Practical training sandbox access control method, terminal equipment and storage medium

Abstract

The invention is suitable for the field of data processing, and discloses an access control method of a practical training sandbox, terminal equipment and a storage medium. The practical training sandbox access control method comprises the steps that a unique access path is generated for each created sandbox according to a preset public network address, and the access path comprises a unique identifier corresponding to the sandbox; if a sandbox access request carrying a public network address is detected, further analyzing the access request to obtain a target user ID and a target experiment ID; if a target local area network IP is matched in a shared memory according to the target user ID and the target experiment ID, the access request is dynamically forwarded to a target practical training sandbox corresponding to the target local area network IP, sandbox connection information of each established practical training sandbox is stored in the shared memory, and the sandbox connection information comprises the local area network IP of the user ID and the experiment ID. The problem that a current practical training sandbox system cannot support a remote scene is effectively solved, and the use flexibility of the practical training sandbox is improved.

Description

Technical Field

[0001] The present invention belongs to the field of data processing, and in particular relates to an access control method, terminal equipment and storage medium for a training sandbox. Background Art

[0002] The training sandbox is the basic technical path for practical training teaching practice. Through the virtualization sandbox, the construction of teaching hardware can be saved and the students' practical training needs can be met to the greatest extent.

[0003] Current training sandbox systems are commonly deployed using LAN virtualization technology. While this reduces hardware costs, sandbox access is forcibly tied to the training room's LAN environment, making it unsuitable for remote scenarios like dormitories or homes. This reduces sandbox flexibility. A new technical approach is needed to address these issues. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides an access control method, a terminal device, and a storage medium for a training sandbox, which can solve the problem of low flexibility in the use of training sandboxes in related technologies.

[0005] A first aspect of the present invention provides an access control method for a training sandbox, comprising: Generate a unique access path for each created sandbox based on the preset public network address, where the access path includes a unique identifier corresponding to the sandbox; If a sandbox access request carrying the public network URL is detected, the access request is further parsed to obtain the target user ID and the target experiment ID; If the target LAN IP is matched in the shared memory according to the target user ID and the target experiment ID, the access request will be dynamically forwarded to the target training sandbox corresponding to the target LAN IP. The shared memory stores the sandbox connection information of each created training sandbox, and the sandbox connection information includes the user ID, the LAN IP of the experiment ID.

[0006] Optionally, in a first implementation of the first aspect of the present invention, the step of generating a unique access path for each created sandbox according to a preset public network address includes: For each created sandbox, the created sandbox user ID, the created sandbox experiment ID and the public network address are concatenated to obtain a unique access path for each created sandbox.

[0007] Optionally, in a second implementation of the first aspect of the present invention, before the step of generating a unique access path for each created sandbox based on a preset public network address, wherein the access path includes a unique identifier corresponding to the sandbox, the method further includes: For each created sandbox, the created sandbox user ID, the created sandbox experiment ID and the created sandbox LAN IP are associated and stored to store the sandbox connection information of each created training sandbox in the shared memory.

[0008] Optionally, in a third implementation of the first aspect of the present invention, before the step of further parsing the access request to obtain the target user ID and the target experiment ID if a sandbox access request carrying the public network URL is detected, the method further includes: The public network address is used as a screening condition, and the sandbox access request carrying the public network address is obtained from the request instruction queue.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, before the step of further parsing the access request to obtain the target user ID and the target experiment ID if a sandbox access request carrying the public network URL is detected, the method further includes: The public network address is used as a screening condition, and the sandbox access request carrying the public network address is obtained from the request instruction queue.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the step of parsing the access request to obtain the target user ID and the target experiment ID includes: The URI path in the access request is parsed by a preset Lua script to extract the target experiment ID and the target user ID embedded in the URI path.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, before the step of matching a target LAN IP in a shared memory based on the target user ID and the target experiment ID, the method further includes: According to the target user ID and the target experiment ID, a key-value matching query operation is performed in the shared memory to determine whether the target LAN IP is matched, wherein the shared memory stores the sandbox connection information of the created sandbox through a hash table structure.

[0012] Optionally, in a seventh implementation of the first aspect of the present invention, after the step of generating a unique access path for each created sandbox based on a preset public network address, wherein the access path includes a unique identifier corresponding to the sandbox, the method further includes: Real-time detection of the real-time status identifier of the created sandbox; Dynamically update the sandbox connection information of the created sandbox in the shared memory according to the real-time status identifier.

[0013] In a second aspect, an embodiment of the present invention provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the access control method for the above-mentioned training sandbox when executing the computer program.

[0014] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the access control method of the above-mentioned training sandbox.

[0015] In a fourth aspect, an embodiment of the present invention provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute the access control method for the above-mentioned training sandbox.

[0016] The beneficial effects of the embodiments of the present invention compared with the prior art are: an access path containing a unique identifier is generated for each created sandbox through a preset public network address, so that users can initiate access requests from the public network, removing the limitation that the traditional training sandbox system can only be accessed within the local area network; after detecting a sandbox access request carrying a public network address, the target user ID and the target experiment ID are parsed to obtain the target user ID and the target experiment ID, and then the target LAN IP is matched in the shared memory storing the sandbox connection information based on the target user ID and the target experiment ID, and the access request is dynamically forwarded to the corresponding target training sandbox, realizing precise positioning and access to the training sandbox in the local area network based on the public network access request, effectively solving the problem that the current training sandbox system is deployed using LAN virtualization technology, resulting in sandbox access being forced to be bound to the training room LAN environment and unable to support remote scenarios, thereby improving the flexibility of using the training sandbox. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 Schematic diagram of an embodiment of a method for controlling access to a training sandbox according to an embodiment of the present invention; Figure 2 Schematic diagram of a specific embodiment of step S101 of the method for controlling access to a training sandbox in an embodiment of the present invention; Figure 3 Schematic diagram of a specific embodiment of step S202 of the method for controlling access to a training sandbox in an embodiment of the present invention; Figure 4This is a schematic diagram of a specific embodiment after step S101 of the access control method for the training sandbox in an embodiment of the present invention; Figure 5 Schematic diagram of a terminal device in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are protected by the present invention.

[0020] It should be noted that the terms "include", "comprising" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, terminal, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices. In the claims, specification and drawings of the present invention, relational terms such as "first" and "second" are merely used to distinguish one entity / operation / object from another entity / operation / object, and do not necessarily require or imply any such real-time relationship or order between these entities / operations / objects.

[0021] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0022] The training sandbox is the basic technical path for practical training teaching practice. Through the virtualization sandbox, the construction of teaching hardware can be saved and the students' practical training needs can be met to the greatest extent.

[0023] Current training sandbox systems are commonly deployed using LAN virtualization technology. While this reduces hardware costs, sandbox access is forcibly tied to the training room's LAN environment, making it unsuitable for remote scenarios like dormitories or homes. This reduces sandbox flexibility. A new technical approach is needed to address these issues.

[0024] In view of this, an embodiment of the present invention provides an access control method, terminal device and storage medium for a training sandbox, which generates an access path containing a unique identifier for each created sandbox through a preset public network address, so that users can initiate access requests from the public network, thereby removing the limitation that the traditional training sandbox system can only be accessed within the local area network; after detecting a sandbox access request carrying a public network address, the target user ID and the target experiment ID are parsed to obtain the target user ID and the target experiment ID, and then the target LAN IP is matched in the shared memory storing the sandbox connection information based on the target user ID and the target experiment ID, and the access request is dynamically forwarded to the corresponding target training sandbox, thereby realizing precise positioning and access to the training sandbox in the local area network based on the public network access request, effectively solving the problem that the current training sandbox system is deployed using LAN virtualization technology, resulting in sandbox access being forced to be bound to the training room LAN environment and unable to support remote scenarios, thereby improving the flexibility of using the training sandbox.

[0025] In order to illustrate the technical solution of the present invention, specific embodiments are provided below.

[0026] Figure 1 The present invention provides a flow chart of a method for implementing access control in a training sandbox, which can be applied to a terminal device such as a mobile phone, tablet computer, laptop computer, ultra-mobile personal computer (UMPC), or netbook.

[0027] Specifically, the access control method of the training sandbox may include the following steps S101 to S103.

[0028] Step S101 : generating a unique access path for each created sandbox according to a preset public network address, wherein the access path includes a unique identifier corresponding to the sandbox.

[0029] In an embodiment of the present invention, after the training sandbox is created, the terminal device (access control of the training sandbox) automatically generates a unique access path to the sandbox based on the preset public network address of the training environment (eg, xsmartedu.com).

[0030] A unique access path is created by concatenating subpaths in a fixed format (e.g., / shaxiang / {experiment ID} / {user ID}). The experiment ID and user ID are embedded in the path as unique identifiers of the sandbox. For example, the path for student A's experiment X sandbox is http: / / xsmartedu.com / shaxiang / X / A, forming a globally accessible logical entry point.

[0031] Step S102: If a sandbox access request carrying the public network address is detected, the access request is further parsed to obtain a target user ID and a target experiment ID.

[0032] In this embodiment of the present invention, a terminal device continuously monitors access traffic from a public network address through a proxy server (Nginx). When a user (e.g., a student) initiates an access request through a browser at a remote terminal (dormitory / home), the terminal screens for requests containing the public network address (e.g., if the URL begins with http: / / xsmartedu.com / shaxiang / ), identifies the request as a sandbox access attempt, and initiates the resolution process.

[0033] Optionally, the URI path in the access request is parsed by a preset Lua script to extract the target experiment ID and the target user ID embedded in the URI path. Specifically, the request URI path is parsed by an embedded Lua script engine to extract dynamic parameters in the path, for example: the first segment after / shaxiang / is intercepted as the target experiment ID, and the second segment is taken as the target user ID.

[0034] Step S103: If the target LAN IP is matched in the shared memory according to the target user ID and the target experiment ID, the access request is dynamically forwarded to the target training sandbox corresponding to the target LAN IP. The shared memory stores the sandbox connection information of each created training sandbox, and the sandbox connection information includes the user ID, the LAN IP of the experiment ID.

[0035] In this embodiment of the present invention, the extracted target experiment ID and target user ID are combined into a composite key to query the hash table structure in shared memory. If a record is found, the corresponding target LAN IP address is returned. If not, a 404 error is returned (sandbox does not exist or has been released).

[0036] Using Nginx's proxy_pass module, the original request is forwarded in real time to the sandbox instance on the target LAN IP address. For example, the forwarding process reuses the original request protocol (HTTP / HTTPS) to maintain the integrity of the request header, parameters, and session state.

[0037] The beneficial effects of the embodiments of the present invention compared with the prior art are: an access path containing a unique identifier is generated for each created sandbox through a preset public network address, so that users can initiate access requests from the public network, removing the limitation that the traditional training sandbox system can only be accessed within the local area network; after detecting a sandbox access request carrying a public network address, the target user ID and the target experiment ID are parsed to obtain the target user ID and the target experiment ID, and then the target LAN IP is matched in the shared memory storing the sandbox connection information based on the target user ID and the target experiment ID, and the access request is dynamically forwarded to the corresponding target training sandbox, realizing precise positioning and access to the training sandbox in the local area network based on the public network access request, effectively solving the problem that the current training sandbox system is deployed using LAN virtualization technology, resulting in sandbox access being forced to be bound to the training room LAN environment and unable to support remote scenarios, thereby improving the flexibility of using the training sandbox.

[0038] Traditional training sandbox systems, when providing remote access capabilities, generally use manually configured access portals. Administrators need to manually maintain IP and sandbox mapping tables, which can easily lead to configuration errors or update delays as the sandbox scales up. Based on this, the present invention proposes an alternative embodiment.

[0039] Reference Figure 2 , Figure 2 Schematic diagram of a specific embodiment of step S101 of the method for controlling access to a training sandbox in an embodiment of the present invention. Step S101 also includes the following specific implementation methods.

[0040] Step S1011: for each created sandbox, the created sandbox user ID, the created sandbox experiment ID and the public network address are concatenated to obtain a unique access path for each created sandbox.

[0041] In an embodiment of the present invention, when the training platform completes the creation operation of a new sandbox instance (for example, allocating experimental resources to students), it automatically captures the event and extracts the core identification information of the sandbox, including the created sandbox user ID (and the experiment ID (for example, "EXP203").

[0042] Use the preset global public network access address (for example, https: / / xsmartedu.com) as the base prefix for path splicing. This address is uniformly configured during system deployment so that all sandboxes share the same public network entrance.

[0043] Based on the preset path generation rules, a fixed format for the sub-path is determined (for example, / shaxiang / {experiment ID} / {user ID}). This template defines the embedding position and separators of identifiers to ensure the uniformity of the path structure.

[0044] Concatenate the public network address with the subpath template. Specifically, insert the experiment ID into the {experiment ID} placeholder in the template (for example, replace it with "EXP203"); insert the user ID into the {user ID} placeholder in the template (for example, replace it with "U1001"); and obtain the complete access path: https: / / xsmartedu.com / shaxiang / EXP203 / U1001.

[0045] The generated unique access path is bound to the sandbox instance and stored in the metadata database.

[0046] In the embodiment of the present invention, the automatic generation of paths is achieved by concatenating standardized character strings, which can significantly improve maintainability and scalability.

[0047] Traditional training sandbox systems typically rely on statically configured IP mapping tables or centralized databases for remote access. A surge in concurrent users can lead to database query delays, the inability of static mapping tables to adapt to the high-frequency changes associated with the dynamic creation and destruction of sandboxes, and the risk of single points of failure in centralized storage. These factors pose technical obstacles to the implementation of remote training. Based on this, the present invention proposes an alternative embodiment.

[0048] The following specific implementation is also included before step S101.

[0049] Step S201: for each created sandbox, concatenate the created sandbox user ID, the created sandbox experiment ID and the public network address to obtain a unique access path for each created sandbox.

[0050] In an embodiment of the present invention, after the training platform completes the creation of the sandbox instance, it automatically collects three core metadata of the sandbox: user ID (unique identity identifier of the training student / teacher); experiment ID (globally unique code of the current training task); LAN IP (private IP address assigned to the sandbox in the training room cluster).

[0051] Combine the user ID and the experiment ID as a composite key and create a key-value mapping in shared memory.

[0052] In this embodiment, a lightweight, highly concurrent routing infrastructure is formed by dynamically binding user IDs, experiment IDs, and LAN IP addresses. The read and write performance of shared memory enables instant resolution of request forwarding paths, avoiding the latency of traditional database queries. The key-value pair structure naturally supports queries based on any combination of experiment IDs and user IDs, providing precise routing targets for dynamic proxies.

[0053] Traditional training systems generally use a full-flow proxy model for remote access, indiscriminately forwarding all public network requests to the intranet gateway. This results in a large number of static resource requests still having to be forwarded through the proxy layer, occupying bandwidth and computing power that could be used for sandbox forwarding. Based on this, the present invention proposes an alternative embodiment.

[0054] The following specific implementation is also included before step S102.

[0055] Step S202: Using the public network address as a screening condition, obtain the sandbox access request carrying the public network address from the request instruction queue.

[0056] In the embodiment of the present invention, during the startup phase, based on the preset public network address of the training environment (e.g. https: / / xsmartedu.com ), assign a dedicated listening port (for example, port 8081) to the Nginx proxy server. This port is bound to a public network address and is used to receive all inbound request traffic destined for that public network address.

[0057] Optionally, the proxy server starts a continuous listening thread to capture all incoming HTTP / HTTPS requests in real time through a configured dedicated port. All requests, regardless of their source, are temporarily stored in a global request instruction queue, forming a pool of raw requests to be processed.

[0058] Preset public network address matching rule templates (for example, the URL must include the prefix https: / / xsmartedu.com / shaxiang / ). The proxy thread scans the request queue one by one, automatically filtering out requests that match the specific format using regular expressions or string matching algorithms, and marking them as sandbox access attempts.

[0059] Requests that pass the screening are removed from the public queue and transferred to an independent sandbox request processing channel. Non-matching requests (such as ordinary web page access) continue to be processed by the default proxy rules, so that non-sandbox traffic is not interfered with.

[0060] In an embodiment of the present invention, accurate traffic diversion is achieved through a public network address feature pre-screening mechanism. Before the request enters the complex resolution process, non-sandbox requests are quickly filtered based on the URL format, effectively avoiding irrelevant traffic from consuming resolution resources.

[0061] Traditional training systems use a single-port full-proxy mode, where long sandbox connections and short-duration web requests share the same port. This sudden burst of traffic can easily cause congestion at the proxy layer, leading to lags in sandbox operations. Based on this, the present invention proposes an alternative embodiment.

[0062] Reference Figure 3 , Figure 3Schematic diagram of a specific embodiment of step S202 of the method for controlling access to a training sandbox in an embodiment of the present invention. Step S202 also includes the following specific implementation methods.

[0063] Step S2021: Configure the proxy server to listen to a dedicated port according to the public network address.

[0064] In this embodiment, during the initialization phase, a dedicated listening port is statically configured for the Nginx proxy server based on a predefined public network access address (e.g., https: / / xsmartedu.com). This port is strongly bound to the public network address and only accepts inbound requests destined for that public domain. Traffic from non-specified domains is automatically discarded by the underlying network stack.

[0065] The proxy service process starts a separate listening thread, bound to a pre-defined dedicated port. This thread continuously listens for TCP connection requests on the port. When a new connection is established, the complete request packet is pushed to the in-memory request instruction queue.

[0066] Based on the standardized format of public network addresses, a pre-generated address matching fingerprint is used as a filter to identify the legitimacy of sandbox access requests.

[0067] Step S2022: The proxy server monitors a dedicated port and uses the public network address as a screening condition to automatically screen the sandbox access request carrying the public network address in the request instruction queue.

[0068] In an embodiment of the present invention, the listening thread performs a scan on the request instruction queue one by one, extracts the Host header field and URI path of each request; performs regular matching through fingerprint rules; automatically separates successfully matched requests, marks them as sandbox access types and transfers them to subsequent processing modules; and immediately releases non-matching requests to the default processing channel.

[0069] In the embodiment of the present invention, physical port isolation can separate sandbox traffic from non-sandbox traffic, preventing irrelevant requests from crowding out proxy computing resources, and ensuring low latency and high throughput of the sandbox forwarding link.

[0070] Traditional training systems rely on database relationship queries when mapping sandbox IP addresses, which results in database query delays and a lack of a secure isolation mechanism by relying solely on ID matching. Based on this, the present invention proposes an alternative embodiment.

[0071] Step S202 also includes the following specific implementation methods.

[0072] Step S2021: Perform a key-value matching query operation in the shared memory according to the target user ID and the target experiment ID to determine whether the target LAN IP is matched, wherein the shared memory stores the sandbox connection information of the created sandbox through a hash table structure.

[0073] In an embodiment of the present invention, the target experiment ID and the target user ID extracted by the Lua script are received and combined into a composite query key according to a preset format of the shared memory.

[0074] Access the hash table structure in shared memory and perform a key-value query using the composite key as the index (time complexity O(1)). If a hit is found, the target LAN IP address is returned. If a hit is not found, a 404 Not Found is returned.

[0075] In this embodiment of the present invention, key-value matching leverages the efficient addressing capabilities of hash tables to achieve real-time resolution of sandbox routes. The reduced time complexity of hash tables eliminates query performance bottlenecks in massive sandbox scenarios. The composite key design enables dual binding of user IDs and experiment IDs, preventing unauthorized access caused by a single ID leak.

[0076] Traditional training systems maintain sandbox access relationships through static IP mapping tables, requiring administrators to manually maintain these tables. When a sandbox instance is restarted or migrated due to a failure, the new IP address cannot be synchronized in a timely manner, resulting in continuous user access failures until manual intervention is required. Based on this, the present invention proposes an alternative embodiment.

[0077] Reference Figure 4 , Figure 4 This is a schematic diagram of a specific embodiment after step S101 of the access control method for the training sandbox in an embodiment of the present invention. After step S101, the following specific implementation methods are also included.

[0078] Step S203: Detect the real-time status identifier of the created sandbox in real time.

[0079] In this embodiment of the present invention, a lightweight status probe is deployed to continuously poll all created training sandbox instances. This probe proactively monitors the real-time operating status of each sandbox at regular intervals, obtaining a real-time operating status indicator for each sandbox, such as "running," "stopped," or "deleted."

[0080] Step S204: dynamically updating the sandbox connection information of the created sandbox in the shared memory according to the real-time status identifier.

[0081] When a change in the sandbox status flag is detected (for example, from active to down), a state change event is generated, including the sandbox user ID, experiment ID, and new status code; the state parser is called to convert the original status code into executable operation instructions.

[0082] Perform memory operations based on the state parsing results.

[0083] In an embodiment of the present invention, a real-time state-driven update mechanism is used to solve the mapping consistency problem in a distributed sandbox environment. When the sandbox is abnormally offline, the memory mapping can be automatically cleaned up, effectively avoiding connection timeouts caused by user requests being forwarded to invalid IP addresses.

[0084] like Figure 5 FIG2 is a schematic diagram of a terminal device according to an embodiment of the present invention. The terminal device 500 may include a processor 501, a memory 502, and a computer program 503 stored in the memory 502 and executable on the processor 501, such as an access control program for a training sandbox. When the processor 501 executes the computer program 503, the steps described in the aforementioned embodiments for access control of the training sandbox are implemented.

[0085] The computer program can be divided into one or more modules / units, which are stored in the memory 502 and executed by the processor 501 to implement the present invention. One or more modules / units can be a series of computer program instruction segments that can perform specific functions. These instruction segments are used to describe the execution process of the computer program in the terminal device.

[0086] The terminal device may include, but is not limited to, a processor 501 and a memory 502. Those skilled in the art will appreciate that Figure 5 It is only an example of a terminal device and does not constitute a limitation of the terminal device. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

[0087] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0088] Memory 502 can be an internal storage unit of the terminal device, such as the terminal device's hard drive or memory. Memory 502 can also be an external storage device of the terminal device, such as a plug-in hard drive, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. Furthermore, memory 502 can include both the terminal device's internal storage unit and an external storage device. Memory 502 is used to store computer programs and other programs and data required by the terminal device. Memory 502 can also be used to temporarily store data that has been output or is about to be output.

[0089] It should be noted that, for the convenience and brevity of description, the structure of the above-mentioned terminal device can also refer to the specific description of the structure in the method embodiment, which will not be repeated here.

[0090] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the steps in the access control method for the above-mentioned training sandbox can be implemented.

[0091] An embodiment of the present invention provides a computer program product. When the computer program product is run on a mobile terminal, the mobile terminal can implement the steps in the access control method of the above-mentioned training sandbox when executing the computer program product.

[0092] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0093] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0094] In the embodiments provided herein, it should be understood that the disclosed terminal devices and methods can be implemented in other ways. For example, the terminal device embodiments described above are merely illustrative. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection via some interface, device, or unit, which may be electrical, mechanical, or other means.

[0095] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0096] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0097] If the integrated module / unit is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the process steps in the above-mentioned method embodiments by using a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signals, telecommunication signals, and software distribution media. It should be noted that the content of the computer-readable medium can be appropriately increased or decreased based on the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, based on legislation and patent practice, computer-readable media does not include electric carrier signals and telecommunication signals.

[0098] The above embodiments are intended only to illustrate the technical solutions of the present invention and are not intended to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may be modified or some of the technical features thereof may be replaced with equivalents. Such modifications or replacements do not deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention and are therefore intended to be included within the scope of protection of the present invention.

Claims

1. A training sandbox access control method, characterized in that: include: Generate a unique access path for each created sandbox based on the preset public network address, where the access path includes a unique identifier corresponding to the sandbox; If a sandbox access request carrying the public network URL is detected, the access request is further parsed to obtain the target user ID and the target experiment ID; If the target LAN IP is matched in the shared memory according to the target user ID and the target experiment ID, the access request will be dynamically forwarded to the target training sandbox corresponding to the target LAN IP. The shared memory stores the sandbox connection information of each created training sandbox, and the sandbox connection information includes the user ID, the LAN IP of the experiment ID.

2. The access control method for the training sandbox according to claim 1, characterized in that: The step of generating a unique access path for each created sandbox according to the preset public network address includes: For each created sandbox, the created sandbox user ID, the created sandbox experiment ID and the public network address are concatenated to obtain a unique access path for each created sandbox.

3. The access control method for the training sandbox according to claim 1, characterized in that: Before the step of generating a unique access path for each created sandbox according to the preset public network address, wherein the access path includes a unique identifier corresponding to the sandbox, the method further includes: For each created sandbox, the created sandbox user ID, the created sandbox experiment ID and the created sandbox LAN IP are associated and stored to store the sandbox connection information of each created training sandbox in the shared memory.

4. The access control method for a training sandbox according to claim 1, wherein: Before the step of further parsing the access request to obtain the target user ID and the target experiment ID if a sandbox access request carrying the public network address is detected, the method further includes: The public network address is used as a screening condition, and the sandbox access request carrying the public network address is obtained from the request instruction queue.

5. The access control method for the training sandbox according to claim 4, characterized in that: The step of obtaining the sandbox access request carrying the public network address from the request instruction queue using the public network address as a screening condition includes: According to the public network address, configure the proxy server to listen to the dedicated port; The proxy server monitors a dedicated port and uses the public network address as a screening condition to automatically screen the sandbox access request carrying the public network address in the request instruction queue.

6. The access control method for a training sandbox according to claim 1, wherein: The step of parsing the access request to obtain the target user ID and the target experiment ID includes: The URI path in the access request is parsed by a preset Lua script to extract the target experiment ID and the target user ID embedded in the URI path.

7. The access control method for a training sandbox according to claim 1, wherein: If, before the step of matching the target LAN IP in the shared memory according to the target user ID and the target experiment ID, the method further comprises: According to the target user ID and the target experiment ID, a key-value matching query operation is performed in the shared memory to determine whether the target LAN IP is matched, wherein the shared memory stores the sandbox connection information of the created sandbox through a hash table structure.

8. The access control method for a training sandbox according to claim 1, wherein: After the step of generating a unique access path for each created sandbox according to the preset public network address, wherein the access path includes a unique identifier corresponding to the sandbox, the method further includes: Real-time detection of the real-time status identifier of the created sandbox; Dynamically update the sandbox connection information of the created sandbox in the shared memory according to the real-time status identifier.

9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the access control method for the training sandbox as claimed in any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the access control method for the training sandbox as claimed in any one of claims 1 to 8 are implemented.

Images