A method, apparatus, device, and medium for managing security groups on cloud physical hosts.

Abstract

This application discloses a method, apparatus, device, and medium for managing security groups on cloud physical hosts, relating to the computer field. The method includes: monitoring a first message and a second message based on a security group service plugin and a security group service agent, respectively; when the security group service plugin detects the first message, it obtains the first target information corresponding to the first message and sends it to the security group service agent, so that the agent determines the first target security group and sends the first target security group to the physical switch, causing the physical switch to update its own security group rules to manage the security groups of the cloud physical hosts; when the security group service agent detects the second message, it obtains the second target information corresponding to the second message and sends a database information request to the security group service plugin to obtain database information, determines the second target security group based on the database information, and sends it to the physical switch, causing the physical switch to update its own security group rules to manage the security groups of the cloud physical hosts.

Description

Technical Field

[0001] This application relates to the field of computers, and in particular to a method, apparatus, device and medium for managing security groups on cloud physical hosts. Background Technology

[0002] With the development of cloud platform technology, cloud physical host services are becoming increasingly popular among users because they can provide users with computing and network resources similar to those of traditional physical servers. Cloud physical host security groups have also gradually become a key security technology in cloud platform security. As a type of cloud platform firewall technology, it is used to control network access traffic entering and leaving cloud physical hosts.

[0003] Currently, in cloud platform environments based on OpenStack (an open-source cloud computing management platform project), the neutron component responsible for virtual network services does not support the management and configuration of cloud physical host security groups. This severely restricts the application scenarios and business scope of cloud physical host services and greatly reduces the user experience of cloud platforms. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for managing cloud physical host security groups, capable of managing and configuring cloud physical host security groups. The specific solution is as follows:

[0005] Firstly, this application provides a cloud physical host security group management method applied to a cloud platform, wherein the cloud platform includes a preset security group service plugin and a preset security group service agent, and the cloud physical host security group management method includes:

[0006] The first and second messages are monitored based on the preset security group service plugin and the preset security group service agent, respectively.

[0007] When the preset security group service plugin detects the first message, it obtains the first target information corresponding to the first message and sends the first target information to the preset security group service agent, so that the preset security group service agent can determine the first target security group based on the first target information and send the first target security group to the physical switch, so that the physical switch can update its own security group rules based on the first target security group in order to manage the security group of the cloud physical host.

[0008] When the preset security group service agent detects the second message, it obtains the second target information corresponding to the second message and sends a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin. Based on the second target information and the database information, it determines the second target security group and sends the second target security group to the physical switch so that the physical switch updates its own security group rules based on the second target security group to manage the security group of the cloud physical host.

[0009] Optionally, the monitoring of the first message and the second message based on the preset security group service plugin and the preset security group service agent includes:

[0010] Control the startup of the preset security group service plugin and the preset security group service proxy, and bind the preset security group service plugin and the preset security group service proxy to the first function and the second function respectively;

[0011] The first message is monitored based on the first function bound to the preset security group service plugin, and the second message is monitored based on the second function bound to the preset security group service agent.

[0012] Optionally, the first message includes a virtual network adapter deletion message; the second message includes a virtual network adapter update message, a security group deletion message, a security group update message, a security group rule deletion message, and a security group rule update message.

[0013] Optionally, the first target information includes the port identifier, Internet Protocol address, security group identifier, and physical address corresponding to the deleted virtual network interface card.

[0014] Optionally, the preset security group service proxy determines a first target security group based on the first target information and sends the first target security group to the physical switch, including:

[0015] The preset security group service agent determines whether the virtual network card corresponding to the first target information is a network card of the cloud physical host based on the first target information;

[0016] If the virtual network interface card is a network interface card of a cloud physical host, then a first target security group is determined and sent to the physical switch; the first target security group is the security group after the security group rules corresponding to the virtual network interface card in the physical switch are cleared.

[0017] If the virtual network interface card is not the network interface card of the cloud physical host, the preset security group service agent sends a target database information request to the preset security group service plugin based on the remote control call operation, so as to re-determine the third target security group corresponding to the cloud physical host according to the database information obtained from the preset security group service plugin, and send the third target security group to the physical switch so that the physical switch updates its own security group rules based on the third target security group.

[0018] Optionally, the cloud physical host security group management method further includes:

[0019] The preset security group service agent connects to the physical switch based on the Secure Shell protocol and sends the identified target security group to the physical switch to update the security group rules in the physical switch;

[0020] The target security group and the security group rules in the physical switch are both in the form of access control lists that the physical switch can understand and execute.

[0021] Optionally, both the default security group service plugin and the default security group service agent are located on the control node in the cloud platform;

[0022] Accordingly, the method further includes:

[0023] Based on the control node, the preset security group service plugin and the preset security group service agent obtain target information, so that the preset security group service agent converts the security group rules corresponding to the current cloud platform into a form that the physical switch can execute, and sends the converted security group rules to the physical switch.

[0024] Secondly, this application provides a cloud physical host security group management device applied to a cloud platform, wherein the cloud platform includes a preset security group service plugin and a preset security group service agent, and the cloud physical host security group management device includes:

[0025] The message monitoring module is used to monitor the first message and the second message based on the preset security group service plugin and the preset security group service agent, respectively.

[0026] The first management module is used to obtain the first target information corresponding to the first message when the preset security group service plugin detects the first message, and send the first target information to the preset security group service agent so that the preset security group service agent can determine the first target security group based on the first target information, and send the first target security group to the physical switch so that the physical switch can update its own security group rules based on the first target security group in order to manage the security group of the cloud physical host.

[0027] The second management module is used to obtain the second target information corresponding to the second message when the preset security group service agent detects the second message, and send a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin. Based on the second target information and the database information, the module determines the second target security group and sends the second target security group to the physical switch so that the physical switch updates its own security group rules based on the second target security group to manage the security group of the cloud physical host.

[0028] Thirdly, this application provides an electronic device, comprising:

[0029] Memory, used to store computer programs;

[0030] A processor is used to execute the computer program to implement the aforementioned cloud physical host security group management method.

[0031] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned cloud physical host security group management method.

[0032] In this application, a first message and a second message are monitored based on a preset security group service plugin and a preset security group service agent, respectively. When the preset security group service plugin detects the first message, it obtains the first target information corresponding to the first message and sends the first target information to the preset security group service agent. The preset security group service agent then determines a first target security group based on the first target information and sends the first target security group to the physical switch. This allows the physical switch to update its own security group rules based on the first target security group to manage the security group of the cloud physical host. When the preset security group service agent detects the second message, it obtains the second target information corresponding to the second message and sends a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin. Based on the second target information and the database information, it determines a second target security group and sends the second target security group to the physical switch. This allows the physical switch to update its own security group rules based on the second target security group to manage the security group of the cloud physical host. As can be seen from the above, this application monitors messages in the cloud platform through a preset security group service plugin and a preset security group service agent to obtain the corresponding target information, controls the preset security group service agent to determine the target security group corresponding to the current cloud platform based on the target information, and sends the target security group to the physical switch, so that the physical switch updates its own security group rules based on the target security group in order to manage the security group corresponding to the cloud physical host. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 This application discloses a flowchart of a cloud physical host security group management method.

[0035] Figure 2 This is a schematic diagram illustrating a specific cloud physical host security group management method disclosed in this application;

[0036] Figure 3 This is a schematic diagram of a first message processing method disclosed in this application;

[0037] Figure 4 This is a schematic diagram of a second message processing method disclosed in this application;

[0038] Figure 5This is a schematic diagram of the structure of a device disclosed in this application;

[0039] Figure 6 This is a schematic diagram of the structure of an electronic device disclosed in this application. Detailed Implementation

[0040] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] With the development of cloud platform technology, cloud physical host services are becoming increasingly popular due to their ability to provide users with computing and network resources similar to traditional physical servers. Cloud physical host security groups have also gradually become a key security technology in cloud platform security. As a type of cloud platform firewall technology, they are used to control network access traffic entering and leaving cloud physical hosts. Currently, in cloud platform environments based on OpenStack (an open-source cloud computing management platform project), the Neutron component responsible for virtual network services does not support the management and configuration of cloud physical host security groups. This severely restricts the application scenarios and business scope of cloud physical host services, greatly reducing the user experience of cloud platforms. Therefore, this application provides a cloud physical host security group management method that can manage and configure the security groups corresponding to cloud physical hosts.

[0042] See Figure 1 As shown in the figure, this application discloses a cloud physical host security group management method, including:

[0043] Step S11: Monitor the first message and the second message based on the preset security group service plugin and the preset security group service agent, respectively.

[0044] In this embodiment, a preset security group service plugin and a preset security group service agent are first deployed on the control node in the cloud platform environment. Then, the first message and the second message are monitored based on the preset security group service plugin and the preset security group service agent, respectively. Specifically, the preset security group service plugin and the preset security group service agent are first enabled, and then bound to a first function and a second function, respectively. The first message is then monitored based on the first function bound to the preset security group service plugin, and the second message is monitored based on the second function bound to the preset security group service agent.

[0045] The first message mentioned above includes, but is not limited to, a virtual network interface card (NIC) deletion message; the second message mentioned above includes, but is not limited to, a virtual NIC update message, a security group deletion message, a security group update message, a security group rule deletion message, and a security group rule update message. The first and second functions mentioned above can be hook functions. When a virtual NIC deletion operation occurs on the cloud platform, the preset security group service plugin can detect the virtual NIC deletion message through the first function; or when a virtual NIC update operation occurs on the cloud platform, the preset security group service agent can detect the virtual NIC update message through the second function.

[0046] Through the above methods, different types of messages in the cloud platform can be accurately perceived by the corresponding components, laying the foundation for further processing and response to these messages.

[0047] Step S12: When the preset security group service plugin detects the first message, it obtains the first target information corresponding to the first message and sends the first target information to the preset security group service agent, so that the preset security group service agent determines the first target security group based on the first target information and sends the first target security group to the physical switch, so that the physical switch updates its own security group rules based on the first target security group in order to manage the security group of the cloud physical host.

[0048] In this embodiment, when the preset security group service plugin detects the first message, it first obtains the first target information corresponding to the first message. The first target information includes, but is not limited to, the port identifier, Internet Protocol address, security group identifier, and physical address corresponding to the deleted virtual network interface card (NIC). For example, if the preset security group service plugin detects a virtual NIC deletion message, it obtains the port identifier, Internet Protocol address, security group identifier, and physical address corresponding to the deleted virtual NIC as the first target information, and then sends the first target information to the preset security group service agent based on a Remote Procedure Call (RPC) operation.

[0049] After receiving the first target information, the preset security group service agent determines the first target security group based on the first target information and sends the first target security group to the physical switch. Specifically, the preset security group service agent determines whether the virtual network interface card (NIC) corresponding to the first target information is a NIC of the cloud physical host based on the first target information. If the virtual NIC is a NIC of the cloud physical host, the agent determines the first target security group and sends it to the physical switch. The first target security group is the security group after clearing the security group rules corresponding to the virtual NIC in the physical switch. If the virtual NIC is not a NIC of the cloud physical host, the preset security group service agent sends a target database information request to the preset security group service plugin based on a remote control call operation. Based on the database information obtained from the preset security group service plugin, the agent re-determines the third target security group corresponding to the cloud physical host and sends the third target security group to the physical switch, so that the physical switch updates its own security group rules based on the third target security group.

[0050] It should be noted that the virtual network interface card (NIC) corresponding to the first target information mentioned above can be the NIC of a cloud physical host or a virtual machine's NIC, etc. If the virtual NIC is the NIC of a cloud physical host, deleting the virtual NIC may indicate that the cloud physical host is about to undergo a major network architecture adjustment, migrate to a new network environment, or undergo a fundamental change in the host's security policy. In these cases, clearing the original security group rules can prevent old rules from interfering with new operations and ensure that the new security policy or network configuration can be implemented smoothly. If the virtual NIC is not the NIC of a cloud physical host, although the operation of the non-cloud physical host NIC may seem to have no direct relationship with the cloud physical host, there may be indirect network relationships and dependencies in the complex network environment of the cloud platform. For example, a change in the configuration of a virtual network adapter in a virtual machine may affect the topology of the entire virtual network, which in turn affects the network access path and security policy of the cloud physical host. Therefore, it is necessary to use the preset security group service agent to send a target database information request to the preset security group service plugin based on remote control call operation to obtain relevant database information, such as security group association, cloud physical host information, virtual network adapter information, and network topology and environment information, so as to re-evaluate and determine the security group rules corresponding to the cloud physical host.

[0051] Step S13: When the preset security group service agent detects the second message, it obtains the second target information corresponding to the second message and sends a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin. Based on the second target information and the database information, it determines the second target security group and sends the second target security group to the physical switch so that the physical switch updates its own security group rules based on the second target security group to manage the security group of the cloud physical host.

[0052] In this embodiment, when the preset security group service agent obtains the second target information, in order to determine the security group rules more comprehensively and accurately, it can send a database information request to the preset security group service plugin based on a remote control call operation, and obtain database information related to security group management from the database. Based on the second target information and the database information, a second target security group is determined. This second target security group can meet the security requirements of the cloud physical host and is compatible with the entire network environment. After determining the second target security group, the preset security group service agent sends the second target security group to the physical switch.

[0053] It should be noted that the physical switch is a key device in the network, responsible for actual network data forwarding and traffic control. The preset security group service agent can connect to the physical switch based on the Secure Shell protocol (SSH) and send the identified target security group to the physical switch to update the security group rules in the physical switch.

[0054] The target security group and the security group rules in the physical switch are both in the form of Access Control Lists (ACLs) that the physical switch can understand and execute.

[0055] It is understood that this embodiment obtains target information based on the control node's control of the preset security group service plugin and the preset security group service agent. This allows the preset security group service agent to convert the security group rules corresponding to the current cloud platform into a form that the physical switch can execute, and then send the converted security group rules to the physical switch, so that the physical switch can update its own security group rules to manage the security groups of the cloud physical hosts.

[0056] As can be seen from the above, this embodiment monitors messages in the cloud platform through a preset security group service plugin and a preset security group service proxy to obtain corresponding target information. The preset security group service proxy then determines the target security group corresponding to the current cloud platform based on the target information and sends the target security group to the physical switch. This allows the physical switch to update its own security group rules based on the target security group, thereby managing the security group corresponding to the cloud physical host. This expands the application scenarios and business scope of the cloud physical host service and improves the user experience of the cloud platform.

[0057] join Figure 2As shown below, taking a cloud platform based on OpenStack as an example, the technical solution in this application is explained. Specifically, the Neutron component is used to handle virtual network services. A cloud physical host security group service plugin (bmsg_plugin) is developed on the extended architecture provided by Neutron to provide security group management functions for cloud physical hosts. The bmsg_plugin is deployed on the control node of the cloud platform environment. A cloud physical host security group service agent (bmsg_agent) is developed on the extended architecture provided by Neutron to actually distribute and configure cloud physical host security group rules to physical switches. The bmsg_agent is also deployed on the control node of the cloud platform. The bmsg_plugin interacts with the bmsg_agent agent through an RPC message mechanism.

[0058] Furthermore, the neutron-server process is the most important service process of the Neutron component. It is essentially a web server process that runs on the control node and is responsible for starting and managing the bmsg_plugin service plugin. The MessageQueue provides RPC communication services between the plugin and the agent. The L2_Agent process runs on the control node and is responsible for receiving and processing RPC messages from the plugin. At the same time, L2_Agent is responsible for starting and managing the agent.

[0059] There are six main types of messages from the cloud platform that affect the security group rules of cloud physical hosts: virtual network interface card deletion message (port_delete); virtual network interface card update message (port_update); security group deletion message (security_group_delete); security group update message (security_group_update); security group rule deletion message (security_group_rule_delete); and security group rule update message (security_group_rule_update). The bmsg_plugin located at the plugin end is responsible for detecting and processing the port_delete message, while the other five messages are detected and processed by bmsg_agent.

[0060] For example, see Figure 3 As shown, the handling of the port_delete message is as follows:

[0061] The neutron-server process on the cloud platform plugin side has deployed and started the bmsg_plugin plugin, and the L2_agent on the cloud platform agent side has deployed and started the bmsg_agent agent. The cloud physical host instance has been successfully enabled and connected to the cloud platform network through the physical switch (UNIX switch).

[0062] The bmsg_plugin starts and registers the port_delete message. Registering the port_delete message means that when a virtual network interface card (NIC) is deleted on the cloud platform, bmsg_plugin can detect the virtual NIC deletion message through hook functions and obtain detailed information such as the virtual NIC's port identifier (port_id), Internet Protocol address (port_ipaddr), security group identifier (port_sgid), and physical address (port_mac). Then, it sends the port_id, port_ipaddr, port_sgid, and port_mac to the bmsg_agent agent via an RPC message. Upon receiving the message, bmsg_agent first determines whether the port_id corresponds to the cloud physical host's network address. If the network card is not a cloud physical host network card, the security group of that network card is found to be empty, and the first target security group is determined. bmsg_agent connects to the physical switch via SSH and sends the first target security group to the physical switch to update the security group rules corresponding to the cloud physical host network card in the physical switch. Essentially, this clears the ACL rules configured on the physical switch. If port_id is not a cloud physical host network card, the security group rules corresponding to the cloud physical host are recalculated. During the recalculation process, bmsg_agent needs to request relevant database information from bmsg_plugin via RPC. After the calculation is completed, bmsg_agent connects to the physical switch via SSH and sends the recalculated third target security group to the physical switch to configure the corresponding ACL rules for the physical switch.

[0063] For example, see Figure 4 As shown, the processing of the security_group_delete, security_group_update, security_group_rule_delete, security_group_rule_update, and port_update messages is as follows:

[0064] The neutron-server process on the cloud platform plugin side has deployed and started the bmsg_plugin plugin, and the L2_agent on the cloud platform agent side has deployed and started the bmsg_agent agent. The cloud physical host instance has been successfully activated and connected to the cloud platform network through the physical switch.

[0065] The bmsg_agent agent starts and registers the security_group_delete, security_group_update, security_group_rule_delete, security_group_rule_update, and port_update messages. When the cloud platform performs corresponding operations, bmsg_agent can detect the message and obtain its detailed information through hook functions. Then, bmsg_agent recalculates the security group rules corresponding to the cloud physical host based on the above detailed information. During the recalculation process, bmsg_agent needs to request relevant database information from bmsg_plugin via RPC. After the calculation is completed, bmsg_agent connects to the physical switch via SSH and sends the recalculated second target security group to the physical switch to configure the corresponding ACL rules for the physical switch.

[0066] As shown above, this embodiment uses a cloud platform based on OpenStack as an example to illustrate in detail how to manage and configure cloud physical host security groups through security group service plugins and security group service agents. In this way, the cloud platform can directly manage and configure cloud physical host security groups uniformly through the Neutron component. Deployment is simple, requiring no modification or secondary development of the existing OpenStack network architecture; only the cloud physical host security group service plugin and cloud physical host security group service agent developed based on the Neutron component need to be deployed.

[0067] See Figure 5 As shown in the embodiments of this application, a cloud physical host security group management device is also disclosed, applied to a cloud platform, wherein the cloud platform includes a preset security group service plugin and a preset security group service agent, and the cloud physical host security group management device includes:

[0068] The message monitoring module 11 is used to monitor the first message and the second message based on the preset security group service plugin and the preset security group service agent, respectively.

[0069] The first management module 12 is used to obtain the first target information corresponding to the first message when the preset security group service plugin detects the first message, and send the first target information to the preset security group service agent so that the preset security group service agent can determine the first target security group based on the first target information and send the first target security group to the physical switch so that the physical switch can update its own security group rules based on the first target security group in order to manage the security group of the cloud physical host.

[0070] The second management module 13 is used to obtain the second target information corresponding to the second message when the preset security group service agent detects the second message, and send a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin, determine the second target security group based on the second target information and the database information, and send the second target security group to the physical switch so that the physical switch updates its own security group rules based on the second target security group in order to manage the security group of the cloud physical host.

[0071] As can be seen from the above, this application monitors messages in the cloud platform through a preset security group service plugin and a preset security group service agent to obtain the corresponding target information, controls the preset security group service agent to determine the target security group corresponding to the current cloud platform based on the target information, and sends the target security group to the physical switch, so that the physical switch updates its own security group rules based on the target security group in order to manage the security group corresponding to the cloud physical host.

[0072] In some specific embodiments, the message monitoring module 11 includes:

[0073] The function binding unit is used to control the startup of the preset security group service plugin and the preset security group service proxy, and to bind the preset security group service plugin and the preset security group service proxy to the first function and the second function respectively;

[0074] The message monitoring unit is used to monitor the first message based on the first function bound to the preset security group service plugin, and to monitor the second message based on the second function bound to the preset security group service agent.

[0075] In some specific implementations, the first message includes a virtual network interface card (NIC) deletion message; the second message includes a virtual NIC update message, a security group deletion message, a security group update message, a security group rule deletion message, and a security group rule update message.

[0076] In some specific implementations, the first target information includes the port identifier, Internet Protocol address, security group identifier, and physical address corresponding to the deleted virtual network interface card.

[0077] In some specific embodiments, the first management module 12 includes:

[0078] The judgment unit is used to determine whether the virtual network card corresponding to the first target information is a network card of the cloud physical host based on the first target information by the preset security group service agent.

[0079] The first processing unit is configured to determine a first target security group if the virtual network interface card is a network interface card of a cloud physical host, and send the first target security group to the physical switch; the first target security group is the security group after the security group rules corresponding to the virtual network interface card in the physical switch are cleared.

[0080] The second processing unit is configured to, if the virtual network interface card is not the network interface card of the cloud physical host, send a target database information request to the preset security group service plugin based on a remote control call operation, so as to re-determine the third target security group corresponding to the cloud physical host according to the database information obtained from the preset security group service plugin, and send the third target security group to the physical switch so that the physical switch updates its own security group rules based on the third target security group.

[0081] In some specific embodiments, the cloud physical host security group management device further includes:

[0082] The security group update unit is used to preset the security group service agent to connect with the physical switch based on the Secure Shell protocol, and send the determined target security group to the physical switch to update the security group rules in the physical switch;

[0083] The target security group and the security group rules in the physical switch are both in the form of access control lists that the physical switch can understand and execute.

[0084] In some specific implementations, both the preset security group service plugin and the preset security group service agent are located on the control node in the cloud platform;

[0085] Correspondingly, the cloud physical host security group management device also includes:

[0086] The security group sending unit is used to control the preset security group service plugin and the preset security group service agent to obtain target information based on the control node, so that the preset security group service agent converts the obtained security group rules corresponding to the current cloud platform into a form of security group rules that can be executed by the physical switch based on the target information, and sends the converted security group rules to the physical switch.

[0087] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0088] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the cloud physical host security group management method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0089] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0090] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0091] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the cloud physical host security group management method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0092] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned cloud physical host security group management method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0093] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0094] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0095] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0096] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0097] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for managing security groups on cloud physical hosts, characterized in that, Applied to a cloud platform, wherein the cloud platform includes a preset security group service plugin and a preset security group service agent, and the cloud physical host security group management method includes: The first and second messages are monitored based on the preset security group service plugin and the preset security group service agent, respectively. When the preset security group service plugin detects the first message, it obtains the first target information corresponding to the first message and sends the first target information to the preset security group service agent, so that the preset security group service agent can determine the first target security group based on the first target information and send the first target security group to the physical switch, so that the physical switch can update its own security group rules based on the first target security group in order to manage the security group of the cloud physical host. When the preset security group service agent detects the second message, it obtains the second target information corresponding to the second message and sends a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin. Based on the second target information and the database information, it determines the second target security group and sends the second target security group to the physical switch so that the physical switch updates its own security group rules based on the second target security group to manage the security group of the cloud physical host.

2. The cloud physical host security group management method according to claim 1, characterized in that, The monitoring of the first and second messages based on the preset security group service plugin and the preset security group service agent includes: Control the startup of the preset security group service plugin and the preset security group service proxy, and bind the preset security group service plugin and the preset security group service proxy to the first function and the second function respectively; The first message is monitored based on the first function bound to the preset security group service plugin, and the second message is monitored based on the second function bound to the preset security group service agent.

3. The cloud physical host security group management method according to claim 2, characterized in that, The first message includes a virtual network adapter deletion message; the second message includes a virtual network adapter update message, a security group deletion message, a security group update message, a security group rule deletion message, and a security group rule update message.

4. The cloud physical host security group management method according to claim 3, characterized in that, The first target information includes the port identifier, Internet Protocol address, security group identifier, and physical address corresponding to the deleted virtual network interface card.

5. The cloud physical host security group management method according to claim 1, characterized in that, The preset security group service proxy determines a first target security group based on the first target information and sends the first target security group to the physical switch, including: The preset security group service agent determines whether the virtual network card corresponding to the first target information is a network card of the cloud physical host based on the first target information; If the virtual network interface card is a network interface card of a cloud physical host, then a first target security group is determined and sent to the physical switch; the first target security group is the security group after the security group rules corresponding to the virtual network interface card in the physical switch are cleared. If the virtual network interface card is not the network interface card of the cloud physical host, the preset security group service agent sends a target database information request to the preset security group service plugin based on the remote control call operation, so as to re-determine the third target security group corresponding to the cloud physical host according to the database information obtained from the preset security group service plugin, and send the third target security group to the physical switch so that the physical switch updates its own security group rules based on the third target security group.

6. The cloud physical host security group management method according to any one of claims 1 to 5, characterized in that, Also includes: The preset security group service agent connects to the physical switch based on the Secure Shell protocol and sends the identified target security group to the physical switch to update the security group rules in the physical switch; The target security group and the security group rules in the physical switch are both in the form of access control lists that the physical switch can understand and execute.

7. The cloud physical host security group management method according to claim 1, characterized in that, Both the default security group service plugin and the default security group service agent are located on the control node of the cloud platform; Accordingly, the method further includes: Based on the control node, the preset security group service plugin and the preset security group service agent obtain target information, so that the preset security group service agent converts the security group rules corresponding to the current cloud platform into a form that the physical switch can execute, and sends the converted security group rules to the physical switch.

8. A cloud physical host security group management device, characterized in that, Applied to a cloud platform, wherein the cloud platform includes a preset security group service plugin and a preset security group service agent, and the cloud physical host security group management device includes: The message monitoring module is used to monitor the first message and the second message based on the preset security group service plugin and the preset security group service agent, respectively. The first management module is used to obtain the first target information corresponding to the first message when the preset security group service plugin detects the first message, and send the first target information to the preset security group service agent so that the preset security group service agent can determine the first target security group based on the first target information, and send the first target security group to the physical switch so that the physical switch can update its own security group rules based on the first target security group in order to manage the security group of the cloud physical host. The second management module is used to obtain the second target information corresponding to the second message when the preset security group service agent detects the second message, and send a database information request to the preset security group service plugin to obtain the database information sent by the preset security group service plugin. Based on the second target information and the database information, the module determines the second target security group and sends the second target security group to the physical switch so that the physical switch updates its own security group rules based on the second target security group to manage the security group of the cloud physical host.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the cloud physical host security group management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the cloud physical host security group management method as described in any one of claims 1 to 7.

Images