Access link construction method, access method, system, device and storage medium

Abstract

One or more embodiments of the specification provide a method for constructing an access link, an access method, a system, a device, a storage medium and a product. A gateway server assigned with a public network access address is deployed in a public cloud environment; at least one gateway client is deployed in a private domain environment; the method for constructing an access link is applied to the gateway server, comprising: maintaining at least one communication channel between the gateway server and the gateway client; the communication channel is established by the gateway client based on the public network access address provided by the public cloud environment and the gateway server, and the communication channel carries the identifier of the gateway client; obtaining the identifier of the specified gateway client and the access address of the specified database in the private domain environment input by the user; based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link between the public cloud environment and the private domain environment is constructed. The safety of data is ensured and the configuration is simple.

Description

Technical Field

[0001] This specification relates to the field of data access technology, and more particularly to a method for constructing an access link, an access method based on an access link, an access system, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] In related technologies, tool-type products (DMS, DTS, DBS) need to access user databases for data management, data migration, or data backup. In one application scenario, the tool-type product is located in a public cloud environment, while the user database is located in a private domain environment. Since the public cloud environment and the private domain environment are not interconnected, a way to access the database in the private domain environment is needed. Summary of the Invention

[0003] In view of the above, one or more embodiments of this specification provide a method for constructing an access link, an access method based on the access link, an access system, an electronic device, a computer-readable storage medium, and a computer program product.

[0004] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions: According to a first aspect of one or more embodiments of this specification, a method for constructing an access link is provided, the access link being used to enable an application in a public cloud environment to access a database in a private domain environment through the access link; a gateway server with a public network access address is deployed in the public cloud environment; at least one gateway client is deployed in the private domain environment; the method is applied to the gateway server and includes: Maintain at least one communication channel between the gateway server and the gateway client; the communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries the identifier of the gateway client; Obtain the identifier of the specified gateway client and the access address of the specified database in the private domain environment, as input by the user; Based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link is constructed between the public cloud environment and the private domain environment. According to a second aspect of one or more embodiments of this specification, an access link-based access method is proposed, wherein the access link is constructed based on the access link construction method described in the first aspect; the method is applied to a gateway server and includes: Receive access requests from applications in a public cloud environment for target databases in a private domain environment; The access request is transmitted through the access link corresponding to the target database, and the access response returned by the target database based on the access request is received. The access response is forwarded to the application in the public cloud environment.

[0005] According to a third aspect of the present disclosure, an access system is provided, including a gateway server and a gateway client; the gateway server is deployed in a public cloud environment and is assigned a public network access address; the gateway client is deployed in a private domain environment. The gateway client is used to establish at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries the identifier of the gateway client; The gateway server is used to maintain at least one communication channel between itself and the gateway client; obtain the identifier of the specified gateway client input by the user and the access address of the specified database in the private domain environment; and construct an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, so that applications in the public cloud environment can access the database in the private domain environment through the access link.

[0006] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: processor; Memory used to store processor-executable instructions; Wherein, when the processor executes the executable instructions, it is used to implement the method described in the first aspect or the second aspect.

[0007] According to a fifth aspect of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps of any of the methods described above.

[0008] According to a sixth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of any of the methods described above.

[0009] The technical solutions provided by the embodiments of this disclosure may include the following beneficial effects: In this embodiment, only a gateway server needs to be deployed in the public cloud environment, and a gateway client in the private domain environment. It eliminates the need to directly open database ports or establish complex VPN or other network connection methods, thus simplifying deployment and management. Furthermore, only the gateway client can actively establish a communication connection with the gateway server based on its public network access address. This ensures that the private domain environment only grants access to trusted public cloud environments, avoiding the data security risks associated with directly opening database ports on the public network. Simultaneously, the gateway server can only access specified databases in the private domain environment through authorized gateway clients, improving data security. The gateway server can maintain at least one communication channel between itself and the gateway client. The gateway server can then obtain the identifier of the specified gateway client input by the user and the access address of the specified database in the private domain environment. Based on the communication channel pointed to by the specified gateway client identifier and the access address of the specified database, an access link between the public cloud environment and the private domain environment is constructed. Users only need to input the identifier of the specified gateway client in the public cloud environment and the access address of the specified database in the private domain environment according to their actual needs, eliminating the need for complex configuration processes and simplifying user configuration operations.

[0010] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the structure of an interactive system provided in an exemplary embodiment.

[0012] Figure 2 This is a schematic diagram of the structure of another interactive system provided in an exemplary embodiment.

[0013] Figure 3 This is a schematic diagram of the structure of another interactive system provided in an exemplary embodiment.

[0014] Figure 4 This is an exemplary embodiment of the interactive diagram for constructing an access link.

[0015] Figure 5 This is another interactive schematic diagram of constructing an access link provided in an exemplary embodiment.

[0016] Figure 6 This is a schematic diagram illustrating access based on an access link, provided in an exemplary embodiment.

[0017] Figure 7 This is a flowchart illustrating a method for constructing an access link, provided in an exemplary embodiment.

[0018] Figure 8This is a schematic diagram of an access method based on an access link, provided in an exemplary embodiment.

[0019] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment. Detailed Implementation

[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0021] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0022] In related technologies, tool-type products (DMS, DTS, DBS) need to access user databases for data management, data migration, or data backup.

[0023] A Database Management System (DMS) is a system that provides a graphical interface and tools for managing and monitoring databases. It helps administrators perform operations such as creating, configuring, and backing up databases, while also offering features like performance optimization, security management, and fault recovery. DMS supports various database engines, such as MySQL, Oracle, and SQL Server.

[0024] DTS (Data Transmission Service) is a data transfer service used to achieve data migration, synchronization, and real-time data transfer between different databases. It supports data migration between different database engines and data synchronization between different data centers. DTS provides a simplified configuration interface and tools, making data migration and synchronization more convenient and reliable.

[0025] DBS (Database Backup Service) is a database backup service used to regularly back up databases and protect data security. It offers features such as automatic backup, incremental backup, and full backup, while supporting cross-region and cross-account backups to ensure data reliability and recoverability. DBS also provides visual backup monitoring and recovery capabilities, allowing administrators to easily manage and operate backup data.

[0026] In one application scenario, the tool-type product is located in a public cloud environment, while the user database is located in a private domain environment. Since the public cloud environment and the private domain environment are not interconnected, a way to access the database in the private domain environment is needed.

[0027] For example, a public cloud environment refers to a cloud computing platform provided by a third-party cloud service provider. In a public cloud environment, users can access and use computing resources provided by the cloud service provider, such as virtual machines, storage space, and databases, via the internet. Public cloud environments are characterized by elasticity, scalability, and flexibility, allowing users to dynamically allocate and release computing resources according to their needs, while enjoying the high availability, security, and management convenience provided by the cloud service provider.

[0028] A private on-premises environment (POI) refers to computing resources deployed in a self-built data center or within an enterprise. In a PPI, the computing resources are entirely owned and managed by the enterprise, and users can access and use these resources within the internal network. PPIs are typically used in scenarios requiring stricter control and protection of data, such as enterprises and organizations dealing with sensitive information. PPIs can be customized to meet specific security and performance requirements, but they also require enterprises to invest significant costs and effort in maintenance and management.

[0029] Among related technologies, methods for accessing databases in a private domain environment include, but are not limited to: (1) Users directly expose the server address to the public network. However, directly exposing the database port to the public network increases the risk of being attacked and reduces data security.

[0030] (2) Users can build a dedicated network between a public cloud environment and a private domain environment or use a VPN. A VPN (Virtual Private Network) is a technology that establishes an encrypted and secure connection over a public network (such as the Internet). However, this method is complex to build, requires a complicated configuration process, and is cumbersome to operate.

[0031] Based on this, embodiments of this specification provide a method for constructing an access link, enabling applications in a public cloud environment to access databases in a private domain environment through the constructed access link. This is achieved using a gateway server and a gateway client. A gateway server with a public network access address can be deployed in the public cloud environment, and at least one gateway client can be deployed in the private domain environment.

[0032] The gateway client actively establishes at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment. The gateway server can then maintain at least one communication channel between the gateway server and the gateway client. The gateway server then obtains the identifier of the specified gateway client input by the user and the access address of the specified database in the private domain environment. Based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link between the public cloud environment and the private domain environment is constructed.

[0033] In this embodiment, the gateway server in the public cloud environment is unaware of the access address of the private domain environment. Only the gateway client can actively establish a communication connection with the gateway server based on the public network access address. This ensures that the private domain environment only grants access to trusted public cloud environments, avoiding the data security risks associated with directly opening database ports on the public network. Furthermore, the gateway server can only access the specified database in the private domain environment through authorized gateway clients, improving data security. Moreover, only the gateway server needs to be deployed in the public cloud environment, and the gateway client in the private domain environment; there is no need to directly open database ports or build complex VPN or other network connection methods, thus simplifying deployment and management. Users only need to input the identifier of the specified gateway client in the public cloud environment and the access address of the specified database in the private domain environment according to their actual needs, without requiring complex configuration processes, simplifying the user's configuration operations.

[0034] This specification also provides an access method based on an access link, which enables applications in a public cloud environment to access databases in a private domain environment through the access link after the aforementioned access link is established.

[0035] The technical solutions provided in the embodiments of this specification will be described by way of example from a system perspective below: Please see Figure 1 This specification provides an access system including a gateway server 10 and a gateway client 20. The gateway server 10 is deployed in a public cloud environment and has been assigned a public network access address 11. The gateway client 20 is deployed in a private domain environment. One or more applications 12, such as the aforementioned utility products (DMS, DTS, DBS), are also deployed in the public cloud environment. One or more databases 21 are deployed in the private domain environment.

[0036] Gateway client 20 is used to establish at least one communication channel with gateway server 10 based on public network access address 11 provided by public cloud environment. The communication channel carries the identifier of gateway client 20.

[0037] Gateway server 10 is used to maintain at least one communication channel between itself and gateway client 20; obtain the identifier of the specified gateway client 20 and the access address of the specified database 21 in the private domain environment input by the user; and construct an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the specified gateway client 20 and the access address of the specified database 21, so that the application 12 in the public cloud environment can access the database 21 in the private domain environment through the access link.

[0038] In this embodiment, it is only necessary to deploy the gateway server 10 in the public cloud environment and the gateway client 20 in the private domain environment. Through the above implementation process, the effects of improving data security, simplifying deployment and management, and simplifying user configuration operations can be achieved.

[0039] For example, please refer to Figure 2 , Figure 2 Two private domain environments are illustrated. In the case of multiple private domain environments, at least one gateway client 20 can be deployed in each private domain environment. The gateway client 20 in each private domain environment establishes at least one communication channel with the gateway server 10 through the public network access address 11 provided by the public cloud environment.

[0040] The deployment process of gateway client 20 will be illustrated here first. Please refer to [link to relevant documentation]. Figure 3 The access system may also include a gateway control component 30 connected to the gateway server 10, which is deployed in a public cloud environment.

[0041] Please see Figure 4 The gateway control component 30 can respond to user operations (1) by providing the user with information such as the download link for the installation package of the gateway client 20, deployment commands, public network access address 11, and the token issued to the gateway client 20 (2.1).

[0042] In addition, while providing the user with the token issued to the gateway client 20, the gateway control component 30 writes the token into the token database 50 (2.2) for subsequent verification.

[0043] After obtaining the download link, deployment command, public network access address 11, and token issued to the gateway client 20, the user can have any electronic device (3) in the private domain environment perform the following steps: download the download link of the gateway client 20 installation package from the second storage medium 40 based on the download link (4), and then run the installation package corresponding to the gateway client 20 in the private domain environment in response to the deployment command provided by the gateway control component 30 to achieve the deployment of at least one gateway client 20 in the private domain environment (5).

[0044] In this context, any electronic device in the private domain environment can deploy multiple gateway clients 20 within the same private domain environment to achieve load balancing.

[0045] Each gateway client 20 can access the public network access address 11 provided by the gateway control component 30 to establish at least one communication channel with the gateway server 10. Each communication channel carries the identifier of the gateway client 20. For example, the established communication channels include TCP communication channels. TCP (Transmission Control Protocol) is a reliable, connection-oriented communication protocol widely used in computer networks. It provides reliable data transmission and error recovery mechanisms to ensure the accuracy and integrity of data.

[0046] It is understandable that gateway client 20 directly accesses public network access address 11. During this process, traffic from the private domain to the public network will automatically pass through the private domain's public network NAT component (not shown in the diagram). The public network NAT component is a network device used to map internal private IP addresses to public IP addresses, so as to enable communication between the internal network of the private domain environment and the public Internet.

[0047] After establishing a communication channel with the gateway server 10, each gateway client 20 can send a token issued by the gateway control component 30 through the communication channel. The gateway server 10 receives the token issued by the public cloud environment sent by the gateway client 20 through the communication channel after the communication channel is established; it authenticates the gateway client 20 based on the token and returns the verification result to the gateway client 20. In this embodiment, by using token authentication, the gateway server 10 can verify the legitimacy of the gateway client 20's identity, which helps prevent unauthorized access and potential security threats. Furthermore, by using token authentication, the gateway server 10 can centrally manage and control access permissions. The issuance and revocation of tokens can be performed on the gateway server 10 without requiring independent configuration and management on each gateway client 20, thereby simplifying management operations and maintenance.

[0048] For example, please refer to Figure 4 After establishing a communication channel with the gateway server 10, each gateway client 20 can send a token issued by the gateway control component 30 through the communication channel (6). After receiving the token to be tested sent by the gateway client 20 through its established communication channel, the gateway server 10 sends the token to be tested to the token database 50 for verification (7), and the token database 50 returns the verification result (8). For example, the database management system of the token database 50 checks whether the token to be tested exists in the token database 50. If it exists, the verification result is that the verification is successful; if it does not exist, the verification result is that the verification is unsuccessful. The gateway server 10 can return the verification result to the gateway client 20 (9).

[0049] Gateway server 10 can maintain the communication channel corresponding to the token in response to a successful token verification result; otherwise, it can disconnect the communication channel. In this embodiment, once the token verification is successful, gateway server 10 will maintain the communication channel corresponding to the token. This means that gateway client 20 can continuously communicate with the public cloud environment without re-establishing a connection for each request, improving communication efficiency and response speed. If token verification fails or is revoked, gateway server 10 can disconnect the communication channel corresponding to the token, preventing unauthorized access and promptly interrupting connections with potentially risky clients.

[0050] During the configuration process, users can enter the identifier of the specified gateway client 20 in the public cloud environment and the access address of the specified database 21 in the private domain environment, according to their actual needs. For an example, please refer to [link to example]. Figure 5 Users can input the identifier of a specified gateway client 20 and the access address of a specified database 21 in the private domain environment into the gateway control component 30 (11). The gateway control component 30 is connected to the gateway server 10 and can send the identifier of the specified gateway client 20 and the access address of the specified database 21 in the private domain environment to the gateway server 10 (12). Thus, the gateway server 10 can obtain the identifier of the specified gateway client 20 and the access address of the specified database 21 in the private domain environment; and then, based on the communication channel pointed to by the identifier of the specified gateway client 20 and the access address of the specified database 21, it can construct an access link between the public cloud environment and the private domain environment.

[0051] It is understood that the embodiments in this specification do not impose any restrictions on the user's input method, which can be achieved by means of a touch screen, mouse, stylus, keyboard, physical buttons, voice input device or motion input device, etc.

[0052] For example, please refer to Figure 5To improve configuration accuracy, after obtaining the identifier of the specified gateway client 20 and the access address of the specified database 21 in the private domain environment from the user input, the gateway server 10 can send a probe command (13) to the specified gateway client 20 through the communication channel pointed to by the identifier of the specified gateway client 20. The probe command carries the access address of the specified database 21, so that the specified gateway client 20 responds to the probe command, probes the operation status of the specified database 21 (14), and returns a probe response (15) to the gateway server 10. By sending the probe command and receiving the probe response, the gateway server 10 can monitor the operation status of the specified database 21 in real time, which helps to promptly discover whether the database 21 is operating normally, whether there are any faults or instabilities, etc. Furthermore, when the probe response indicates that the specified database 21 is operating normally, the gateway client 20 can automatically construct an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the specified gateway client 20 and the access address of the specified database 21. This embodiment realizes the automatic creation of access links without manual intervention during system operation, thereby simplifying the configuration and management process.

[0053] For some possible implementations, please refer to Figure 5 During the creation of the access link, the gateway server 10 can assign a reverse proxy address (16) to the access address of the specified database 21 for the application 12 in the public cloud environment. Then, based on the reverse proxy address, the communication channel pointed to by the identifier of the specified gateway client 20, and the access address of the specified database 21, the access link between the application 12 in the public cloud environment and the database 21 in the private domain environment is constructed. The reverse proxy address refers to the address of the intermediate server (or reverse proxy server) that forwards the access request of the application 12 in the public cloud environment to the server in the private domain environment. However, for the application 12 in the public cloud environment, the reverse proxy server is equivalent to the target server (i.e., the server in the private domain environment). That is, the application 12 in the public cloud environment can directly access the reverse proxy server to obtain the resources of the target server. At the same time, the application 12 in the public cloud environment does not need to know the address of the target server and does not need to make any settings.

[0054] After establishing the access link between application 12 in the public cloud environment and database 21 in the private domain environment, the gateway server 10 can record the link information of the access link in the first storage medium 31 of the public cloud environment. The link information includes the mapping relationship between the reverse proxy address, the identifier of the specified gateway client 20, and the access address of the specified database 21.

[0055] For example, please refer to Figure 5The gateway server 10 can send the access link information (17) to the gateway control component 30 so that the gateway control component 30 can record the access link information (18) in the first storage medium 31 of the public cloud environment.

[0056] After the access link is established, the gateway server 10 can receive access requests sent by the application 12 in the public cloud environment to the target database 21 in the private domain environment. It then transmits the access request through the access link corresponding to the target database 21 and receives the access response returned by the target database 21 based on the access request. Finally, it forwards the access response to the application 12 in the public cloud environment. This enables the application 12 in the public cloud environment to access the database 21 in the private domain.

[0057] For example, please refer to Figure 6 Gateway client 20 receives an access request (24) sent by application 12 in the public cloud environment to the reverse proxy address corresponding to the target database 21 in the private domain environment. The reverse proxy address corresponding to the target database 21 is obtained from the storage medium storing the link information of the access link corresponding to the target database 21.

[0058] For example, a user initiates an access request (21) for a target database 21 in application 12 in a public cloud environment. This access request carries the access address of the target database 21. Application 12 in the public cloud environment calls gateway control component 30 (22) so that gateway control component 30 obtains the reverse proxy address (23) corresponding to the target database 21 from the first storage medium 31 that stores the link information of the access link corresponding to the target database 21 and returns it to application 12 in the public cloud environment. For example, application 12 in the public cloud environment calls gateway control component 30 and passes the access address of the target database 21 to gateway control component 30. Gateway control component 30 finds the reverse proxy address corresponding to the target database 21 from the mapping relationship stored in the first database 21 based on the access address of the target database 21 and returns it to application 12 in the public cloud environment.

[0059] After obtaining the reverse proxy address corresponding to the target database 21, application 12 in the public cloud environment can directly send an access request (24) to the reverse proxy address.

[0060] After receiving an access request sent by application 12 in the public cloud environment to the reverse proxy address corresponding to the target database 21, gateway server 10 obtains the identifier of target gateway client 20 corresponding to target database 21 from the second storage medium 40 storing the link information of the access link corresponding to target database 21, and sends an access request (25) to target gateway client 20 through the communication channel pointed to by the identifier of target gateway client 20, so that target gateway client 20 forwards the access request to target database 21 for processing. For example, the access request carries the access address of target database 21. Target gateway client 20 can establish a connection with target database 21 based on the access address of target database 21 and forward the access request to target database 21 for processing. Target database 21 can return the processed access response to target gateway client 20 (26). Next, the target gateway client 20 receives the access response from the target database 21 and returns the access response to the gateway server 10 based on the above communication channel (27). The gateway server 10 forwards the access response to the application 12 in the public cloud environment based on the reverse proxy address corresponding to the target database 21 (28).

[0061] It is understandable that the gateway control component 30 may not be set up in the access system. Instead, the functions of the gateway control component 30 may be integrated into the gateway server 10, and the gateway server 10 may execute the relevant functions of the gateway control component 30, such as the function of interacting with the user.

[0062] The various technical features in the above embodiments can be combined arbitrarily, as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, the arbitrary combination of various technical features in the above embodiments is also within the scope of this specification.

[0063] In some embodiments, please refer to Figure 7 This specification provides an embodiment of a method for constructing an access link, which enables applications in a public cloud environment to access a database in a private domain environment. The public cloud environment has a gateway server deployed with a public network access address; the private domain environment has at least one gateway client deployed. The method is applied to the gateway server and includes: In S101, at least one communication channel is maintained between the gateway server and the gateway client. The communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries the identifier of the gateway client.

[0064] In S102, the identifier of the specified gateway client and the access address of the specified database in the private domain environment are obtained from the user input.

[0065] In S103, an access link between the public cloud environment and the private domain environment is constructed based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database.

[0066] Based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link is constructed between the public cloud environment and the private domain environment, including: Assign a reverse proxy address for the specified database to the application in the public cloud environment; In some embodiments, an access link between an application in a public cloud environment and a database in a private domain environment is constructed based on the reverse proxy address, the communication channel pointed to by the identifier of the specified gateway client, and the access address of the specified database.

[0067] In some embodiments, it also includes: The access link information is recorded in the first storage medium of the public cloud environment. The link information includes the mapping relationship between the reverse proxy address, the identifier of the specified gateway client, and the access address of the specified database.

[0068] In some embodiments, before establishing the access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, the method further includes: By sending a probe command to the specified gateway client through the communication channel pointed to by the identifier of the specified gateway client, the probe command carries the access address of the specified database, so that the specified gateway client responds to the probe command, probes the operation of the specified database and returns a probe response to the gateway server; Based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link is constructed between the public cloud environment and the private domain environment, including: If the probe response indicates that the specified database is operating normally, an access link between the public cloud environment and the private domain environment is constructed based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database.

[0069] In some embodiments, the gateway client deployed in a private domain environment is obtained by running the corresponding installation package of the gateway client in the private domain environment in response to a deployment command provided by the public cloud environment; wherein, the installation package corresponding to the gateway client is downloaded from the second storage medium based on a download link provided by the public cloud environment.

[0070] In some embodiments, before maintaining at least one communication channel between the gateway server and the gateway client, the method further includes: receiving a token issued by the public cloud environment sent by the gateway client through the communication channel after establishing the communication channel; authenticating the gateway client based on the token and returning a verification result to the gateway client. Maintaining at least one communication channel between the gateway server and the gateway client includes: maintaining the communication channel corresponding to the token in response to a verification result indicating that the token verification is successful; otherwise, disconnecting the communication channel corresponding to the token.

[0071] In some embodiments, a gateway control component connected to the gateway server is deployed in the public cloud environment; the public network access address, download link, deployment command, and token are provided by the gateway control component.

[0072] In some embodiments, the communication channel includes a TCP channel.

[0073] Please see Figure 8 This specification also provides an access method based on an access link, wherein the access link is constructed based on any of the access link construction methods described above; the method is applied to a gateway server and includes: In S201, an access request is received from an application in the public cloud environment for a target database in the private domain environment.

[0074] In S202, an access request is transmitted through the access link corresponding to the target database, and an access response returned by the target database based on the access request is received.

[0075] In S203, the access response is forwarded to the application in the public cloud environment.

[0076] In some embodiments, receiving an access request from an application in a public cloud environment for a target database in a private domain environment includes: It receives access requests sent by applications in a public cloud environment to a target database in a private domain environment, directed to the reverse proxy address corresponding to the target database; wherein the reverse proxy address is obtained from a first storage medium storing link information of the access link corresponding to the target database.

[0077] In some embodiments, transmitting access requests via an access link corresponding to the target database includes: Obtain the identifier of the target gateway client corresponding to the target database from the first storage medium that stores the link information of the access link corresponding to the target database; The access request is sent to the target gateway client through the communication channel pointed to by the identifier of the target gateway client, so that the target gateway client forwards the access request to the target database for processing.

[0078] The various technical features in the above embodiments can be combined arbitrarily, as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, the arbitrary combination of various technical features in the above embodiments is also within the scope of this specification.

[0079] In some embodiments of this specification, an electronic device is also provided, including: a processor; a memory for storing processor-executable instructions; wherein the processor implements the method described in any one of the above embodiments by executing the executable instructions.

[0080] Figure 9 This is a schematic structural diagram of a device provided in an exemplary embodiment. Please refer to... Figure 9 At the hardware level, the device includes a processor 902, an internal bus 904, a network interface 906, memory 908, and non-volatile memory 910, and may also include other hardware required for different scenarios. One or more embodiments of this specification can be implemented in software, such as the processor 902 reading the corresponding computer program from the non-volatile memory 910 into memory 908 and then running it. Of course, in addition to software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0081] In some embodiments, this specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the method as described in any of the preceding embodiments.

[0082] In some embodiments, this specification also provides a computer program product including a computer program that, when executed by a processor, implements the steps of any of the methods described above.

[0083] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0084] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0085] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0087] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0088] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0089] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0090] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0091] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0092] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the scope of protection of one or more embodiments of this specification.

Claims

1. A method of constructing an access link for enabling an application in a public cloud environment to access a database in a private domain environment through the access link. The public cloud environment has a gateway server that has been assigned a public network access address; the private domain environment has at least one gateway client. The method is applied to the gateway server and includes: Maintain at least one communication channel between the gateway server and the gateway client; the communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries the identifier of the gateway client; Obtain the identifier of the specified gateway client and the access address of the specified database in the private domain environment, as input by the user; Based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link is constructed between the public cloud environment and the private domain environment.

2. The method according to claim 1, wherein constructing the access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database includes: Assign a reverse proxy address for the specified database to the application in the public cloud environment; Based on the reverse proxy address, the communication channel pointed to by the identifier of the specified gateway client, and the access address of the specified database, an access link is constructed between the application in the public cloud environment and the database in the private domain environment.

3. The method according to claim 2, further comprising: The access link information is recorded in the first storage medium of the public cloud environment. The link information includes the mapping relationship between the reverse proxy address, the identifier of the designated gateway client, and the access address of the designated database.

4. The method according to claim 1, before constructing the access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, further includes: A probe command is sent to the designated gateway client through the communication channel pointed to by the identifier of the designated gateway client. The probe command carries the access address of the designated database, so that the designated gateway client responds to the probe command, probes the operation of the designated database, and returns a probe response to the gateway server. The step of constructing an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database includes: If the probe response indicates that the designated database is operating normally, an access link between the public cloud environment and the private domain environment is constructed based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database.

5. The method according to claim 1, wherein the gateway client deployed in the private domain environment is obtained by running the installation package corresponding to the gateway client in the private domain environment in response to the deployment command provided by the public cloud environment; wherein The installation package corresponding to the gateway client is downloaded from the second storage medium based on the download link provided by the public cloud environment.

6. The method according to claim 5, further comprising, before maintaining at least one communication channel between the gateway server and the gateway client: Receive the token issued by the public cloud environment sent by the gateway client through the communication channel after the communication channel is established; The gateway client is authenticated based on the token, and the verification result is returned to the gateway client. Maintaining at least one communication channel between the gateway server and the gateway client includes: In response to the verification result indicating that the token has passed verification, maintain the communication channel corresponding to the token; Otherwise, disconnect the communication channel corresponding to the token.

7. The method according to claim 6, wherein a gateway control component connected to the gateway server is deployed in the public cloud environment; the public network access address, the download link, the deployment command, and the token are provided by the gateway control component; and / or The communication channel includes a TCP channel.

8. An access method based on an access link, the access link being constructed based on the construction method of the access link according to any one of claims 1 to 7. The method is applied to the gateway server and includes: Receive access requests from applications in a public cloud environment for target databases in a private domain environment; The access request is transmitted through the access link corresponding to the target database, and the access response returned by the target database based on the access request is received. The access response is forwarded to the application in the public cloud environment.

9. The method according to claim 8, wherein receiving an access request sent by an application in a public cloud environment for a target database in a private domain environment includes: The system receives an access request sent by an application in a public cloud environment to a reverse proxy address corresponding to a target database in a private domain environment; wherein the reverse proxy address is obtained from a first storage medium storing link information of the access link corresponding to the target database.

10. The method according to claim 8, wherein transmitting the access request through an access link corresponding to the target database comprises: Obtain the identifier of the target gateway client corresponding to the target database from the first storage medium that stores the link information of the access link corresponding to the target database; The access request is sent to the target gateway client through the communication channel indicated by the identifier of the target gateway client, so that the target gateway client forwards the access request to the target database for processing.

11. An access system comprising a gateway server and a gateway client. The gateway server is deployed in a public cloud environment and has been assigned a public network access address; The gateway client is deployed in a private domain environment; The gateway client is used to establish at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries the identifier of the gateway client; The gateway server is used to maintain at least one communication channel between itself and the gateway client. Obtain the identifier of the specified gateway client and the access address of the specified database in the private domain environment, as input by the user; Based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database, an access link is constructed between the public cloud environment and the private domain environment, so that applications in the public cloud environment can access the database in the private domain environment through the access link.

12. An electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1 to 10 by executing the executable instructions.

13. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1 to 10.

14. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 10.

Images