System resource access method, device and computer equipment

Abstract

The present application relates to the field of computer technology, and to a system resource access method, apparatus, and computer equipment. The method comprises: a resource access request for system resources in a newly added network namespace of a network system; the newly added network namespace is mounted on an intermediate network namespace, and the intermediate network namespace is determined from at least one idle network namespace pre-monitored for the network system; the access permission of the resource access request for the newly added network namespace is verified to obtain an access permission verification result; if the access permission verification result indicates that the verification is passed, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request; receiving the access response result returned by the newly added network namespace through the intermediate network namespace, thereby improving the continuity and stability of resource access.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a system resource access method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the digital age, with the widespread adoption of technologies like cloud computing and big data, the network environments of businesses and organizations are becoming increasingly complex. Zero-trust network architecture, as an emerging security concept, aims to abandon the traditional trust model based on network boundaries and instead continuously authenticate all entities in the network to ensure network security.

[0003] Multi-tenant network isolation is a technology developed in cloud computing environments to meet the resource isolation and security requirements of different tenants. In a multi-tenant environment, multiple tenants share the same physical resources and network infrastructure. Without effective isolation measures, security issues in one tenant could affect other tenants.

[0004] At present, zero-trust network architecture and multi-tenant network isolation technology have become research hotspots in the field of network security. However, when accessing system resources under the existing zero-trust network architecture, frequent additions of network namespaces require system reloading. The reloading process will cause other tenants to interrupt their access to system resources, affecting the stability of resource access. Summary of the Invention

[0005] Based on this, it is necessary to provide a system resource access method, device, computer equipment, computer-readable storage medium and computer program product that can improve the stability of resource access in response to the above technical problems.

[0006] In a first aspect, the present application provides a system resource access method, the method comprising:

[0007] receiving a resource access request for a system resource in a newly added network namespace of a network system; the newly added network namespace is mounted on an intermediate network namespace, the intermediate network namespace being determined from at least one idle network namespace pre-monitored for the network system;

[0008] Verifying the access rights of the resource access request for the newly added network namespace to obtain an access rights verification result;

[0009] If the access permission verification result indicates that the verification is passed, sending the resource access request to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request;

[0010] Receive the access response result returned by the newly added network namespace through the intermediate network namespace.

[0011] In one embodiment, the method further comprises:

[0012] In the case of detecting a newly added network namespace, determining at least one idle network namespace that has been pre-monitored, and determining an intermediate network namespace from the at least one idle network namespace according to a space determination method;

[0013] Determine identification information of the newly added network namespace, and establish a mapping relationship between the newly added network namespace and the intermediate network namespace based on the identification information;

[0014] According to the mapping relationship, the newly added network namespace is mounted on the intermediate network namespace.

[0015] In one embodiment, upon detecting a newly added network namespace, determining at least one idle network namespace to be pre-monitored includes:

[0016] In the case of monitoring a new space request from a target tenant, a new network namespace is created for the target tenant, and at least one pre-monitored idle network namespace is determined.

[0017] In one embodiment, the method further comprises:

[0018] In the case where a deletion instruction for the newly added network namespace is detected, the newly added network namespace is deleted, and the mapping relationship is released to release the intermediate network namespace and restore it to an idle network namespace.

[0019] In one embodiment, verifying the access rights of the resource access request to the newly added network namespace includes:

[0020] determining access permission information according to the resource access request;

[0021] Based on the access permission information, the access permission of the resource access request for the newly added network namespace is determined, and the access permission of the resource access request is verified according to the access permission.

[0022] In one embodiment, the method further comprises:

[0023] When a user login request for the newly added network namespace is detected, obtaining the user login request, and determining user information and login environment information of the user login request according to the user login request;

[0024] Verifying the login permission of the newly added network namespace targeted by the user login request based on the user information and the login environment information;

[0025] The determining access permission information according to the resource access request includes:

[0026] In a case where the login authority verification of the user login request is passed, access authority information is determined according to the resource access request.

[0027] In one embodiment, sending the resource access request to the newly added network namespace through the intermediate network namespace includes:

[0028] Determine the intermediate network namespace to which the newly added network namespace is mounted and a mapping relationship between the newly added network namespace and the intermediate network namespace;

[0029] According to the mapping relationship, the resource access request is sent to the newly added network namespace through the intermediate network namespace.

[0030] In one embodiment, when the access permission verification result indicates that the verification is passed, sending the resource access request to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request, includes:

[0031] If the access permission verification result indicates that the verification is passed, determining the current network environment of the network system and the system resource type corresponding to the resource access request;

[0032] If the current network environment does not match the system resource type, converting the current network environment into a target network environment that matches the system resource type;

[0033] When the network system is in the target network environment, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request.

[0034] In a second aspect, the present application further provides a system resource access device, comprising:

[0035] a request receiving module, configured to receive a resource access request for a system resource in a newly added network namespace of the network system; the newly added network namespace is mounted on an intermediate network namespace, the intermediate network namespace being determined from at least one idle network namespace pre-monitored for the network system;

[0036] An authority verification module is used to verify the access rights of the resource access request for the newly added network namespace and obtain an access rights verification result;

[0037] a request sending module, configured to send the resource access request to the newly added network namespace via the intermediate network namespace if the access permission verification result indicates that the verification is passed, so that the newly added network namespace returns an access response result obtained by processing the resource access request;

[0038] The result receiving module is configured to receive the access response result returned by the newly added network namespace through the intermediate network namespace.

[0039] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-described method when executing the computer program.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method described above when the computer program is executed by a processor.

[0041] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, which implements the steps of the method described above when executed by a processor.

[0042] The system resource access method, apparatus, computer device, computer-readable storage medium, and computer program product described above receive a resource access request for system resources in a newly added network namespace of a network system; the newly added network namespace is mounted on an intermediate network namespace, which is determined from at least one idle network namespace pre-monitored for the network system; the access rights of the resource access request against the newly added network namespace are verified to obtain an access rights verification result; if the access rights verification result indicates that the verification is successful, the resource access request is sent to the newly added network namespace via the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request; and the access response result is received from the newly added network namespace via the intermediate network namespace. The intermediate network namespace is formed by mounting the newly added network namespace on the pre-monitored idle network namespace, and monitoring of the intermediate network namespace is continuously maintained, so that the intermediate network namespace can continuously monitor data transmission and traffic on the newly added network namespace. During the monitoring process, no additional monitoring of the newly added network namespace is required, which can effectively avoid system service interruptions caused by the additional monitoring, thereby improving the continuity and stability of resource access. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 An application environment diagram of a system resource access method in one embodiment;

[0045] Figure 2 1 is a flow chart of a method for accessing system resources in one embodiment;

[0046] Figure 3 A schematic diagram of a flow chart of a space mounting step in one embodiment;

[0047] Figure 4 A schematic diagram of a space mounting process in one embodiment;

[0048] Figure 5 A schematic diagram of a client accessing a resource in one embodiment;

[0049] Figure 6 is a structural block diagram of a system resource access device in one embodiment;

[0050] Figure 7 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of this application more clearly understood, the following description is given in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0052] The system resource access method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 receives a resource access request for system resources in a newly added network namespace of the network system sent by the client; the newly added network namespace is mounted on the intermediate network namespace, and the intermediate network namespace is determined from at least one idle network namespace pre-monitored for the network system; the server 104 verifies the access rights of the resource access request for the newly added network namespace and obtains an access rights verification result; when the access rights verification result indicates that the verification is passed, the server 104 sends the resource access request to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request; the server 104 receives the access response result returned by the newly added network namespace through the intermediate network namespace.

[0053] Terminal 102 may include, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, smart car devices, and projectors. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Head-mounted devices may include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, and the like. Server 104 may be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0054] In an exemplary embodiment, Figure 2 As shown, a system resource access method is provided, which is applied to Figure 1 The server 104 in FIG is used as an example to illustrate, and it is understood that the method can also be applied to Figure 1The terminal 102 in the embodiment may also be applied to a system including the terminal 102 and the server 104, and implemented through interaction between the terminal 102 and the server 104. The method of this embodiment includes:

[0055] Step 202: Receive a resource access request for a system resource in a newly added network namespace of the network system.

[0056] Among them, a network system refers to a system used to implement functions such as data transmission, sharing, and processing. A network system can include a local area network within an enterprise or a larger wide area network, such as a portion of the Internet. The network system has a specific network topology, protocol stack, and security policy. The network system includes several network namespaces, so that when a client initiates a resource access request, it can access the system resources in the corresponding network namespace in the network system based on the resource access request. A network namespace refers to a mechanism used in an operating system to isolate network (system) resources. A network namespace allows the creation of multiple logically independent network environments within a physical network environment. Each network namespace has independent network configurations such as network devices, network interfaces, addresses, routing tables, and firewall rules. Different network namespaces can be isolated from each other or communicate through specific methods.

[0057] In network systems, network namespaces can be used to isolate and flexibly allocate system resources, ensuring secure and orderly access to them. Specifically, multiple network namespaces can be created within a network system, each corresponding to a different application or service. This prevents network interference between different applications and improves system security and stability.

[0058] A new network namespace is a newly created, logically independent network namespace within a network system. It has independent network configuration and resource environments, designed to meet specific business needs or application scenarios and isolate different applications, services, or users. For example, in a multi-tenant environment, when a new tenant joins, a new network namespace can be created for that tenant to ensure that their network traffic and applications are isolated from other tenants, ensuring data security. New network namespaces can be customized based on actual needs, such as setting specific IP address ranges, address tables, and port numbers.

[0059] A resource access request is a request sent by the network system to access system resources in a newly added network namespace. System resources can include, but are not limited to, files, database records, network services, and other types of resources. A resource access request may include, but is not limited to, the identifier of the system resource to be accessed, the access method (e.g., read, write, delete), and the client's identity information (or permissions). In practice, a resource access request can be initiated by a client to the network system via an edge gateway.

[0060] Exemplarily, the server can receive a resource access request for system resources in a newly added network namespace of the network system; for example, when the client initiates a resource access request to system resources in a newly added namespace of the network system through an edge gateway, the server can receive a resource access request for system resources in the newly added network namespace of the network system.

[0061] In an optional embodiment, the newly added network namespace is mounted on an intermediate network namespace, and the intermediate network namespace is determined from at least one idle network namespace pre-monitored for the network system.

[0062] Among them, the intermediate network namespace refers to a network namespace that acts as a bridge in the network system. The intermediate network namespace can be determined from at least one idle network namespace pre-monitored for the network system. The newly added network namespace is mounted on the intermediate network namespace, so that the intermediate network namespace can transmit data and traffic between the newly added network namespace and other network components (such as the client that sends the resource access request). At the same time, due to the continuous monitoring on the intermediate network namespace, the intermediate network namespace can also monitor the data and traffic when the newly added network namespace transmits data and traffic with other network components to ensure the security and stability of the data and traffic transmission between the newly added network namespace and other network components. In specific implementation, when a resource access request needs to access system resources in a newly added network namespace, the resource access request will first reach the intermediate network namespace, and then be forwarded to the newly added network namespace by the intermediate network namespace.

[0063] Mounting is the process of associating and connecting a newly added network namespace with an intermediate network namespace. For example, in Linux, you can use the mount command to associate a newly added network namespace with an intermediate network namespace, allowing them to share network stack and routing information. Mounting allows the newly added network namespace to interact with other network components through the intermediate network namespace. After mounting, the newly added network namespace can send and receive network data and traffic through the intermediate network namespace.

[0064] An idle network namespace refers to a pre-configured network namespace, which may include network namespaces that are underutilized or idle. In specific implementations, the server can pre-configure a sufficient number of network namespaces as idle network namespaces and monitor each idle network namespace separately. This allows the server to indirectly monitor data and traffic transmission on the newly created network namespace by directly monitoring the intermediate network namespace (i.e., the idle network namespace after it has been mounted). This eliminates the need for additional monitoring on the newly created network namespace, preventing system service interruptions due to the newly added monitoring and ensuring the stability and continuity of system services. Whether a network namespace is idle may be determined based on current network traffic, the number of established connections, resource utilization, and other factors. For example, if a network namespace's bandwidth usage remains below a certain threshold for a long period of time and has few active network connections, it can be considered idle. Alternatively, a mounted network namespace (i.e., an intermediate network namespace) can be configured with a mount flag. Unmounted network namespaces in pre-configured network namespaces can also be considered idle.

[0065] Pre-monitoring refers to the process of proactively and continuously observing and monitoring the status of idle network namespaces in a network system. This provides real-time information on the usage and resource usage of each idle network namespace. This can be achieved using monitoring tools and technologies, such as network monitoring software and system log analysis, to collect data related to idle network namespaces, including but not limited to monitoring metrics such as CPU (Central Processing Unit) utilization, memory usage, and the number of network connections.

[0066] Step 204 : Verify the access rights of the resource access request against the newly added network namespace to obtain an access rights verification result.

[0067] Among them, access permission verification refers to the process of verifying whether the newly added network namespace and system resources targeted by the resource access request have access permissions. Access permissions may include whether the client has permission to access the newly added network namespace, whether it has permission to access specific system resources in the newly added network namespace, etc. In specific implementation, access permission verification can be implemented according to pre-set access control policies, such as user identity authentication information, role permissions, etc., to prevent users who do not have access permissions from accessing specific resources, avoid data leakage and system attacks. Access permission verification results refer to the output results of the access permission verification process. Access permission verification results are used to indicate whether the verification is passed. Generally, they can include two possible results: "verification passed" and "verification failed". If the verification is passed, it means that the user has permission to access the feature resources; if the verification fails, the client's access request is rejected.

[0068] For example, the server can verify the access rights of the resource access request for the newly added network namespace and obtain the access rights verification result; for example, the server can verify the access rights of the resource access request for the newly added network namespace and the access rights of the system resources in the newly added network namespace according to a pre-set access control policy (such as the user's identity authentication information and role permissions) and obtain the access rights verification result.

[0069] Step 206 : If the access permission verification result indicates that the verification is passed, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request.

[0070] The access response result refers to the result returned by the newly added network namespace after processing the resource access request. The access response result may include the execution status of the resource access request, such as whether the system resource was successfully accessed and the content of the returned system resource. Based on the mounting relationship between the newly added network namespace and the intermediate network namespace, the access response result can be sent from the newly added network namespace to the intermediate network namespace, and then returned to the client that sent the resource access request through the intermediate network namespace. When the resource access request is sent to the newly added network namespace through the intermediate network namespace, the server can obtain the resource access request (traffic) captured by the edge gateway via a transparent proxy. The resource access request can be sent by the client to the edge gateway. In specific implementation, the WireGuard protocol can be used to establish a tunnel between the client and the edge gateway, allowing the client to transmit the resource access request through the tunnel to the edge gateway. The edge gateway captures the resource access request via a transparent proxy and sends the resource access request to the newly added network namespace for processing based on the intermediate network namespace to obtain the access response result.

[0071] Exemplarily, the server can send the resource access request to the newly added network namespace through the intermediate network namespace when the access permission verification result indicates that the verification is successful, so that the newly added network namespace returns the access response result obtained by processing the resource access request; for example, the server can obtain the resource access request sent by the client to the edge gateway through the tunnel when the access permission verification result indicates that the verification is successful, and enable the edge gateway to send the resource access request to the newly added network namespace through the intermediate network namespace to instruct the newly added network namespace to process the resource access request, obtain the access response result, and return the access response result.

[0072] In some other embodiments, the server may also restrict the resource access request from accessing the newly added network namespace or specific system resources in the newly added network namespace when the access permission verification result indicates that the verification fails, and return the access permission verification result of restricted access to the client.

[0073] Step 208: Receive an access response result returned by the newly added network namespace through the intermediate network namespace.

[0074] Exemplarily, the server may receive an access response result returned by the newly added network namespace through the intermediate network namespace, and then the server may return the received access response result to the client through the edge gateway.

[0075] In the above-mentioned system resource access method, a resource access request for system resources in a newly added network namespace of a network system is received; the newly added network namespace is mounted on an intermediate network namespace, and the intermediate network namespace is determined from at least one idle network namespace pre-monitored for the network system; the access permission of the resource access request for the newly added network namespace is verified to obtain an access permission verification result; if the access permission verification result indicates that the verification is passed, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request; the access response result returned by the newly added network namespace through the intermediate network namespace is received; and the access permission is obtained by A new network namespace is mounted on the idle network namespace to form an intermediate network namespace, and monitoring on the intermediate network namespace persists. The intermediate network namespace can then continuously monitor the data transmission and traffic on the new network namespace. During the monitoring process, there is no need to add additional monitoring for the new network namespace, which can effectively avoid system service termination caused by the new monitoring and help improve the continuity and stability of resource access. At the same time, when accessing system resources, the access rights corresponding to the resource access request are verified to ensure that specific resources can be accessed only after the access rights verification is passed. In addition, all requests and data are transmitted through the monitored intermediate network namespace, which not only filters malicious requests but also helps to continuously monitor resource access behavior and ensure network security.

[0076] In one embodiment, Figure 3 As shown, the system resource access method further includes:

[0077] Step 302: When a newly added network namespace is detected, at least one idle network namespace that has been pre-monitored is determined, and an intermediate network namespace is determined from the at least one idle network namespace according to a space determination method.

[0078] Detecting a newly added network namespace may include detecting that the system is in the process of creating a newly added network namespace or detecting that the system has completed creating a newly added network namespace. A space determination method refers to a method or rule for determining an intermediate network namespace from at least one idle network namespace. In a specific implementation, an idle network namespace may be randomly selected from the at least one idle network namespace as the intermediate network namespace, or the intermediate network namespace may be determined based on certain rules to ensure that the selected intermediate network namespace meets the system's needs and performance requirements. For example, when determining an intermediate network namespace based on certain rules, based on resource availability rules, an idle network namespace with the most remaining resources (such as network bandwidth, memory, etc.) can be selected as the intermediate network namespace to ensure that it can carry the traffic and load of the newly added network namespace. For example, based on network topology rules, an idle network namespace that is closer to the newly added network namespace in network topology or more convenient to connect to can be selected as the intermediate network namespace based on the physical or logical connection relationship between network namespaces to reduce network latency and communication overhead. For example, based on load balancing rules, a namespace with a relatively light load can be selected as the intermediate network namespace based on the current load of each idle network namespace to achieve overall system load balancing.

[0079] For example, upon detecting a newly added network namespace, the server may determine at least one idle network namespace for pre-monitoring. For example, upon detecting a newly created network namespace in the system, the server may determine at least one idle network namespace for pre-monitoring based on indicators such as CPU usage, memory usage, and number of network connections of a pre-created network namespace. The server may determine an intermediate network namespace from at least one idle network namespace using a space determination method. For example, the server may randomly determine an idle network namespace from at least one idle network namespace as the intermediate network namespace.

[0080] Step 304: Determine identification information of the newly added network namespace, and construct a mapping relationship between the newly added network namespace and the intermediate network namespace based on the identification information.

[0081] Identification information refers to data or attributes used to uniquely identify a newly added network namespace. Identification information may include at least one of a name, number, IP (Internet Protocol) address, or other information that can clearly distinguish the network namespace from other network namespaces, so that the newly added network namespace can be accurately located and referenced. For example, in the network environment of a large data center, each network namespace may have a unique identifier, which allows servers or systems to quickly locate and manage specific network namespaces. In specific implementations, identification information can be determined based on methods such as timestamps, hash algorithms, random numbers, and database-incremented IDs (identity documents) when a new network namespace is created.

[0082] A mapping relationship refers to a correspondence established between a newly added network namespace and an intermediate network namespace based on identification information. The mapping relationship is used to indicate that the newly added network namespace will be mounted and communicated through the intermediate network namespace. In specific implementation, the mapping relationship can exist in the form of a data structure, such as a hash table, an associative array, etc. For example, in a mapping table, the identification information of the newly added network namespace is used as the key, and the identification information of the intermediate network namespace is used as the value. By querying the mapping table, the system can quickly locate the intermediate network namespace corresponding to the newly added network namespace, so that when there is a resource access request for the newly added network namespace, the server can send the resource access request to the newly added network namespace through the intermediate network namespace corresponding to the newly added network namespace based on the mapping relationship.

[0083] For example, the server may determine identification information of the newly added network namespace; for example, the server may determine the identification information of the newly added network namespace based on a timestamp when creating the newly added network namespace. The server may construct a mapping relationship between the newly added network namespace and the intermediate network namespace based on the identification information; for example, the server may construct a mapping table between the newly added network namespace and the intermediate network namespace based on the timestamp to indicate the mapping relationship between the newly added network namespace and the intermediate network namespace.

[0084] Step 306: Mount the newly added network namespace to the intermediate network namespace according to the mapping relationship.

[0085] For example, the server may mount the newly added network namespace onto the intermediate network namespace based on the mapping relationship; for example, the server may mount the newly added network namespace onto the intermediate network namespace based on a mapping table between the newly added network namespace and the intermediate network namespace.

[0086] In an exemplary embodiment, Figure 4As shown, when the server detects that a new network namespace has been created in the system, it can determine at least one idle network namespace for pre-monitoring based on indicators such as CPU usage, memory usage, and number of network connections of the pre-created network namespace, and randomly determine an idle network namespace from the at least one idle network namespace as an intermediate network namespace; then, the server can mount the new network namespace to the intermediate network namespace based on the mapping relationship between the new network namespace and the intermediate network namespace.

[0087] In this embodiment, by pre-monitoring idle network namespaces and determining an intermediate network namespace from the idle network namespace when a newly added network namespace is detected, the intermediate network namespace is used as a mount point so that the newly added network namespace can be mounted on the intermediate network namespace. Moreover, by constructing a mapping relationship between the newly added network namespace and the intermediate network namespace, when a resource access request is received, the resource access request can be accurately and quickly sent to the newly added network namespace based on the mapping relationship and through the monitored intermediate network namespace, which is conducive to rapid access and response of system resources and improves the efficiency of resource access.

[0088] In one embodiment, when a newly added network namespace is detected, determining at least one idle network namespace to be pre-monitored includes:

[0089] In the case of monitoring a new space request from a target tenant, a new network namespace is created for the target tenant, and at least one pre-monitored idle network namespace is determined.

[0090] A target tenant in a multi-tenant environment currently requires the creation of a new network namespace. A tenant is an independent entity using system resources or services, and each tenant may have its own business needs and data isolation requirements. In a multi-tenant architecture, different tenants share the system infrastructure, but their data and resources are isolated from each other. A target tenant may be a new tenant for whom a dedicated network namespace needs to be created to meet their business needs, or an existing tenant requiring a new network namespace due to business expansion or other reasons. For example, on a cloud computing platform with multiple enterprises as tenants, when one of them requests to expand its network namespace, it becomes the target tenant. A new namespace request is a request sent by a target tenant to the system to create a new network namespace. A new namespace request may include the target tenant's specific requirements, such as desired network resource configuration and security requirements. A new namespace request triggers the creation of a new network namespace.

[0091] Exemplarily, when the server detects a new space request from the target tenant, it can create a new network namespace for the target tenant and determine at least one idle network namespace for pre-monitoring; for example, on a multi-tenant cloud service platform, the server can continuously monitor the interfaces of each tenant. When a tenant sends a specific space request, the server can create an independent new network namespace for the target tenant. After the new network namespace is created, it can determine at least one idle network namespace for pre-monitoring.

[0092] In an exemplary embodiment, a new network namespace can be added using the command ip netns add<tenant_name> (i.e., the command to create a new network namespace) Create an independent new network namespace for each new tenant or tenant with expansion needs.<tenant_name> In [1], ip can be a Linux network configuration tool used to manage network devices, routes, addresses, etc.; netns (network namespace) can be an isolation mechanism provided by the Linux kernel, used to isolate network resources and configurations into different logical spaces; add means creating or adding a new network namespace;<tenant_name> Indicates the name of the network namespace to be created.<tenant_name> You can name it according to actual needs, such as the tenant name (tenant_name) or other identifiers. For example, the network namespace created for tenant A can be named tenant_A.

[0093] After the new network namespace is added, the server can configure network resources for the new network namespace, such as adding a virtual network card, setting an IP address, configuring a routing table, etc. In specific implementation, the server can use the veth pair (virtual Ethernet device pair) method to add a virtual network card to the target tenant's new network namespace and assign an IP address. At the same time, the server can also use the command ip netns exec<tenant_name> ip route show checks the routing table of the namespace and configures routing as needed; ip netns exec indicates the subcommand that executes the command in the specified network namespace, that is,<tenant_name> The subcommands of the command executed in the command, ip route is the command used to manage the routing table, and show is the subcommand used to display the current routing table information.

[0094] In this embodiment, by monitoring the target tenant's space addition request, it is possible to quickly respond and create a new network namespace for the target tenant to meet the immediate needs of the target tenant. At the same time, creating an independent network namespace for each tenant is conducive to achieving resource isolation between tenants, thereby improving the security and stability of the system.

[0095] In one embodiment, the system resource access method further includes:

[0096] When a deletion instruction for a newly added network namespace is detected, the newly added network namespace is deleted, and the mapping relationship is released to release the intermediate network namespace and restore it to an idle network namespace.

[0097] Among them, the deletion instruction refers to an instruction used to instruct the server to execute the deletion of the newly added network namespace; the deletion instruction can be an instruction automatically generated by the server based on the usage rights or usage period of the newly added network namespace, or it can be an instruction actively issued by the target tenant based on its own usage needs. For example, on a cloud service platform, when the target tenant no longer needs to use a newly added network namespace, the target tenant can clean up the resources by issuing a deletion instruction. When the newly added network namespace is deleted, the mapping relationship between the intermediate network namespace and it needs to be released. After the mapping relationship is released, the intermediate network namespace can be restored to an idle network namespace and wait for new tasks or connections.

[0098] Illustratively, the server may delete the newly added network namespace upon detecting a deletion instruction for the newly added network namespace, and release the mapping relationship to release the intermediate network namespace and restore it to the idle network namespace; for example, when the target tenant no longer needs the newly added network namespace, the target tenant issues a deletion instruction for the newly added network namespace to the server. The server may uninstall the newly added network namespace upon detecting the deletion instruction issued by the target tenant, and when the uninstallation is completed, the server releases the mapping relationship between the newly added network namespace and the intermediate network namespace to release the intermediate network namespace, so that the intermediate network namespace can be restored to the idle network namespace.

[0099] In this embodiment, when a deletion instruction is detected, it can quickly respond and delete the newly added network namespace, effectively reclaiming system resources, avoiding idle resources and waste, and helping to improve overall resource utilization. At the same time, by releasing the mapping relationship, the intermediate network namespace can be released and restored to the idle network namespace, facilitating subsequent rapid allocation and reuse.

[0100] In one embodiment, verifying access rights of a resource access request for a newly added network namespace includes:

[0101] Determine access permission information according to the resource access request; determine access permission of the resource access request for the newly added network namespace based on the access permission information, and verify the access permission of the resource access request according to the access permission.

[0102] Access rights information refers to the permission rules and data related to resource access, which define the access rights of different clients or users to specific resources. Access rights information can be obtained based on the system resource identifier, access method (e.g., read, write, delete), and client identity information (or permission information) in the resource access request. Access rights information may include, but is not limited to, the user's identity, role, and corresponding resource access rights level (e.g., read-only, read-write, or no permissions). For example, in an enterprise's file management system, access rights information may include stipulating that ordinary employees can only read department files (read-only permission), while department managers can read and modify department files (read-write permission). Access rights information can be stored in the system's rights management database and retrieved using the identity information (e.g., username and password) provided by the user during login. Access rights verification can be used to check and confirm resource access requests based on the access rights information to determine whether the client or user has permission to access specific resources in the newly added network namespace. Only resource access requests that pass verification are allowed to continue accessing system resources; otherwise, they will be denied.

[0103] Exemplarily, the server can determine access permission information based on the resource access request; for example, the server can determine access permission information such as the user's identity, role, and corresponding resource access permission level based on the system resource identifier, access method, and client identity information contained in the resource access request. Based on the access permission information, the server can determine the access permission granted by the resource access request for the newly added network namespace, and verify the access permission granted by the resource access request based on the access permission. For example, the server can determine the access permission granted by the resource access request for the newly added network namespace based on the user's identity, role, and corresponding resource access permission level, and verify the access permission granted by the resource access request based on the access permission.

[0104] In this embodiment, by identifying the access permission information of the resource access request and verifying the access permission of the resource access request based on the access permission information, access by persons without access permission can be effectively prevented, which is beneficial to protecting the security of resources in the network namespace.

[0105] In one embodiment, the system resource access method further includes:

[0106] When a user login request for a newly added network namespace is detected, the user login request is obtained, and user information and login environment information of the user login request are determined based on the user login request; and login permissions for the newly added network namespace targeted by the user login request are verified based on the user information and login environment information.

[0107] A user login request is a request sent by a user (or a client program acting on their behalf) to the system to access a newly added network namespace. This request may include, but is not limited to, the user's identity information (such as username, password, and digital certificate) and information about the target (i.e., the newly added network namespace) being requested. For example, when an employee wishes to access an internal office system built on a newly added network namespace, they enter their username and password on the login screen and click the Login button. The server then receives the employee's login request.

[0108] User information refers to data extracted from user login requests that is used to identify the user's identity and characteristics. User information may include, but is not limited to, user name, user ID, digital certificate, biometrics, user role, and other user attributes (such as department, permissions), etc. The server can identify the user based on the user information and provide corresponding services and permissions. Login environment information refers to environmental data related to the user's login request. Login environment information may include, but is not limited to, login device, login time, login IP address, browser type, etc.; login environment information helps the server evaluate the security and legitimacy of the user's login request. Login permission verification refers to the process of verifying the login permission of the newly added network namespace targeted by the user's login request based on user information and login environment information. The server can determine whether the user has permission to enter the newly added network namespace and whether the login environment meets security requirements based on the verification results.

[0109] Exemplarily, the server may obtain a user login request upon detecting a user login request for a newly added network namespace. For example, when a user logs in to a newly added network namespace through a client, the server may detect the user login request and, upon detecting the user login request, obtain the user login request. The server may determine user information and login environment information of the user login request based on the user login request. For example, the server may parse the user login request to obtain user information such as the user name, user ID, digital certificate, biometrics, user role, and other user attributes, as well as login environment information such as the login device, login time, login IP address, and browser type contained in the user login request. The server may verify login permissions for the newly added network namespace targeted by the user login request based on the user information and login environment information. For example, the server may verify whether the user has permission to enter the newly added network namespace and whether the login environment meets security requirements based on user information such as the user name, user ID, digital certificate, biometrics, user role, and other user attributes, as well as login environment information such as the login device, login time, login IP address, and browser type.

[0110] Furthermore, access permission information is determined based on the resource access request, including:

[0111] When the login authority verification of the user login request is passed, the access authority information is determined according to the resource access request.

[0112] Among them, when verifying the login permission of the newly added network namespace targeted by the user login request, the verification results may include two types: verification passed or verification failed. When the login permission verification of the user login request passes, it means that the user has the permission to enter the newly added network namespace and the login environment meets the security requirements. Then, the access permission information of subsequent resource access requests can be determined. Otherwise, login will not be allowed.

[0113] For example, the server may determine the access permission information based on the resource access request if the login permission verification of the user login request passes. In other embodiments, the server may also deny the user login request if the login permission verification of the user login request fails, and feedback the login failure information to the client or user.

[0114] This embodiment effectively prevents unauthorized logins and enhances system security by monitoring user login requests in real time and accurately capturing user and login environment information. During the verification process, the login permissions for newly added network namespaces are meticulously verified, combining user information with the login environment to ensure the accuracy of permission allocation. After the login permission verification is passed, resource access permission information is further determined. This dual verification mechanism enables progressive permission control, ensuring the security of system resources while improving resource access flexibility and management efficiency.

[0115] In one embodiment, sending a resource access request to a newly added network namespace through an intermediate network namespace includes:

[0116] Determine the intermediate network namespace to which the newly added network namespace is mounted and the mapping relationship between the newly added network namespace and the intermediate network namespace; and send the resource access request to the newly added network namespace through the intermediate network namespace based on the mapping relationship.

[0117] For example, the server can determine the intermediate network namespace mounted on the newly added network namespace and the mapping relationship between the newly added network namespace and the intermediate network namespace. For example, the server can determine the mapping relationship between the newly added network namespace and the intermediate network namespace based on a mapping table between the newly added network namespace and the intermediate network namespace, and determine the intermediate network namespace mounted on the newly added network namespace based on the mapping relationship. The server can send resource access requests to the newly added network namespace through the intermediate network namespace based on the mapping relationship. For example, the server can control the edge gateway to send resource access requests to the newly added network namespace through the intermediate network namespace based on the mapping relationship.

[0118] In this embodiment, by determining the mapping relationship between the newly added network namespace and the intermediate network namespace and the intermediate network namespace mounted by the newly added network namespace, resource access requests can be quickly and accurately forwarded to the target newly added network namespace through the intermediate network namespace, thereby improving the access efficiency and targeting of system resources.

[0119] In one embodiment, if the access permission verification result indicates that the verification is passed, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request, including:

[0120] When the access permission verification result indicates that the verification is passed, the current network environment of the network system and the system resource type corresponding to the resource access request are determined; when the current network environment does not match the system resource type, the current network environment is converted into a target network environment that matches the system resource type; when the network system is in the target network environment, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns the access response result obtained by processing the resource access request.

[0121] Among them, the current network environment of the network system refers to the network configuration and status of the network system at the current moment. The network environment may include information such as the network connection range, network topology, network bandwidth, network protocol, and security policy. The system resource type refers to the category of the resource to which the resource access request is directed. System resources of different resource types can support their access through different network environments. According to the access rights of the system resources, the system resource types may include intranet resources and extranet resources (or public network resources). According to the functional attributes of the system resources, the system resource types may include file resources, database resources, computing resources, etc. The target network environment is a network environment that matches the system resource type. The target network environment has a network configuration and status suitable for access to the system resource. When the current network environment cannot meet the access requirements of the system resource type, the current network environment needs to be converted to the target network environment.

[0122] Exemplarily, the server can determine the current network environment of the network system and the type of system resource corresponding to the resource access request when the access permission verification result indicates that the verification is passed; for example, the server can determine the current network environment of the network system by detecting the network, obtaining the network configuration, and reading the network log, and determine the corresponding system resource type by parsing the resource access request when the access permission verification result indicates that the verification is passed. The server can convert the current network environment into a target network environment that matches the system resource type when the current network environment does not match the system resource type; for example, when the server cannot access the system resource through the current network environment, it can convert the network address of the current network environment into the network address of the target network environment that matches the system resource type. The server can send the resource access request to the newly added network namespace through the intermediate network namespace when the network system is in the target network environment, so that the newly added network namespace returns the access response result obtained by processing the resource access request.

[0123] In this embodiment, by identifying and adjusting the network environment to match the system resource type, the compatibility and efficiency of resource access are improved. Moreover, after the current network environment is converted to the target network environment, the intermediate network namespace is used to forward the resource access request to the newly added network namespace in the target network environment, thereby ensuring access to the corresponding system resources.

[0124] In an exemplary embodiment, Figure 5 As shown in the figure, the current network environment is the extranet, the target network environment is the intranet, and the system resource type accessed by the resource access request is an intranet resource. When a user accesses a resource on the system, the client sends the resource access request through a tunnel to the edge gateway. The edge gateway captures the resource access request through a transparent proxy and verifies the access rights of the resource access request. At this time, if the resource the user is accessing belongs to the intranet and the user's current network environment is the extranet, when accessing through the extranet, the access process will return from the edge gateway to the connector end. The connector uses intranet penetration technology to convert the extranet address to the intranet address to ensure extranet access connectivity of the intranet service. At the same time, the network traffic control module of the edge gateway monitors network traffic and intercepts and analyzes suspicious traffic.

[0125] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0126] Based on the same inventive concept, embodiments of the present application also provide a system resource access device for implementing the aforementioned system resource access method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in one or more embodiments of the system resource access device provided below can be found in the above-mentioned limitations on the system resource access method and will not be repeated here.

[0127] In an exemplary embodiment, Figure 6 As shown, a system resource access device is provided, including: a request receiving module 602, a permission verification module 604, a request sending module 606 and a result receiving module 608, wherein:

[0128] a request receiving module 602 for receiving a resource access request for a system resource in a newly added network namespace of the network system; the newly added network namespace is mounted on an intermediate network namespace, and the intermediate network namespace is determined from at least one idle network namespace pre-monitored for the network system;

[0129] The permission verification module 604 is used to verify the access rights of the resource access request for the newly added network namespace and obtain an access rights verification result;

[0130] A request sending module 606 is configured to send the resource access request to the newly added network namespace via the intermediate network namespace if the access permission verification result indicates that the verification is passed, so that the newly added network namespace returns an access response result obtained by processing the resource access request;

[0131] The result receiving module 608 is configured to receive the access response result returned by the newly added network namespace via the intermediate network namespace.

[0132] In an optional embodiment, the above-mentioned device also includes a space mounting module, which is used to determine at least one idle network namespace for pre-monitoring when a newly added network namespace is detected, and determine an intermediate network namespace from at least one idle network namespace according to the space determination method; determine the identification information of the newly added network namespace, and construct a mapping relationship between the newly added network namespace and the intermediate network namespace based on the identification information; and mount the newly added network namespace on the intermediate network namespace according to the mapping relationship.

[0133] In an optional embodiment, the space mounting module is further configured to create a new network namespace for the target tenant when a new space request from the target tenant is detected, and determine at least one idle network namespace that has been pre-monitored.

[0134] In an optional embodiment, the above-mentioned device also includes a space deletion module, which is used to delete the newly added network namespace when a deletion instruction for the newly added network namespace is detected, and to release the mapping relationship to release the intermediate network namespace and restore it to the idle network namespace.

[0135] In an optional embodiment, the permission verification module 604 is further used to determine access permission information based on the resource access request; based on the access permission information, determine the access permission of the resource access request for the newly added network namespace, and verify the access permission of the resource access request based on the access permission.

[0136] In an optional embodiment, the apparatus further includes a login verification module configured to, upon detecting a user login request for a newly added network namespace, obtain the user login request, determine user information and login environment information associated with the user login request based on the user login request, and verify login permissions for the newly added network namespace associated with the user login request based on the user information and login environment information. The permission verification module 604 is further configured to, if the login permission verification for the user login request passes, determine access permission information based on the resource access request.

[0137] In an optional embodiment, the request sending module 606 is also used to determine the intermediate network namespace mounted on the newly added network namespace and the mapping relationship between the newly added network namespace and the intermediate network namespace; according to the mapping relationship, the resource access request is sent to the newly added network namespace through the intermediate network namespace.

[0138] In an optional embodiment, the request sending module 606 is also used to determine the current network environment of the network system and the system resource type corresponding to the resource access request when the access permission verification result indicates that the verification is passed; when the current network environment does not match the system resource type, the current network environment is converted into a target network environment that matches the system resource type; when the network system is in the target network environment, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request.

[0139] Each module in the above-mentioned system resource access device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0140] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, memory and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data such as resource access requests, newly added network namespaces, intermediate network namespaces, idle network namespaces, access permissions, access response results, mapping relationships, etc. The I / O interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a system resource access method is implemented.

[0141] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0142] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the system resource access method of the above embodiment when executing the computer program.

[0143] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the system resource access method of the above embodiment is implemented.

[0144] In one embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the system resource access method of the above embodiment is implemented.

[0145] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data confirmed by the user or fully confirmed by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0146] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), data processing logic of programmable logic devices (PLDs), artificial intelligence (AI) processors, and the like.

[0147] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0148] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A system resource access method, characterized in that: The method comprises: receiving a resource access request for a system resource in a newly added network namespace of a network system; the newly added network namespace is mounted on an intermediate network namespace, the intermediate network namespace being determined from at least one idle network namespace pre-monitored for the network system; Verifying the access rights of the resource access request for the newly added network namespace to obtain an access rights verification result; If the access permission verification result indicates that the verification is passed, sending the resource access request to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request; Receive the access response result returned by the newly added network namespace through the intermediate network namespace.

2. The method according to claim 1, characterized in that The method further comprises: In the case of detecting a newly added network namespace, determining at least one idle network namespace that has been pre-monitored, and determining an intermediate network namespace from the at least one idle network namespace according to a space determination method; Determine identification information of the newly added network namespace, and establish a mapping relationship between the newly added network namespace and the intermediate network namespace based on the identification information; According to the mapping relationship, the newly added network namespace is mounted on the intermediate network namespace.

3. The method according to claim 2, characterized in that The step of determining at least one idle network namespace to be pre-monitored when a newly added network namespace is detected includes: In the case of monitoring a new space request from a target tenant, a new network namespace is created for the target tenant, and at least one pre-monitored idle network namespace is determined.

4. The method according to claim 2, characterized in that The method further comprises: In the case where a deletion instruction for the newly added network namespace is detected, the newly added network namespace is deleted, and the mapping relationship is released to release the intermediate network namespace and restore it to an idle network namespace.

5. The method according to claim 1, characterized in that The verifying the access rights of the resource access request for the newly added network namespace includes: determining access permission information according to the resource access request; Based on the access permission information, the access permission of the resource access request for the newly added network namespace is determined, and the access permission of the resource access request is verified according to the access permission.

6. The method according to claim 5, characterized in that The method further comprises: When a user login request for the newly added network namespace is detected, obtaining the user login request, and determining user information and login environment information of the user login request according to the user login request; Verifying the login permission of the newly added network namespace targeted by the user login request based on the user information and the login environment information; The determining access permission information according to the resource access request includes: In a case where the login authority verification of the user login request is passed, access authority information is determined according to the resource access request.

7. The method according to claim 1, characterized in that The sending the resource access request to the newly added network namespace through the intermediate network namespace includes: Determine the intermediate network namespace to which the newly added network namespace is mounted and a mapping relationship between the newly added network namespace and the intermediate network namespace; According to the mapping relationship, the resource access request is sent to the newly added network namespace through the intermediate network namespace.

8. The method according to any one of claims 1 to 7, characterized in that When the access permission verification result indicates that the verification is passed, sending the resource access request to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request, including: If the access permission verification result indicates that the verification is passed, determining the current network environment of the network system and the system resource type corresponding to the resource access request; If the current network environment does not match the system resource type, converting the current network environment into a target network environment that matches the system resource type; When the network system is in the target network environment, the resource access request is sent to the newly added network namespace through the intermediate network namespace, so that the newly added network namespace returns an access response result obtained by processing the resource access request.

9. A system resource access device, characterized in that: The device comprises: a request receiving module, configured to receive a resource access request for a system resource in a newly added network namespace of the network system; the newly added network namespace is mounted on an intermediate network namespace, the intermediate network namespace being determined from at least one idle network namespace pre-monitored for the network system; An authority verification module is used to verify the access rights of the resource access request for the newly added network namespace and obtain an access rights verification result; a request sending module, configured to send the resource access request to the newly added network namespace via the intermediate network namespace if the access permission verification result indicates that the verification is passed, so that the newly added network namespace returns an access response result obtained by processing the resource access request; The result receiving module is configured to receive the access response result returned by the newly added network namespace through the intermediate network namespace.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images