forward the third service access request to the target cloud service.

2. The method according to claim 1, characterized in that The source address of the first service access request is the request end address of the service request end, and the destination address of the first service access request is the cloud service address of the target cloud service; The performing three-layer proxy conversion on the first service access request based on the three-layer proxy configuration to obtain a second service access request includes: Based on the three-layer proxy configuration, convert the cloud service address into a virtual address corresponding to the load balancing rule of the target cloud service; Based on the three-layer proxy configuration, the request end address is converted into the gateway address of the proxy gateway to obtain the second service access request.

3. The method according to claim 2, characterized in that The method further comprises: Creating an access session based on the five-tuple corresponding to the second service access request, wherein the access session includes an address conversion mode of a source address and a destination address in the first service access request; receiving a second service access response sent by the switch, where the second service access response is obtained by the load balancer performing address translation on the first service access response sent by the target cloud service and is sent to the switch through the VPN channel, where the first service access response is a response of the target cloud service to the third service access request; Determining, based on the quintuple corresponding to the second service access response, the access session matching the second service feedback; Based on the access session, performing reverse layer-3 proxy conversion on the second service access response to obtain a third service access response; The third service access response is sent to the switch, so that the switch forwards the third service access response to the service request end.

4. The method according to claim 3, characterized in that: The source address of the second service access response is the virtual address, and the destination address of the second service access response is the gateway address; The performing reverse layer-3 proxy conversion on the second service access response based on the access session to obtain a third service access response includes: Based on the address conversion mode included in the access session, convert the gateway address into the request end address; Based on the address conversion mode included in the access session, the virtual address is converted into the cloud service address to obtain the third service access response.

5. The method according to claim 3, characterized in that: After creating the access session based on the five-tuple corresponding to the second service access request, the method further includes: Setting a timer corresponding to the access session; If the second service access response is not received within the timing duration of the timer, the second service access request is resent to the switch.

6. The method according to claim 3, characterized in that After creating the access session based on the five-tuple corresponding to the second service access request, the method further includes: Setting a timer corresponding to the access session; the timer is used to record the time interval from sending the second service access request to receiving the second service access response; When the second service access response is received and the timing duration of the timer is greater than the duration threshold, the second service access request is resent to the switch.

7. The method according to any one of claims 1 to 6, characterized in that: Before receiving the first service access request sent by the switch, the method further includes: Perform BGP neighbor configuration based on the neighbor gateway address of the proxy gateway in the BGP neighbor relationship, the neighbor switch address of the switch in the BGP neighbor relationship, and the neighbor authentication password; A network segment is declared for a target network segment, where the target network segment is a network segment where the target cloud service is located, and the network segment declaration is used to instruct the switch to absorb traffic for a service access request to access the target cloud service.

8. A distributed system, characterized in that: The distributed system includes: an edge node and a cloud center, wherein the edge node is provided with a service request end, a switch and a proxy gateway, and the cloud center is deployed with a load balancer and a cloud service; The service request end is used to send a first service access request to the switch, where the first service access request is used to request access to a target cloud service provided by the cloud center; The switch is used to send the first service access request to the proxy gateway, wherein the switch and the proxy gateway have established a BGP neighbor relationship; The proxy gateway is used to perform a three-layer proxy conversion on the first service access request based on a three-layer proxy configuration to obtain a second service access request, and send the second service access request to the switch, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request; The switch is further used to send the second service access request to the load balancer of the cloud center through a VPN channel; The load balancer is used to perform address translation on the second service access request to obtain a third service access request, and forward the third service access request to the target cloud service.

9. A service request device applied to a distributed cloud, characterized in that: The device comprises: A receiving module, configured to receive a first service access request sent by a switch, wherein the switch is arranged in an edge node and a BGP neighbor relationship is established between the switch and the proxy gateway, wherein the first service access request is sent by a service request end in the edge node and is used to request access to a target cloud service provided by a cloud center; a conversion module, configured to perform a three-layer proxy conversion on the first service access request based on a three-layer proxy configuration to obtain a second service access request, wherein the three-layer proxy configuration is used to indicate an address conversion method of a source address and a destination address in the first service access request; A sending module is used to send the second service access request to the switch, so that the switch sends the second service access request to the cloud center through a VPN channel, and the cloud center is used to perform address translation on the second service access request through a load balancer to obtain a third service access request, and forward the third service access request to the target cloud service.

10. A proxy gateway, characterized in that: The proxy gateway includes a processor and a memory; the memory stores at least one instruction, and the at least one instruction is used to be executed by the processor to implement the service request method applied to a distributed cloud as described in any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the instruction is loaded and executed by the processor to implement the service request method applied to a distributed cloud as described in any one of claims 1 to 7.

Images