Construction method and system of access link, access method and system, equipment and storage medium

Abstract

One or more embodiments of the invention provide an access link construction method, an access method, a system, equipment, a storage medium and a product. A gateway server to which a public network access address is allocated is deployed in the public cloud environment; at least one gateway client is deployed in the private domain environment; the access link construction method is applied to a gateway server, and comprises the following steps: maintaining at least one communication channel between the gateway server and a gateway client; the communication channel is established and obtained by the gateway client based on a public network access address provided by the public cloud environment and the gateway server, and the communication channel carries an identifier of the gateway client; obtaining an identifier of a specified gateway client input by a user and an access address of a specified database in the private domain environment; and constructing an access link between the public cloud environment and the private domain environment based on the communication channel pointed by the identifier of the specified gateway client and the access address of the specified database. And the data security is ensured and the configuration is simple.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of data access technology, and in particular, to a method for constructing an access link, an access method based on an access link, an access system, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] In related technologies, tool products (DMS, DTS, DBS) need to access user databases for data management, data migration, or data backup. In one application scenario, the tool product is located in a public cloud environment, while the user database is located in a private domain. The public cloud and private domain environments are disconnected, so a method to access the database in the private domain is needed. Summary of the Invention

[0003] In view of this, one or more embodiments of this specification provide a method for constructing an access link, an access method based on an access link, an access system, an electronic device, a computer-readable storage medium, and a computer program product.

[0004] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0005] According to a first aspect of one or more embodiments of this specification, a method for constructing an access link is provided, wherein the access link is used to enable an application in a public cloud environment to access a database in a private domain environment through the access link; a gateway server assigned a public network access address is deployed in the public cloud environment; and at least one gateway client is deployed in the private domain environment. The method, applied to the gateway server, includes:

[0006] Maintaining at least one communication channel between the gateway server and the gateway client; the communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries an identifier of the gateway client;

[0007] Obtaining an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user;

[0008] Based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, an access link is constructed between the public cloud environment and the private domain environment. According to a second aspect of one or more embodiments of this specification, an access method based on an access link is proposed, wherein the access link is constructed based on the access link construction method described in the first aspect; the method is applied to the gateway server, and includes:

[0009] Receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment;

[0010] transmitting the access request through an access link corresponding to the target database, and receiving an access response returned by the target database based on the access request;

[0011] The access response is forwarded to the application in the public cloud environment.

[0012] According to a third aspect of an embodiment of the present disclosure, an access system is provided, comprising a gateway server and a gateway client; the gateway server is deployed in a public cloud environment and is assigned a public network access address; the gateway client is deployed in a private domain environment;

[0013] The gateway client is configured to establish at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, wherein the communication channel carries an identifier of the gateway client;

[0014] The gateway server is configured to maintain at least one communication channel between itself and the gateway client; obtain an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user; and construct an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, so that applications in the public cloud environment can access the database in the private domain environment through the access link.

[0015] According to a fourth aspect of the embodiments of the present disclosure, there is provided an electronic device, including:

[0016] processor;

[0017] a memory for storing processor-executable instructions;

[0018] When the processor executes the executable instructions, it is used to implement the method described in the first aspect or the second aspect.

[0019] According to a fifth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of any of the above methods are implemented.

[0020] According to a sixth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program, which implements the steps of any of the above methods when executed by a processor.

[0021] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0022] In the disclosed embodiments, only the gateway server needs to be deployed in the public cloud environment and the gateway client needs to be deployed in the private domain environment. There is no need to directly open database ports or build complex network connections such as VPNs, thereby simplifying deployment and management. Furthermore, only the gateway client can actively establish a communication connection with the gateway server based on the public network access address, ensuring that the private domain environment only provides access rights to trusted public cloud environments. This can avoid the data security risks associated with directly opening database ports on the public network. Furthermore, the gateway server can only access the designated database in the private domain environment through authorized gateway clients, thereby improving data security. The gateway server can maintain at least one communication channel between the gateway server and the gateway client, and then the gateway server obtains the user-entered identifier of the designated gateway client and the access address of the designated database in the private domain environment. Based on the communication channel pointed to by the designated gateway client identifier and the access address of the designated database in the private domain environment, an access link is established between the public cloud environment and the private domain environment. Users only need to enter the identifier of the designated gateway client and the access address of the designated database in the private domain environment in accordance with actual needs, eliminating the need for a complex configuration process and simplifying user configuration operations.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a structural diagram of an interactive system provided by an exemplary embodiment.

[0025] Figure 2 It is a structural diagram of another interactive system provided by an exemplary embodiment.

[0026] Figure 3 It is a structural diagram of another interactive system provided by an exemplary embodiment.

[0027] Figure 4 This is an interactive diagram of establishing an access link provided by an exemplary embodiment.

[0028] Figure 5 This is another interactive schematic diagram of establishing an access link provided by an exemplary embodiment.

[0029] Figure 6 It is a schematic diagram of access based on an access link provided by an exemplary embodiment.

[0030] Figure 7 This is a flowchart of a method for establishing an access link provided by an exemplary embodiment.

[0031] Figure 8 This is a flowchart of an access method based on an access link provided by an exemplary embodiment.

[0032] Figure 9 It is a structural diagram of an electronic device provided by an exemplary embodiment. DETAILED DESCRIPTION

[0033] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The implementations described in the following exemplary embodiments are not intended to represent all implementations consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of one or more embodiments of this specification, as detailed in the appended claims.

[0034] It should be noted that in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the method may include more or fewer steps than those described in this specification. In addition, a single step described in this specification may be broken down into multiple steps for description in other embodiments, and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0035] In related technologies, tool products (DMS, DTS, DBS) need to access user databases for data management, data migration, or data backup.

[0036] A Database Management System (DMS) is a database management system that provides a graphical interface and tools for managing and monitoring databases. It helps administrators perform operations such as creating, configuring, and backing up databases, while also providing performance optimization, security management, and fault recovery capabilities. DMS supports a variety of database engines, including MySQL, Oracle, and SQL Server.

[0037] DTS (Data Transmission Service) is a data transmission service used to migrate, synchronize, and transfer data between different databases. It supports data migration between different database engines and data synchronization between different data centers. DTS provides a simplified configuration interface and tools, making data migration and synchronization more convenient and reliable.

[0038] DBS (Database Backup Service) is a database backup service that regularly backs up databases and protects data security. It provides automatic, incremental, and full backups, and supports cross-region and cross-account backups to ensure data reliability and recoverability. DBS also provides visual backup monitoring and recovery features, allowing administrators to easily manage and operate backup data.

[0039] In one application scenario, tool products are located in a public cloud environment, and user databases are located in a private domain environment. The public cloud environment and the private domain environment are not connected, so a method is needed to access the database in the private domain environment.

[0040] For example, a public cloud environment refers to a cloud computing platform provided by a third-party cloud service provider. In a public cloud environment, users can access and use computing resources provided by the cloud service provider, such as virtual machines, storage space, and databases, via the internet. Public cloud environments are elastic, scalable, and flexible, allowing users to dynamically allocate and release computing resources based on demand while enjoying the high availability, security, and manageability provided by the cloud service provider.

[0041] A private on-premises environment (PVE) refers to computing resources deployed within an enterprise's own data center or within the enterprise. Computing resources in a PVE are completely owned and managed by the enterprise, and users can access and use these resources within the internal network. PVEs are typically used in scenarios requiring stricter control and data protection, such as those involving sensitive information in enterprises and institutions. PVEs can be customized to meet specific security and performance requirements, but they also require significant cost and effort to maintain and manage.

[0042] In related technologies, methods for accessing databases in private domain environments include but are not limited to:

[0043] (1) Users directly open the server address to the public network. However, directly opening the database port to the public network increases the risk of being attacked and reduces data security.

[0044] (2) Users build a dedicated network between the public cloud environment and the private domain environment or use a VPN. VPN (Virtual Private Network) is a technology that establishes an encrypted and secure connection over a public network (such as the Internet). However, this method is complex to build, requires a complicated configuration process, and is cumbersome to operate.

[0045] Based on this, embodiments of this specification provide a method for establishing an access link, enabling applications in a public cloud environment to access databases in a private domain environment through the established access link. This method is implemented using a gateway server and a gateway client. A gateway server, assigned a public network access address, can be deployed in the public cloud environment, and at least one gateway client can be deployed in the private domain environment.

[0046] The gateway client actively establishes at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, so that the gateway server can maintain at least one communication channel between the gateway server and the gateway client, and then the gateway server obtains the identifier of the designated gateway client entered by the user and the access address of the designated database in the private domain environment; based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, an access link is established between the public cloud environment and the private domain environment.

[0047] In this embodiment, the gateway server in the public cloud environment does not know the access address of the private domain environment. The gateway client can only actively establish a communication connection with the gateway server based on the public network access address, so that the private domain environment only opens access rights to the trusted public cloud environment, which can avoid the data security risks brought by directly opening the database port on the public network. At the same time, the gateway server can only access the specified database in the private domain environment through the authorized gateway client, thereby improving data security; and it is only necessary to deploy the gateway server in the public cloud environment and the gateway client in the private domain environment. There is no need to directly open the database port or build complex VPN and other network connection methods, thereby simplifying deployment and management work; the user only needs to enter the identifier of the specified gateway client and the access address of the specified database in the private domain environment in the public cloud environment according to actual needs, without the need for a complex configuration process, thereby simplifying the user's configuration operation.

[0048] The embodiments of this specification also provide an access method based on an access link, so that after the access link is established, an application in a public cloud environment can access a database in a private domain environment through the access link.

[0049] The following is an illustrative description of the technical solutions provided in the embodiments of this specification from a system perspective:

[0050] See also Figure 1The embodiments of this specification provide an access system, including a gateway server 10 and a gateway client 20. The gateway server 10 is deployed in a public cloud environment and is assigned a public network access address 11. The gateway client 20 is deployed in a private domain environment. The public cloud environment also has one or more applications 12 deployed, such as the aforementioned tool products (DMS, DTS, DBS). The private domain environment also has one or more databases 21 deployed.

[0051] The gateway client 20 is used to establish at least one communication channel with the gateway server 10 based on the public network access address 11 provided by the public cloud environment. The communication channel carries the identifier of the gateway client 20.

[0052] The gateway server 10 is used to maintain at least one communication channel between itself and the gateway client 20; obtain the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment input by the user; and build an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client 20 and the access address of the designated database 21, so that the application 12 in the public cloud environment can access the database 21 in the private domain environment through the access link.

[0053] In this embodiment, it is only necessary to deploy the gateway server 10 in the public cloud environment and the gateway client 20 in the private domain environment. Through the above implementation process, the effects of improving data security, simplifying deployment and management work, and simplifying user configuration operations can be achieved.

[0054] For example, see Figure 2 , Figure 2 Two private domain environments are shown as an example. When there are multiple private domain environments, at least one gateway client 20 can be deployed in each private domain environment. The gateway client 20 in each private domain environment establishes at least one communication channel with the gateway server 10 through the public network access address 11 provided by the public cloud environment.

[0055] Here we first illustrate the deployment process of the gateway client 20. Figure 3 The access system may further include a gateway control component 30 connected to the gateway server 10 , and the gateway control component 30 is deployed in a public cloud environment.

[0056] See also Figure 4 In response to user operation (1), the gateway control component 30 can provide the user with information such as a download link of the installation package of the gateway client 20, a deployment command, a public network access address 11, and a token issued to the gateway client 20 (2.1).

[0057] In addition, when providing the token issued to the gateway client 20 to the user, the gateway control component 30 writes the token into the token database 50 (2.2) for subsequent verification.

[0058] After the user obtains the download link of the installation package of the gateway client 20, the deployment command, the public network access address 11, and the token issued to the gateway client 20, the user can let any electronic device (3) in the private domain environment perform the following steps: based on the download link, download the download link of the installation package of the gateway client 20 from the second storage medium 40 (4), and then respond to the deployment command provided by the gateway control component 30 to run the installation package corresponding to the gateway client 20 in the private cloud environment to realize the deployment of at least one gateway client 20 in the private domain environment (5).

[0059] Any electronic device in the private domain environment can deploy multiple gateway clients 20 in the same private domain environment to achieve the purpose of load balancing.

[0060] Each gateway client 20 can access the public network access address 11 provided by the gateway control component 30 to establish at least one communication channel with the gateway server 10. Each communication channel carries the identifier of the gateway client 20. Exemplarily, the established communication channel includes a TCP communication channel. TCP (Transmission Control Protocol) communication channel is a reliable, connection-oriented communication protocol widely used in computer networks. It provides reliable data transmission and error recovery mechanisms, ensuring data accuracy and integrity.

[0061] It is understood that the gateway client 20 directly accesses the public network access address 11, and traffic from the private domain to the public network automatically passes through the private domain's public network NAT component (not shown). The public network NAT component is a network device that maps internal private IP addresses to public IP addresses to enable communication between the private domain's internal network and the public Internet.

[0062] After establishing a communication channel with the gateway server 10, each gateway client 20 can send a token issued by the gateway control component 30 through the communication channel. The gateway server 10 receives the token issued by the public cloud environment and sent by the gateway client 20 through the communication channel after the communication channel is established; authenticates the gateway client 20 based on the token and returns the verification result to the gateway client 20. In this embodiment, by using the token for identity authentication, the gateway server 10 can confirm whether the identity of the gateway client 20 is legal, which helps to prevent unauthorized access and potential security threats. And by using the token for identity authentication, the gateway server 10 can centrally manage and control access rights. The issuance and revocation of tokens can be performed on the gateway server 10 without the need for independent configuration and management on each gateway client 20, thereby simplifying management operations and maintenance.

[0063] For example, see Figure 4 After establishing a communication channel with the gateway server 10, each gateway client 20 can send a token (6) issued by the gateway control component 30 through the communication channel. After receiving the token to be detected sent by the gateway client 20 through the communication channel established by it, the gateway server 10 sends the token to be detected to the token database 50 for verification (7) and the token database 50 returns the verification result (8). For example, the database management system of the token database 50 detects whether the token to be detected exists in the token database 50. If it exists, the verification result is verification passed. If it does not exist, the verification result is verification failed. The gateway server 10 can return the verification result (9) to the gateway client 20.

[0064] The gateway server 10 can maintain the communication channel corresponding to the token in response to the verification result indicating that the token verification has passed; otherwise, the communication channel corresponding to the token is disconnected. In this embodiment, once the token verification is passed, the gateway server 10 will maintain the communication channel corresponding to the token, which means that the gateway client 20 can continuously communicate with the public cloud environment without having to re-establish the connection for each request, thereby improving communication efficiency and response speed. If the token verification fails or is revoked, the gateway server 10 can disconnect the communication channel corresponding to the token, which can prevent unauthorized access from continuing and promptly interrupt the connection with the client that may be at risk.

[0065] During the configuration process, the user can input the identifier of the designated gateway client 20 in the public cloud environment and the access address of the designated database 21 in the private domain environment according to actual needs. Figure 5, the user can input the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment in the gateway control component 30 (11). The gateway control component 30 is connected to the gateway server 10 and can send the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment input by the user to the gateway server 10 (12), so that the gateway server 10 can obtain the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment input by the user; then, based on the communication channel pointed to by the identifier of the designated gateway client 20 and the access address of the designated database 21, an access link between the public cloud environment and the private domain environment is constructed.

[0066] It is understandable that the embodiments of this specification do not impose any restrictions on the user's input method, and the user can use a touch screen, mouse, stylus, keyboard, physical buttons, voice input device or somatosensory input device, etc.

[0067] For example, see Figure 5 In order to improve the configuration accuracy, after obtaining the identifier of the designated gateway client 20 input by the user and the access address of the designated database 21 in the private domain environment, the gateway server 10 can send a detection command (13) to the designated gateway client 20 through the communication channel pointed to by the identifier of the designated gateway client 20. The detection command carries the access address of the designated database 21, so that the designated gateway client 20 responds to the detection command, detects the operation status of the designated database 21 (14) and returns a detection response (15) to the gateway server 10. By sending the detection command and receiving the detection response, the gateway server 10 can monitor the operation status of the designated database 21 in real time, which helps to timely discover whether the database 21 is operating normally, whether there are faults or instability, etc. In addition, the gateway client 20 can automatically build an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client 20 and the access address of the designated database 21 when the detection response indicates that the designated database 21 is operating normally. This embodiment realizes the automatic creation of access links without manual intervention during system operation, thereby simplifying the configuration and management process.

[0068] For some possible implementations, see Figure 5In the process of creating an access link, the gateway server 10 can allocate a reverse proxy address (16) for the application 12 in the public cloud environment to the access address of the specified database 21, and then build an access link between the application 12 in the public cloud environment and the database 21 in the private domain environment based on the reverse proxy address, the communication channel pointed to by the identifier of the specified gateway client 20, and the access address of the specified database 21. Among them, the reverse proxy address refers to the address of the intermediate server (or reverse proxy server) that forwards the access request of the application 12 in the public cloud environment to the server in the private domain environment. However, for the application 12 in the public cloud environment, the reverse proxy server is equivalent to the target server (that is, the server in the private domain environment), that is, the application 12 in the public cloud environment can obtain the resources of the target server by directly accessing the reverse proxy server. At the same time, the application 12 in the public cloud environment does not need to know the address of the target server and does not need to make any settings.

[0069] After building an access link between the application 12 in the public cloud environment and the database 21 in the private domain environment, the gateway server 10 can record the link information of the access link in the first storage medium 31 of the public cloud environment. The link information includes the mapping relationship between the reverse proxy address, the identifier of the specified gateway client 20, and the access address of the specified database 21.

[0070] For example, see Figure 5 , the gateway service end 10 may send the link information (17) of the access link to the gateway control component 30, so that the gateway control component 30 records the link information (18) of the access link in the first storage medium 31 of the public cloud environment.

[0071] After the access link is established, the gateway server 10 can receive an access request from an application 12 in the public cloud environment for a target database 21 in the private domain environment. The gateway server 10 then transmits the access request via the access link corresponding to the target database 21 and receives an access response from the target database 21 based on the access request. Finally, the gateway server 10 forwards the access response to the application 12 in the public cloud environment, thereby enabling the application 12 in the public cloud environment to access the database 21 in the private domain.

[0072] For example, see Figure 6 The gateway client 20 receives an access request (24) sent by the application 12 in the public cloud environment to the reverse proxy address corresponding to the target database 21 in the private domain environment. The reverse proxy address corresponding to the target database 21 is obtained from a storage medium storing link information of the access link corresponding to the target database 21.

[0073] Exemplarily, a user initiates an access request (21) for a target database 21 in an application 12 in a public cloud environment. The access request carries the access address of the target database 21. The application 12 in the public cloud environment calls a gateway control component 30 (22), so that the gateway control component 30 obtains the reverse proxy address (23) corresponding to the target database 21 from a first storage medium 31 storing link information of an access link corresponding to the target database 21 and returns the reverse proxy address to the application 12 in the public cloud environment. For example, the application 12 in the public cloud environment calls the gateway control component 30 and passes the access address of the target database 21 to the gateway control component 30. The gateway control component 30 searches for the reverse proxy address corresponding to the target database 21 from the mapping relationship stored in the first database 21 based on the access address of the target database 21 and returns the reverse proxy address to the application 12 in the public cloud environment.

[0074] After obtaining the reverse proxy address corresponding to the target database 21, the application 12 in the public cloud environment can directly send an access request (24) to the reverse proxy address.

[0075] After receiving an access request sent by an application 12 in a public cloud environment to a reverse proxy address corresponding to a target database 21, the gateway server 10 obtains the identifier of the target gateway client 20 corresponding to the target database 21 from the second storage medium 40 storing link information of the access link corresponding to the target database 21, and sends an access request (25) to the target gateway client 20 through the communication channel pointed to by the identifier of the target gateway client 20, so that the target gateway client 20 forwards the access request to the target database 21 for processing. Exemplarily, the access request carries the access address of the target database 21. The target gateway client 20 can establish a connection with the target database 21 based on the access address of the target database 21 and forward the access request to the target database 21 for processing. The target database 21 can return the access response generated after processing to the target gateway client 20 (26). Next, the target gateway client 20 receives the access response from the target database 21 and returns the access response to the gateway server 10 based on the above-mentioned communication channel (27). The gateway server 10 forwards the access response to the application 12 in the public cloud environment based on the reverse proxy address corresponding to the target database 21 (28).

[0076] It is understandable that the gateway control component 30 may not be set in the access system, but the functions of the gateway control component 30 may be integrated into the gateway server 10, and the gateway server 10 may execute the relevant functions of the gateway control component 30, such as the function of interacting with the user.

[0077] The various technical features in the above embodiments can be combined arbitrarily as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, the arbitrary combination of the various technical features in the above embodiments also falls within the scope of disclosure of this specification.

[0078] In some embodiments, see Figure 7 The embodiments of this specification provide a method for constructing an access link, wherein the access link is used to enable an application in a public cloud environment to access a database in a private domain environment through the access link; a gateway server assigned a public network access address is deployed in the public cloud environment; and at least one gateway client is deployed in the private domain environment. The method is applied to the gateway server and includes:

[0079] In S101, at least one communication channel is maintained between the gateway server and the gateway client. The communication channel is established between the gateway client and the gateway server based on a public network access address provided by the public cloud environment, and the communication channel carries an identifier of the gateway client.

[0080] In S102 , the identifier of the designated gateway client and the access address of the designated database in the private domain environment input by the user are obtained.

[0081] In S103 , an access link between the public cloud environment and the private domain environment is established based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database.

[0082] Based on the communication channel pointed to by the specified gateway client identifier and the access address of the specified database, an access link is established between the public cloud environment and the private domain environment, including:

[0083] Assign a reverse proxy address for applications in the public cloud environment to the access address of the specified database;

[0084] In some embodiments, an access link between an application in a public cloud environment and a database in a private domain environment is established based on a reverse proxy address, a communication channel pointed to by an identifier of a designated gateway client, and an access address of a designated database.

[0085] In some embodiments, it further includes:

[0086] Link information of the access link is recorded in a first storage medium in the public cloud environment, where the link information includes a mapping relationship between a reverse proxy address, an identifier of a designated gateway client, and an access address of a designated database.

[0087] In some embodiments, before establishing an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, the method further includes:

[0088] Sending a detection command to the designated gateway client through the communication channel pointed to by the identifier of the designated gateway client, the detection command carrying the access address of the designated database, so that the designated gateway client responds to the detection command, detects the operation status of the designated database and returns a detection response to the gateway server;

[0089] Based on the communication channel pointed to by the specified gateway client identifier and the access address of the specified database, an access link is established between the public cloud environment and the private domain environment, including:

[0090] If the detection response indicates that the specified database is operating normally, an access link between the public cloud environment and the private domain environment is established based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database.

[0091] In some embodiments, the gateway client deployed in the private domain environment is obtained by running the installation package corresponding to the gateway client in the private cloud environment in response to a deployment command provided by the public cloud environment; wherein, the installation package corresponding to the gateway client is downloaded from the second storage medium based on the download link provided by the public cloud environment.

[0092] In some embodiments, before maintaining at least one communication channel between the gateway server and the gateway client, the method further includes: receiving a token issued by the public cloud environment and sent by the gateway client through the communication channel after the communication channel is established; authenticating the gateway client based on the token, and returning a verification result to the gateway client. Maintaining at least one communication channel between the gateway server and the gateway client includes: maintaining the communication channel corresponding to the token in response to the verification result indicating that the token verification has passed; otherwise, disconnecting the communication channel corresponding to the token.

[0093] In some embodiments, a gateway control component connected to the gateway server is deployed in the public cloud environment; the public network access address, download link, deployment command and token are provided by the gateway control component.

[0094] In some embodiments, the communication channel comprises a TCP channel.

[0095] See also Figure 8 The embodiment of this specification also provides an access method based on an access link, wherein the access link is constructed based on any of the above-mentioned access link construction methods; the method is applied to the gateway server, including:

[0096] In S201 , an access request sent by an application in a public cloud environment to a target database in a private domain environment is received.

[0097] In S202, an access request is transmitted through an access link corresponding to a target database, and an access response returned by the target database based on the access request is received.

[0098] In S203 , the access response is forwarded to the application in the public cloud environment.

[0099] In some embodiments, receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment includes:

[0100] An access request is received from an application in a public cloud environment to a target database in a private domain environment, and is sent to a reverse proxy address corresponding to the target database; wherein the reverse proxy address is obtained from a first storage medium storing link information of an access link corresponding to the target database.

[0101] In some embodiments, transmitting an access request through an access link corresponding to a target database includes:

[0102] Acquire an identifier of a target gateway client corresponding to the target database from a first storage medium storing link information of an access link corresponding to the target database;

[0103] An access request is sent to the target gateway client through the communication channel pointed to by the identifier of the target gateway client, so that the target gateway client forwards the access request to the target database for processing.

[0104] The various technical features in the above embodiments can be combined arbitrarily as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, the arbitrary combination of the various technical features in the above embodiments also falls within the scope of disclosure of this specification.

[0105] In some embodiments of this specification, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor implements any of the above methods by running the executable instructions.

[0106] Figure 9 This is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 9At the hardware level, the device includes a processor 902, an internal bus 904, a network interface 906, a memory 908, and a non-volatile memory 910. Of course, it may also include hardware required for other scenarios. One or more embodiments of this specification can be implemented based on software, such as the processor 902 reading the corresponding computer program from the non-volatile memory 910 into the memory 908 and then running it. Of course, in addition to software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0107] In some embodiments, the embodiments of this specification further provide a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any of the methods described above.

[0108] In some embodiments, the embodiments of this specification further provide a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0109] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0110] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email transceiver, game console, tablet computer, wearable device, or any combination of these devices.

[0111] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0112] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0113] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0114] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0115] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "an," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0117] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when..." or "when..." or "in response to determining."

[0118] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this specification shall be included in the scope of protection of one or more embodiments of this specification.

Claims

1. A method for constructing an access link, wherein the access link is used to enable an application in a public cloud environment to access a database in a private domain environment through the access link; A gateway server allocated with a public network access address is deployed in the public cloud environment; at least one gateway client is deployed in the private domain environment; The method is applied to the gateway server and includes: Maintaining at least one communication channel between the gateway server and the gateway client; the communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries an identifier of the gateway client; Obtaining an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user; An access link between the public cloud environment and the private domain environment is established based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database.

2. The method according to claim 1, wherein establishing an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database comprises: Allocating a reverse proxy address for an application in the public cloud environment to an access address of the designated database; An access link between an application in a public cloud environment and a database in a private domain environment is established based on the reverse proxy address, the communication channel pointed to by the identifier of the designated gateway client, and the access address of the designated database.

3. The method according to claim 2, further comprising: Link information of the access link is recorded in a first storage medium of the public cloud environment, where the link information includes a mapping relationship between the reverse proxy address, an identifier of the designated gateway client, and an access address of the designated database.

4. The method according to claim 1, before establishing the access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, further comprising: Sending a probe command to the designated gateway client through the communication channel pointed to by the identifier of the designated gateway client, the probe command carrying the access address of the designated database, so that the designated gateway client responds to the probe command, detects the operation status of the designated database and returns a probe response to the gateway server; The step of constructing an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database includes: If the detection response indicates that the designated database is operating normally, an access link between the public cloud environment and the private domain environment is established based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database.

5. The method according to claim 1, wherein the gateway client deployed in the private domain environment is obtained by running an installation package corresponding to the gateway client in the private cloud environment in response to a deployment command provided by the public cloud environment; in, The installation package corresponding to the gateway client is downloaded from the second storage medium based on the download link provided by the public cloud environment.

6. The method according to claim 5, before maintaining at least one communication channel between the gateway server and the gateway client, further comprising: receiving a token issued by the public cloud environment and sent by the gateway client through the communication channel after the communication channel is established; authenticating the gateway client based on the token and returning a verification result to the gateway client; Maintaining at least one communication channel between the gateway server and the gateway client includes: In response to the verification result indicating that the token passes verification, maintaining a communication channel corresponding to the token; Otherwise, the communication channel corresponding to the token is disconnected.

7. The method according to claim 6, wherein a gateway control component connected to the gateway server is deployed in the public cloud environment; the public network access address, the download link, the deployment command, and the token are provided by the gateway control component; and / or The communication channel includes a TCP channel.

8. An access method based on an access link, wherein the access link is constructed based on the access link construction method according to any one of claims 1 to 7; The method is applied to the gateway server and includes: Receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment; transmitting the access request through an access link corresponding to the target database, and receiving an access response returned by the target database based on the access request; The access response is forwarded to the application in the public cloud environment.

9. The method according to claim 8, wherein receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment comprises: An access request is received from an application in a public cloud environment to a target database in a private domain environment, and is sent to a reverse proxy address corresponding to the target database; wherein the reverse proxy address is obtained from a first storage medium that stores link information of an access link corresponding to the target database.

10. The method according to claim 8, wherein transmitting the access request through the access link corresponding to the target database comprises: Acquire an identifier of a target gateway client corresponding to the target database from a first storage medium storing link information of an access link corresponding to the target database; The access request is sent to the target gateway client through the communication channel pointed to by the identifier of the target gateway client, so that the target gateway client forwards the access request to the target database for processing.

11. An access system comprising a gateway server and a gateway client; The gateway server is deployed in a public cloud environment and is assigned a public network access address; The gateway client is deployed in a private domain environment; The gateway client is configured to establish at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, wherein the communication channel carries an identifier of the gateway client; The gateway server is configured to maintain at least one communication channel between itself and the gateway client; Obtaining an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user; Based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, an access link is constructed between the public cloud environment and the private domain environment so that applications in the public cloud environment can access the database in the private domain environment through the access link.

12. An electronic device comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 10 by running the executable instructions.

13. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program, which implements the steps of the method according to any one of claims 1 to 10 when the computer program is executed by a processor.

Images