Public network access method and device, electronic equipment and medium

Abstract

The invention provides a public network access method and device, electronic equipment and a medium, and relates to the field of artificial intelligence and cloud computing, in particular to the technical field of network communication.The method comprises the steps that a first access initiating data packet transmitted by an access initiating end through a virtual route is received; an on-cloud virtual private network access source IP address in the first access initiation data packet is converted, a converted under-cloud intranet access source IP address is obtained, and the under-cloud intranet access source IP address is a high-availability virtual IP address; a second access initiation data packet after the first access initiation data packet is updated is obtained based on the under-cloud intranet access source IP address, the second access initiation data packet is transmitted to a public network gateway, and the public network gateway is used for converting the under-cloud intranet access source IP address in the second access initiation data packet into a public network access source IP address and transmitting the public network access source IP address to the cloud intranet access source IP address. And performing service access on the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

Description

Technical Field

[0001] The present disclosure relates to the fields of artificial intelligence and cloud computing, and in particular to the field of network communication technology. Background Art

[0002] With the development of technology, people can obtain the information they want through the retrieval service provided by artificial intelligence. After receiving the input demand information, artificial intelligence can generate corresponding replies by retrieving external information and return it to the user end. The retrieval cost is relatively high. Summary of the Invention

[0003] The present disclosure provides a public network access method, device, electronic device and medium.

[0004] According to a first aspect of the present disclosure, a public network access method is proposed, which is applicable to a primary virtual machine. The method includes: receiving a first access initiation data packet transmitted by an access initiator through a virtual route; converting the on-cloud virtual private network access source IP address in the first access initiation data packet to obtain a converted off-cloud intranet access source IP address, wherein the off-cloud intranet access source IP address is a highly available virtual IP address; obtaining a second access initiation data packet updated from the first access initiation data packet based on the off-cloud intranet access source IP address, and transmitting the second access initiation data packet to a public network gateway, wherein the public network gateway is used to convert the off-cloud intranet access source IP address in the second access initiation data packet into a public network access source IP address, so as to perform business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

[0005] A public network access method proposed in the first aspect of the present disclosure is applicable to a primary virtual machine. The method converts the on-cloud virtual private network access source IP address in the on-cloud virtual private network in the first access initiation data packet into the off-cloud intranet access source IP address in the internal network of the off-cloud computer room, and then converts the off-cloud intranet access source IP address into the public network access source IP address through a public network gateway. While opening up the traffic path between the virtual private network and the public network, the privacy and security of the network resources corresponding to the virtual private network of the cloud service are improved. The access of the virtual private network to the public network is realized by converting the IP address of the virtual private network, which reduces the number of public IP addresses used by the cloud service, reduces the public network access cost of the cloud service, and optimizes the access method of the virtual private network of the cloud service to the public network.

[0006] According to the second aspect of the present disclosure, a public network access method is proposed, which is applicable to a public network gateway. The method includes: receiving a second access initiation data packet transmitted by a primary virtual machine; converting the cloud intranet access source IP address in the second access initiation data packet to obtain a converted public network access source IP address; obtaining the public network access target IP address in the second access initiation data packet, and initiating access to the public network access target IP address based on the public network access source IP address.

[0007] The second aspect of the present disclosure proposes a public network access method, which is applicable to a public network gateway. The public network gateway converts the source IP address of the intranet access under the cloud to obtain the public network access source IP address, thereby realizing the service access of the access initiator corresponding to the public network source IP address in the virtual private network to the public network object on the public network target IP address. The public network access source IP address is used to mask the virtual private network access source IP address on the cloud of the access initiator, thereby improving the security and privacy when the virtual private network initiates service access to the public network, and improving the security of the network resources of the virtual private network. The public network gateway is configured for the virtual private network, opening up the traffic path between the virtual private network and the public network, reducing the cost of using public network resources for cloud services, and optimizing the method of initiating service access from the virtual private network to the public network.

[0008] According to a third aspect of the present disclosure, a public network access device is proposed, which is applicable to a primary virtual machine, and the device includes: a receiving module, which is used to receive a first access initiation data packet transmitted by an access initiator through a virtual route; a first IP address conversion module, which is used to convert the on-cloud virtual private network access source IP address in the first access initiation data packet to obtain a converted off-cloud intranet access source IP address, wherein the off-cloud intranet access source IP address is a highly available virtual IP address; a first access module, which is used to obtain a second access initiation data packet updated after the first access initiation data packet based on the off-cloud intranet access source IP address, and transmit the second access initiation data packet to a public network gateway, wherein the public network gateway is used to convert the off-cloud intranet access source IP address in the second access initiation data packet into a public network access source IP address, so as to perform business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

[0009] According to the fourth aspect of the present disclosure, a public network access device is proposed, which is suitable for a public network gateway. The device includes: a second receiving module, used to receive a second access initiation data packet transmitted by a primary virtual machine; a second IP address conversion module, used to convert the cloud intranet access source IP address in the second access initiation data packet to obtain a converted public network access source IP address; an access initiation module, used to obtain the public network access target IP address in the second access initiation data packet, and initiate access to the public network access target IP address based on the public network access source IP address.

[0010] According to a fifth aspect of the present disclosure, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the public network access method proposed in the first aspect and / or the second aspect.

[0011] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is proposed, wherein the computer instructions are used to enable the computer to execute the public network access method proposed in the first aspect and / or the second aspect.

[0012] According to a seventh aspect of the present disclosure, a computer program product is proposed, including a computer program, which, when executed by a processor, implements the public network access method proposed in the first aspect and / or the second aspect.

[0013] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0015] Figure 1 A flowchart of a method for accessing a public network according to an embodiment of the present disclosure is shown;

[0016] Figure 2 This is a flowchart of a method for accessing a public network according to another embodiment of the present disclosure;

[0017] Figure 3 This is a flowchart of a method for accessing a public network according to another embodiment of the present disclosure;

[0018] Figure 4 This is a flowchart of a method for accessing a public network according to another embodiment of the present disclosure;

[0019] Figure 5 This is a flowchart of a method for accessing a public network according to another embodiment of the present disclosure;

[0020] Figure 6 This is a flowchart of a method for accessing a public network according to another embodiment of the present disclosure;

[0021] Figure 7 This is a schematic structural diagram of a public network access device according to an embodiment of the present disclosure;

[0022] Figure 8 This is a structural diagram of a public network access device according to another embodiment of the present disclosure;

[0023] Figure 9 A schematic block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0024] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0025] Artificial Intelligence (AI) is a new technological discipline that studies and develops theories, methods, techniques, and application systems for simulating, extending, and expanding human intelligence. A branch of computer science, AI seeks to understand the essence of intelligence and develop new intelligent machines that can respond in a manner similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems.

[0026] Cloud computing is a type of distributed computing. It involves breaking down massive data processing programs into countless smaller programs via a network called the "cloud." These programs are then processed and analyzed by a system of multiple servers, generating results and returning them to users. In its early days, cloud computing was simply distributed computing, distributing tasks and consolidating results. Therefore, cloud computing is also known as grid computing.

[0027] Network Communication Technology (NTC) refers to the technology that uses computers and network communication equipment to collect, store, process and transmit data in the form of graphics and text, so as to fully share information resources.

[0028] Figure 1 This is a flow chart of a public network access method according to an embodiment of the present disclosure, which is applicable to a master virtual machine, such as Figure 1 As shown, the method includes:

[0029] S101: Receive a first access initiation data packet transmitted by an access initiator through a virtual router.

[0030] In the embodiment of the present disclosure, there is a relevant module in the virtual private network that needs to access the public network. The module can be determined as the access initiator of the virtual private network to the public network.

[0031] As an example, Figure 2 As shown, set Figure 2 The cloud computing / cloud storage module shown initiates access to the relevant Internet Protocol (IP) address in the public network. In this example, the cloud computing / cloud storage module can be determined as Figure 2 The access initiator in the illustrated scenario.

[0032] like Figure 2 As shown, in Figure 2 In the scenario shown, the cloud computing / cloud storage module as the access initiator and the main virtual machine can realize information exchange through virtual routing. Figure 2 In the scenario shown, the access initiator can transmit the first access initiation data packet to the virtual router, and transmit it to the virtual router through the virtual router. Figure 2 The primary virtual machine is shown.

[0033] In the embodiment of the present disclosure, the virtual private network routing table maintained by the virtual router records the IP address corresponding to the primary virtual machine in the current system. In this scenario, when the virtual router receives the first access data packet, it can obtain the IP address of the primary virtual machine based on the relevant record information of the primary virtual machine in the virtual private network routing table it maintains, and transmit the received first access initiation data packet to the IP address, so as to realize the transmission of the first access initiation data packet from the access initiation end to the primary virtual machine, thereby enabling the primary virtual machine to receive the first access initiation data packet transmitted by the access initiation end through the virtual router.

[0034] Among them, the virtual private network routing table maintained by the virtual router can be constructed based on the Layer 2 Media Access Control Address (MAC address) mapping table in the relevant technology. Through the virtual private network routing table, the mapping relationship between the virtual IP address-virtual MAC address (Virtual IP Address-VirtualMACAddress, vip-vmac) in the system and the MAC addresses of the primary virtual machine and the backup virtual machine can be obtained.

[0035] S102, convert the on-cloud virtual private network access source IP address in the first access initiation data packet to obtain a converted off-cloud intranet access source IP address, wherein the off-cloud intranet access source IP address is a highly available virtual IP address.

[0036] In the embodiment of the present disclosure, the source IP address carried in the first access initiation data packet is the IP address in the private network corresponding to the virtual private network, and it is impossible to directly initiate access to the target IP address in the public network. In this scenario, the source IP carried in the first access initiation data packet can be converted into an IP address that can initiate access in the public network.

[0037] Optionally, the source IP address in the first access initiation data packet may be an IP address within a virtual private network on the cloud. In this scenario, the access initiation source IP carried in the first access initiation data packet may be determined as the access source IP address of the virtual private network on the cloud.

[0038] In the scenario where the IP address corresponding to the virtual private network on the cloud is converted to the IP address corresponding to the internal network of the computer room under the cloud, the source IP address of the virtual private network on the cloud in the first access initiation data packet can be converted based on the conversion rules of the relevant technology for converting the IP address corresponding to the virtual private network on the cloud to the IP address corresponding to the internal network of the computer room under the cloud, and the converted IP address that can be used in the internal network of the computer room under the cloud is determined as the converted source IP address of the internal network access under the cloud.

[0039] As an example, Figure 2 As shown, the cloud virtual private network access source IP address carried in the first access initiation data packet is set to 172.16.1.6.

[0040] In this example, after the first access initiation data packet is transmitted to the primary virtual machine VM01 through the virtual router, the primary virtual machine VM01 can convert the cloud virtual private network access source IP address 172.16.1.6 in the first access initiation data packet.

[0041] like Figure 2As shown, the IP address 172.16.1.6 can be converted by the Source Network Address Translation (SNAT) rule in the related technology to an IP address that can be used in the internal network of the cloud computer room, that is, Figure 2 The IP address 100.127.0.55 shown is the converted source IP address for accessing the cloud's intranet.

[0042] It should be noted that the IP address that can be used in the internal network of the off-cloud computer room proposed in the embodiment of the present disclosure is a high-availability virtual IP (HAVIP). In this scenario, the off-cloud intranet access source IP address obtained by converting the on-cloud virtual private network access source IP address carried in the first access initiation data packet is the high-availability virtual IP address.

[0043] S103, based on the cloud-based intranet access source IP address, obtain a second access initiation data packet that is updated from the first access initiation data packet, and transmit the second access initiation data packet to the public network gateway, wherein the public network gateway is used to convert the cloud-based intranet access source IP address in the second access initiation data packet into a public network access source IP address, so as to perform business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

[0044] In an embodiment of the present disclosure, after converting the cloud virtual private network access source IP in the first access initiation data packet, the first access initiation data packet can be updated based on the converted IP address, and the updated data packet can be determined as the second access initiation data packet.

[0045] Optionally, the source IP address of the intranet access under the cloud can be updated to the first access initiation data packet, and the source IP address of the virtual private network access on the cloud in the first access initiation data packet can be deleted, thereby updating the first access initiation data packet and obtaining the updated second access initiation data packet.

[0046] In the disclosed embodiment, after obtaining the second access initiation data packet, it can be transmitted to a preset public network gateway, and the public network gateway can be used to implement service access from the access initiator in the virtual private network to the target access IP address in the public network.

[0047] Among them, after the public network gateway receives the second access initiation data packet, it can further convert the IP address of the cloud intranet access source IP address carried in the second access initiation data packet, so that the converted IP address can be used in the public network, and the IP address that can be used in the public network after conversion is determined as the public network access source IP address.

[0048] In an embodiment of the present disclosure, the second access initiation data packet carries the target IP address that the access initiator wants to access for business, wherein the target IP address is an IP address in the public network, then the target IP address can be determined as the public network access target IP address carried in the second access initiation data packet.

[0049] Optionally, after the public network gateway converts the source IP address of the intranet access under the cloud, the converted public network access source IP address can be used as the access initiation IP address corresponding to the access initiator in the virtual private network in the public network, and then business access to the public network access target IP address can be initiated based on the public network access source IP address.

[0050] The public network access method proposed in the present disclosure is applicable to a master virtual machine. The master virtual machine receives a first access initiation data packet transmitted by an access initiator through a virtual router, and converts the virtual private network access source IP address on the cloud to obtain a converted intranet access source IP address under the cloud. Furthermore, the first access initiation data packet is updated based on the intranet access source IP address under the cloud to obtain an updated second access initiation data packet, which is transmitted to a public network gateway. Then, the public network access source IP address corresponding to the intranet access source IP address under the cloud is obtained through the public network gateway, thereby realizing the service access of the access initiator to the corresponding public network access target IP address in the public network. In the present disclosure, the on-cloud virtual private network access source IP address in the on-cloud virtual private network in the first access initiation data packet is converted into the off-cloud intranet access source IP address in the internal network of the off-cloud computer room, and then the off-cloud intranet access source IP address is converted into the public network access source IP address through the public network gateway. While opening up the traffic path between the virtual private network and the public network, the privacy and security of the network resources corresponding to the virtual private network of the cloud service are improved. The access of the virtual private network to the public network is realized through the conversion of the IP address of the virtual private network, which reduces the number of public IP addresses used by the cloud service, reduces the public network access cost of the cloud service, and optimizes the access method of the virtual private network of the cloud service to the public network.

[0051] In the above embodiment, regarding the service access initiated by the virtual private network to the public network, it can also be combined with Figure 3 Further understanding, Figure 3 This is a flow chart of a public network access method according to another embodiment of the present disclosure, which is applicable to a master virtual machine, such as Figure 3As shown, the method includes:

[0052] Optionally, in response to the current primary virtual machine in the virtual private network running normally, the first access initiation data packet is received through the primary virtual machine.

[0053] In an embodiment of the present disclosure, a primary virtual machine currently running in a virtual private network used by a cloud service may experience an operational failure. In this scenario, before the primary virtual machine needs to receive a first access initiation data packet transmitted by an access initiator through a virtual router, it is necessary to determine that the primary virtual machine used to receive the first access initiation data packet is operating normally.

[0054] That is, when the primary virtual machine currently running in the virtual private network runs normally, the primary virtual machine can receive the first access initiation data packet transmitted by the access initiator through the virtual router.

[0055] Optionally, in response to a current primary virtual machine in the virtual private network failing, a new primary virtual machine is determined from a backup virtual machine cluster corresponding to the primary virtual machine, and the first access initiation data packet is received through the new primary virtual machine.

[0056] Accordingly, when the running state of the currently running primary virtual machine in the virtual private network fails, a new primary virtual machine can be obtained for the virtual private network, and the first access initiation data packet transmitted by the access initiator through the virtual router is received by the new primary virtual machine.

[0057] In an embodiment of the present disclosure, a virtual machine cluster is deployed in a virtual private network. The virtual machine cluster may include a primary virtual machine and corresponding multiple backup virtual machines. The cluster composed of multiple backup virtual machines may be determined as a backup virtual machine cluster corresponding to the primary virtual machine.

[0058] In this scenario, a backup virtual machine that meets relevant preset conditions can be obtained from the backup virtual machine cluster, and the primary virtual machine and the backup virtual machine are switched between the primary and backup roles.

[0059] As a possible implementation method, the active / standby switching between the primary virtual machine and the standby virtual machine can be implemented based on the high availability software in the related technology, such as Figure 4 As shown, when the primary virtual machine is running normally, you can Figure 4 The high availability software 1 shown is bound to the master virtual machine, and when the master virtual machine fails, it can be Figure 4 The high availability software 2 shown binds the standby virtual machine.

[0060] Among them, when other services in the virtual private network interact with the primary virtual machine, they can only use the virtual machine bound to the high-availability software as the primary virtual machine in the current virtual private network. It can be seen that the behavior of binding the backup virtual machine through the high-availability software 2 when the primary virtual machine fails as proposed in the above content can be regarded as using the backup virtual machine as the new primary virtual machine when the primary virtual machine fails, replacing the original failed primary virtual machine.

[0061] It should be noted that the fault detection of the primary virtual machine can be performed based on the heartbeat detection technology in the related art, or based on other methods, which are not specifically limited here.

[0062] As another possible implementation, the active / standby switching in the virtual private network can also be implemented based on the following method:

[0063] S301 : In response to a primary virtual machine operating abnormally, obtaining a host virtual IP address of the primary virtual machine.

[0064] In an embodiment of the present disclosure, the operating status of the primary virtual machine can be detected and identified based on the primary virtual machine operation failure identification method in the related technology. When the primary virtual machine operation failure is determined according to the detection and identification results, a new virtual machine can be obtained from the backup virtual machine cluster as the new primary virtual machine in the virtual private network.

[0065] Optionally, switching between the currently failed primary virtual machine and the new primary virtual machine determined in the backup virtual machine cluster can be achieved based on the IP drift method. In this scenario, it is necessary to obtain the IP address used by the currently running failed primary virtual machine in the virtual private network and determine the address as the host virtual IP address of the primary virtual machine.

[0066] S302: Obtain a standby virtual machine cluster corresponding to the primary virtual machine, and determine a target standby virtual machine from the standby virtual machine cluster.

[0067] In the embodiment of the present disclosure, based on preset screening conditions, a standby virtual machine that meets the set conditions can be screened out from the standby virtual machines in the standby virtual machine cluster, and the standby virtual machine can be determined as the target standby virtual machine in the standby virtual machine cluster.

[0068] As an example, Figure 2 As shown, set Figure 2 If the primary virtual machine VM01 in the current virtual private network fails, a backup virtual machine VM02 that meets the set conditions can be determined from the corresponding backup virtual machine cluster, and VM02 can be determined as the target backup virtual machine for VM01.

[0069] S303: Obtain the standby virtual IP address of the target standby virtual machine, and drift the virtual IP address based on the host virtual IP address and the standby virtual machine IP address, so as to switch the target standby virtual machine to a new primary virtual machine.

[0070] In the embodiment of the present disclosure, an IP address used by the target standby virtual machine in the virtual private network may be obtained as the standby virtual IP address of the target standby virtual machine.

[0071] Optionally, based on the IP address drift method in the relevant technology, virtual IP address drift can be performed between the host virtual IP address and the backup virtual IP address, so that the communication IP address between other modules in the virtual private network and the primary virtual machine is switched from the host virtual IP address of the current primary virtual machine to the backup virtual IP address of the target backup virtual machine, thereby realizing the master-slave switching between the primary virtual machine and the target backup virtual machine in the virtual private network, and then determining the target backup virtual machine as the new primary virtual machine in the virtual private network.

[0072] Among them, the IP address drift between the primary virtual machine and the target backup virtual machine can be achieved through the second-layer MAC address switching technology based on the high-availability virtual IP address in the relevant technology, or it can be achieved based on other technologies, which are not specifically limited here.

[0073] Optionally, after switching the new primary virtual machine, a master grabbing message corresponding to the new primary virtual machine can be sent to the virtual router, wherein the master grabbing message is used to update the primary virtual machine recorded in the virtual private network routing table on the virtual router to the new primary virtual machine.

[0074] That is, after the target standby virtual machine is switched to the new primary virtual machine, the new primary virtual machine can send a corresponding message to the virtual router, wherein the message can be determined as a master-seizing message corresponding to the new primary virtual machine.

[0075] In this scenario, after receiving the master-grabbing message, the virtual router can update the record information about the master virtual machine in the virtual private network routing table it maintains based on the relevant information of the new master virtual machine carried in the master-grabbing message, and replace the relevant information of the master virtual machine recorded in the routing table with the relevant information of the failed master virtual machine with the relevant information of the new master virtual machine, thereby realizing the information update of the virtual private network routing table maintained by the virtual router.

[0076] As an example, Figure 2 As shown, you can get Figure 2 The host virtual IP address of VM01 and the standby virtual IP address of the target standby virtual machine VM02 are shown, and the virtual IP address drift is performed based on the two, and VM02 is switched to Figure 2 The new primary virtual machine in the virtual private network is shown.

[0077] Furthermore, after VM02 switches to the new primary virtual machine, the master grabbing message can be sent to Figure 2 The virtual router shown is used to update the virtual private network routing table on the virtual router.

[0078] The public network access method proposed in the present invention realizes the master-slave switching between the primary virtual machine and the target backup virtual machine through IP address drift. Compared with the master-slave virtual machine switching realized by the control plane proposed in the related art, the operation steps of switching between the primary and backup virtual machines are simplified, and the switching speed between the primary and backup virtual machines is improved. In the scenario where the primary virtual machine has an operation failure, the possibility of network abnormalities caused by virtual machine failure is reduced, and the dependence of the master-slave virtual machine switching on the control plane components included in the virtual cloud is reduced, thereby reducing the possibility of master-slave switching delays and network delays caused by abnormalities of the control plane components. The master-slave switching is realized by binding the primary virtual machine based on high-availability software, which improves the fault detection efficiency of the primary virtual machine. The master-slave virtual machine switching is realized by IP address drift, which narrows the operation area of ​​the master-slave switching and reduces the resources occupied by the master-slave switching operation, thereby improving the efficiency of virtual machine fault handling, shortening the delay time of network delays caused by virtual machine failure, improving the stability and continuity of the cloud service network, and optimizing the user's network usage experience.

[0079] In the above embodiment, the service access initiated by the access initiator in the virtual private network to the public network access target IP address can be combined with Figure 5 Further understanding, Figure 5 This is a flowchart of a public network access method according to another embodiment of the present disclosure, which is applicable to a public network gateway, such as Figure 5 As shown, the method includes:

[0080] S501: Receive a second access initiation data packet transmitted by a primary virtual machine.

[0081] In the embodiment of the present disclosure, after the primary virtual machine in the virtual private network receives the first access initiation data packet, it converts the cloud virtual private network access source IP address carried therein to obtain the cloud intranet access source IP address corresponding to the cloud computer room intranet, thereby updating the first access initiation data packet and obtaining an updated second access initiation data packet.

[0082] In this scenario, the primary virtual machine transmits the second access initiation data packet to the public network gateway corresponding to the virtual private network, so as to realize the service access of the access initiator in the virtual private network to the public network access target IP address based on the public network gateway.

[0083] As an example, Figure 2As shown, when VM01 is the primary virtual machine in the virtual private network, the second access initiation data packet can be transmitted to the public network gateway through the information interaction link between VM01 and the public network gateway, and when VM02 is the primary virtual machine in the virtual private network, the second access initiation data packet can be transmitted to the public network gateway through the information interaction link between VM02 and the public network gateway, so that the public network gateway can receive the second access initiation data packet transmitted by the primary virtual machine.

[0084] S502: Convert the cloud-based intranet access source IP address in the second access initiation data packet to obtain a converted public network access source IP address.

[0085] In the embodiment of the present disclosure, the second access initiation data packet received by the public network gateway carries the cloud-based intranet access source IP address used by the cloud-based computer room intranet. This IP address cannot be used directly in the public network. In this scenario, the cloud-based intranet access source IP address needs to be further converted to obtain the corresponding public network IP address as the public network access source IP address corresponding to the cloud-based intranet access source IP address.

[0086] Optionally, the IP address conversion rules set between the internal network of the cloud computer room and the public network in the relevant technology can be obtained, and based on the rules, the cloud internal network access source IP address in the second access initiation data packet can be converted to obtain the public network access source IP address as the access initiation IP address in the public network.

[0087] As an example, Figure 2 As shown, set Figure 2 The 100.127.0.55 shown is the source IP address of the cloud network carried in the second access initiation data packet. The IP address can be converted to the IP address 30.6.1.1 that can be used in the public network. Figure 2 In the scenario shown, 30.6.1.1 can be determined as the public network access source IP address corresponding to the cloud's intranet access source IP address 100.127.0.55.

[0088] S503: Obtain the public network access target IP address in the second access initiation data packet, and initiate access to the public network access target IP address based on the public network access source IP address.

[0089] In the embodiment of the present disclosure, the second access initiation data packet carries the public network IP address of the public network object that the access initiator wants to access. This address can be determined as the public network access target IP address corresponding to the public network access object.

[0090] In this scenario, after the public network gateway obtains the public network access source IP address, it can obtain the corresponding public network access target IP address from the second access initiation data packet. In this scenario, the public network gateway can use the public network access source IP address as the access initiation IP address within the public network, and through the access method in the relevant technology, initiate business access to the public network access target IP address based on the address, thereby realizing business access from the access initiator within the virtual private network to the public network object on the public network access target IP address within the public network.

[0091] The public network access method proposed in the present disclosure receives a second access initiation data packet transmitted by a primary virtual machine, and converts the cloud-based intranet access source IP address therein to obtain a corresponding public network access source IP address, and then initiates business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address. In the present disclosure, the cloud-based intranet access source IP address is converted by a public network gateway to obtain a public network access source IP address, thereby realizing the business access of the access initiator corresponding to the public network source IP address in the virtual private network to the public network object on the public network access target IP address, and masking the cloud-based virtual private network access source IP address of the access initiator with the public network access source IP address, thereby improving the security and privacy of the virtual private network when initiating business access to the public network, and improving the security of the network resources of the virtual private network, configuring a public network gateway for the virtual private network, opening up the traffic path between the virtual private network and the public network, reducing the cost of using public network resources for cloud services, and optimizing the method for initiating business access from the virtual private network to the public network.

[0092] In the above embodiment, the service access initiated by the access initiator in the virtual private network to the public network access target IP address can be combined with Figure 6 Further understanding, Figure 6 This is a flowchart of a public network access method according to another embodiment of the present disclosure, which is applicable to a public network gateway, such as Figure 6 As shown, the method includes:

[0093] S601: Acquire a transmission data packet from a second access initiation data packet.

[0094] In the embodiment of the present disclosure, the second access initiation data packet carries data that the access initiator needs to transmit when accessing the corresponding public network object. This part of data can be determined as the transmission data for the service access carried in the second access initiation data packet.

[0095] Furthermore, based on the method for constructing a public network transmission data packet in the related art, a corresponding data packet is constructed based on the transmission data, and the data packet is determined as a public network transmission data packet obtained based on the second access initiation data packet.

[0096] S602: Using the public network access source IP address as a data sending end, a transmission data packet is sent to the public network access target IP address to initiate access to the public network access target IP address.

[0097] In the embodiment of the present disclosure, the public network access source IP address can be used as the data sending end of the transmission data packet, and the public network access target IP address can be used as the data receiving end of the transmission data packet.

[0098] In this scenario, based on the data packet transmission method within the public network in the relevant technology, the transmission data packet can be transmitted from the public network access source IP address to the public network access target IP address, and when the public network object on the public network access target IP address receives the transmission data packet, service access from the public network access source IP address to the public network access target IP address can be realized.

[0099] As an example, Figure 2 As shown, it can be achieved through Figure 2 The public network gateway shown transmits the transmission data packet obtained based on the second access initiation data packet from the public network access source IP address 30.6.1.1 to Figure 2 The public network access target IP address shown is 30.6.1.2, and when the public network object on the public network access target IP address 30.6.1.2 receives the transmission data packet, service access from the public network access source IP address 30.6.1.1 to the public network access target IP address 30.6.1.2 is realized.

[0100] In the embodiment of the present disclosure, after the public network object at the public network access target IP address receives the transmission data packet, it needs to respond to the public network access source IP address that initiated the service access.

[0101] Optionally, a public network response data packet transmitted from a public network access target IP address is received.

[0102] In the embodiment of the present disclosure, after receiving the transmission data packet, the public network access target IP address can generate a corresponding access response based on the specific information carried in the transmission data packet, and return it to the public network access source IP address in the form of a data packet.

[0103] The data packet generated by the public network access target IP address based on the service access response information may be determined as the public network response data packet.

[0104] In this scenario, the public network object at the target IP address of public network access can use itself as the data sender of the data packet and the public network gateway of the virtual private network as the data receiver, and then transmit the response data packet to the public network gateway, so that the public network gateway can receive the public network response data packet transmitted by the public network object at the target IP address of public network access.

[0105] Optionally, the public network response target IP address in the public network response data packet is converted to obtain a converted on-cloud virtual private network response target IP address.

[0106] In the embodiment of the present disclosure, after the public network gateway receives the public network response data packet, it needs to transmit the information carried in the public network response data packet to the access initiator in the virtual private network. In this scenario, the public network gateway can convert the relevant IP address in the public network response data packet.

[0107] The public network response data packet carries the IP address corresponding to the access initiator in the public network to which the public network response data packet needs to be delivered. The IP address is determined as the public network response target IP address in the public network response data packet.

[0108] In this scenario, based on the mapping relationship between the IP addresses of the virtual private network and the public network, the public network response target IP address can be converted into an IP address that can be used in the virtual private network. This IP address is the converted virtual private network response target IP address on the cloud.

[0109] Optionally, the public network response data packet is updated based on the virtual private network response target IP address on the cloud to obtain an updated private network response data packet, and the private network response data packet is sent to the primary virtual machine through virtual routing.

[0110] In the embodiment of the present disclosure, the public network gateway can update the public network response data packet with the virtual private network response target IP address on the cloud obtained after conversion, and determine the updated data packet as a private network response data packet.

[0111] Optionally, the public network gateway can realize the transmission of the private network response data packet to the access initiator through the virtual router in the virtual private network. That is to say, after the public network gateway obtains the private network response data packet, it can transmit it to the virtual router, determine the IP address of the main virtual machine running in the current virtual private network through the virtual private network routing table maintained by the virtual router, and then transmit the private network response data packet to the main virtual machine of the virtual private network, and then transmit the private network response data packet to the access initiator at the virtual private network response target IP address on the cloud through the main virtual machine, thereby realizing the response of the public network object that the access initiator wants to access to the business access initiated by the access initiator.

[0112] As an example, Figure 2 As shown, the public network object on 30.6.1.2 can transmit the public network response data packet to Figure 2 At the public network gateway shown, the public network gateway converts the public network response target IP address in the public network response data packet into Figure 2The virtual private network on the cloud that can be used in the virtual private network shown responds to the target IP address 172.16.1.6, and the public network response data packet is updated based on the virtual private network on the cloud response target IP address to obtain the corresponding private network response data packet.

[0113] Further, through Figure 2 Shows that the virtual router transmits the private network response packet to Figure 2 At the main virtual machine VM01 shown, the private network response data packet is transmitted to Figure 2 The access initiator of cloud computing / cloud service is shown, thereby realizing the response of the public network object on 30.6.1.2 to the virtual private network object on 172.16.1.6.

[0114] The public network access method proposed in the present invention converts the source IP address of the intranet access under the cloud into a public network access source IP address through a public network gateway, thereby realizing the service access of the access initiator corresponding to the public network source IP address in the virtual private network to the public network object on the public network target IP address, and masks the virtual private network access source IP address on the cloud of the access initiator by the public network source IP address, thereby improving the security and privacy when the virtual private network initiates service access to the public network, and improving the security of the network resources of the virtual private network, configuring a public network gateway for the virtual private network, opening up the traffic path between the virtual private network and the public network, and reducing the cost of using public network resources for cloud services.

[0115] An embodiment of the present disclosure further proposes a public network access device. Since the public network access device proposed in the embodiment of the present disclosure corresponds to the public network access methods proposed in the above-mentioned embodiments, the implementation methods of the above-mentioned public network access methods are also applicable to the public network access device proposed in the embodiment of the present disclosure and will not be described in detail in the following embodiments.

[0116] Figure 7 This is a schematic diagram of the structure of a public network access device according to an embodiment of the present disclosure, which is applicable to a master virtual machine, such as Figure 7 As shown, the public network access device 700 includes a first receiving module 71, a first IP address conversion module 72 and a first access module 73, wherein:

[0117] A first receiving module 71 is configured to receive a first access initiation data packet transmitted from an access initiating end through a virtual router;

[0118] A first IP address conversion module 72 is configured to convert the on-cloud virtual private network access source IP address in the first access initiation data packet to obtain a converted off-cloud intranet access source IP address, wherein the off-cloud intranet access source IP address is a highly available virtual IP address;

[0119] The first access module 73 is used to obtain a second access initiation data packet that is updated after the first access initiation data packet is obtained based on the cloud intranet access source IP address, and transmit the second access initiation data packet to the public network gateway, wherein the public network gateway is used to convert the cloud intranet access source IP address in the second access initiation data packet into a public network access source IP address, so as to perform business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

[0120] In the embodiment of the present disclosure, the first receiving module 71 is also used to: in response to the current primary virtual machine in the virtual private network operating normally, receive a first access initiation data packet through the primary virtual machine; in response to the current primary virtual machine in the virtual private network operating failure, determine a new primary virtual machine from the backup virtual machine cluster corresponding to the primary virtual machine, and receive the first access initiation data packet through the new primary virtual machine.

[0121] In the embodiment of the present disclosure, the first receiving module 71 is also used to: obtain the host virtual IP address of the primary virtual machine in response to abnormal operation of the primary virtual machine; obtain the standby virtual machine cluster corresponding to the primary virtual machine, and determine the target standby virtual machine from the standby virtual machine cluster; obtain the standby virtual IP address of the target standby virtual machine, and drift the virtual IP address based on the host virtual IP address and the standby virtual machine IP address to switch the target standby virtual machine to the new primary virtual machine.

[0122] In an embodiment of the present disclosure, the device also includes a sending module for sending a master grabbing message corresponding to the new master virtual machine to the virtual router, wherein the master grabbing message is used to update the master virtual machine recorded in the virtual private network routing table on the virtual router to the new master virtual machine.

[0123] In an embodiment of the present disclosure, the device also includes a first response module, which is used to: receive a private network response data packet transmitted by the public network gateway through the virtual router, and obtain the virtual private network response target IP address on the cloud in the private network response data packet; based on the virtual private network response target IP address on the cloud, transmit the private network response data packet to the access initiator.

[0124] The public network access device proposed in the present disclosure is applicable to a master virtual machine. The master virtual machine receives a first access initiation data packet transmitted by an access initiator through a virtual route, and converts the virtual private network access source IP address on the cloud to obtain a converted intranet access source IP address under the cloud. Furthermore, the first access initiation data packet is updated based on the intranet access source IP address under the cloud to obtain an updated second access initiation data packet, and the updated second access initiation data packet is transmitted to a public network gateway. Then, the public network access source IP address corresponding to the intranet access source IP address under the cloud is obtained through the public network gateway, thereby realizing the service access of the access initiator to the corresponding public network access target IP address in the public network. In the present disclosure, the on-cloud virtual private network access source IP address in the on-cloud virtual private network in the first access initiation data packet is converted into the off-cloud intranet access source IP address in the internal network of the off-cloud computer room, and then the off-cloud intranet access source IP address is converted into the public network access source IP address through the public network gateway. While opening up the traffic path between the virtual private network and the public network, the privacy and security of the network resources corresponding to the virtual private network of the cloud service are improved. The access of the virtual private network to the public network is realized through the conversion of the IP address of the virtual private network, which reduces the number of public IP addresses used by the cloud service, reduces the public network access cost of the cloud service, and optimizes the access method of the virtual private network of the cloud service to the public network.

[0125] An embodiment of the present disclosure further proposes a public network access device. Since the public network access device proposed in the embodiment of the present disclosure corresponds to the public network access methods proposed in the above-mentioned embodiments, the implementation methods of the above-mentioned public network access methods are also applicable to the public network access device proposed in the embodiment of the present disclosure and will not be described in detail in the following embodiments.

[0126] Figure 8 This is a schematic diagram of the structure of a public network access device according to an embodiment of the present disclosure, which is applicable to a public network gateway, such as Figure 8 As shown, the public network access device 800 includes a second receiving module 81, a second IP address conversion module 82 and an access initiating module 83, wherein:

[0127] The second receiving module 81 is used to receive a second access initiation data packet transmitted by the primary virtual machine;

[0128] The second IP address conversion module 82 is used to convert the cloud-based intranet access source IP address in the second access initiation data packet to obtain a converted public network access source IP address;

[0129] The access initiating module 83 is configured to obtain the public network access target IP address in the second access initiating data packet, and initiate access to the public network access target IP address based on the public network access source IP address.

[0130] In the embodiment of the present disclosure, the access initiation module 83 is also used to: obtain a transmission data packet from the second access initiation data packet; use the public network access source IP address as the data sending end, and send the transmission data packet to the public network access target IP address to initiate access to the public network access target IP address.

[0131] In the embodiment of the present disclosure, the device also includes a second response module, which is used to: receive a public network response data packet transmitted from a public network access target IP address; convert the public network response target IP address in the public network response data packet to obtain a converted virtual private network response target IP address on the cloud; update the public network response data packet based on the virtual private network response target IP address on the cloud to obtain an updated private network response data packet, and send the private network response data packet to the main virtual machine through virtual routing.

[0132] The public network access device proposed in the present disclosure receives the second access initiation data packet transmitted by the main virtual machine, and converts the cloud-based intranet access source IP address therein to obtain the corresponding public network access source IP address, and then initiates business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address. In the present disclosure, the cloud-based intranet access source IP address is converted by the public network gateway to obtain the public network access source IP address, which realizes the business access of the access initiator corresponding to the public network source IP address in the virtual private network to the public network object on the public network access target IP address, and uses the public network access source IP address to mask the cloud-based virtual private network access source IP address of the access initiator, thereby improving the security and privacy of the virtual private network when initiating business access to the public network, as well as the security of the network resources of the virtual private network, configuring a public network gateway for the virtual private network, opening up the traffic path between the virtual private network and the public network, reducing the cost of using public network resources for cloud services, and optimizing the method of initiating business access from the virtual private network to the public network.

[0133] According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0134] Figure 9 A schematic block diagram of an example electronic device 900 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0135] like Figure 9 As shown, the device 900 includes a computing unit 901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded from a storage unit 909 into a random access memory (RAM) 903. Various programs and data required for the operation of the device 900 can also be stored in the RAM 903. The computing unit 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0136] Various components in the device 900 are connected to the I / O interface 905, including an input unit 906, such as a keyboard, a mouse, etc.; an output unit 906, such as various types of displays, speakers, etc.; a storage unit 909, such as a magnetic disk, an optical disk, etc.; and a communication unit 909, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 909 allows the device 900 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0137] The computing unit 901 can be a variety of general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 901 performs the various methods and processes described above, such as the public network access method. For example, in some embodiments, the public network access method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 909. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 900 via the ROM 902 and / or the communication unit 909. When the computer program is loaded into the RAM 903 and executed by the computing unit 901, one or more steps of the public network access method described above can be performed. Alternatively, in other embodiments, the computing unit 901 can be configured to perform the public network access method by any other appropriate means (e.g., by means of firmware).

[0138] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0140] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0141] To initiate interaction with a user account, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user account; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user account can provide input to the computer. Other types of devices can also be used to initiate interaction with the user account; for example, feedback provided to the user account can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user account can be received in any form (including acoustic input, voice input, or tactile input).

[0142] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user account computer with a graphical user account interface or a web browser through which a user account can interact with embodiments of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0143] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0144] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0145] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A method for accessing a public network, wherein: Applicable to a master virtual machine, the method includes: receiving a first access initiation data packet transmitted by the access initiator through the virtual router; Converting the on-cloud virtual private network access source IP address in the first access initiation data packet to obtain a converted off-cloud intranet access source IP address, wherein the off-cloud intranet access source IP address is a highly available virtual IP address; Based on the cloud-based intranet access source IP address, a second access initiation data packet that is updated after the first access initiation data packet is obtained, and the second access initiation data packet is transmitted to the public network gateway, wherein the public network gateway is used to convert the cloud-based intranet access source IP address in the second access initiation data packet into a public network access source IP address, so as to perform business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

2. The method according to claim 1, wherein The receiving of a first access initiation data packet transmitted by the access initiator through the virtual router includes: In response to the current primary virtual machine in the virtual private network running normally, receiving the first access initiation data packet through the primary virtual machine; In response to a failure of the current primary virtual machine in the virtual private network, a new primary virtual machine is determined from a backup virtual machine cluster corresponding to the primary virtual machine, and the first access initiation data packet is received through the new primary virtual machine.

3. The method according to claim 2, wherein: In response to the current primary virtual machine in the virtual private network failing to operate, determining a new primary virtual machine from a backup virtual machine cluster corresponding to the primary virtual machine includes: In response to the primary virtual machine operating abnormally, obtaining a host virtual IP address of the primary virtual machine; Obtain a standby virtual machine cluster corresponding to the primary virtual machine, and determine a target standby virtual machine from the standby virtual machine cluster; The standby virtual IP address of the target standby virtual machine is obtained, and virtual IP address drift is performed based on the host virtual IP address and the standby virtual machine IP address, so as to switch the target standby virtual machine to a new primary virtual machine.

4. The method according to claim 3, wherein: After switching the target standby virtual machine to a new primary virtual machine, the method further includes: A master-grabbing message corresponding to the new master virtual machine is sent to the virtual router, wherein the master-grabbing message is used to update the master virtual machine recorded in the virtual private network routing table on the virtual router to the new master virtual machine.

5. The method according to claim 1, wherein The method further comprises: Receive the private network response data packet transmitted by the public network gateway through the virtual router, and obtain the cloud virtual private network response target IP address in the private network response data packet; Based on the on-cloud virtual private network response target IP address, the private network response data packet is transmitted to the access initiator.

6. A method for accessing a public network, wherein: Applicable to a public network gateway, the method includes: Receive a second access initiation data packet transmitted by the primary virtual machine; Converting the cloud-based intranet access source IP address in the second access initiation data packet to obtain a converted public network access source IP address; Obtain the public network access target IP address in the second access initiation data packet, and initiate access to the public network access target IP address based on the public network access source IP address.

7. The method according to claim 6, wherein: The obtaining of the public network access target IP address in the second access initiation data packet and initiating access to the public network access target IP address based on the public network access source IP address includes: Acquire a transmission data packet from the second access initiation data packet; The public network access source IP address is used as a data sending end, and the transmission data packet is sent to the public network access target IP address to initiate access to the public network access target IP address.

8. The method according to claim 7, wherein: The method further comprises: Receive a public network response data packet transmitted from the public network access target IP address; Convert the public network response target IP address in the public network response data packet to obtain a converted on-cloud virtual private network response target IP address; The public network response data packet is updated based on the virtual private network response target IP address on the cloud to obtain an updated private network response data packet, and the private network response data packet is sent to the main virtual machine through virtual routing.

9. A public network access device, wherein: Applicable to a master virtual machine, the device includes: A receiving module, configured to receive a first access initiation data packet transmitted by the access initiator through the virtual router; A first IP address conversion module is configured to convert the on-cloud virtual private network access source IP address in the first access initiation data packet to obtain a converted off-cloud intranet access source IP address, wherein the off-cloud intranet access source IP address is a highly available virtual IP address; The first access module is used to obtain a second access initiation data packet that is updated by the first access initiation data packet based on the cloud-based intranet access source IP address, and transmit the second access initiation data packet to the public network gateway, wherein the public network gateway is used to convert the cloud-based intranet access source IP address in the second access initiation data packet into a public network access source IP address, so as to perform business access to the public network access target IP address carried in the second access initiation data packet based on the public network access source IP address.

10. A public network access device, wherein: Applicable to a public network gateway, the device includes: A second receiving module is used to receive a second access initiation data packet transmitted by the primary virtual machine; A second IP address conversion module is used to convert the cloud internal network access source IP address in the second access initiation data packet to obtain a converted public network access source IP address; The access initiation module is used to obtain the public network access target IP address in the second access initiation data packet, and initiate access to the public network access target IP address based on the public network access source IP address.

11. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5 and / or 6-8.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5 and / or 6-8.

13. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1-5 and / or 6-8.

Images