Communication method, system and device between cloud and private network, medium and product

Abstract

The invention discloses a method, a system, equipment, a medium and a product for communication between a cloud and a private network in the technical field of communication, and the method comprises the following steps: for the cloud and the private network in an isolated state, when a first server (such as a server of a NaaS service provider) located at the cloud obtains first indication information, sending the first indication information to the cloud; if the proxy server located in the private network has established a first channel between the first server and the proxy server, the first server forwards the first indication information to the proxy server through the first channel, and the proxy server processes the first indication information by using at least one resource in the private network, the external message is processed according to the configured logic of the private network, and the processing process of the external message is ensured to meet the well configured constraint of the private network, so that the internal service calling link of the private network can be opened through the message forwarding mode on the premise of ensuring the safety; therefore, safe and controllable communication of the cloud to the intranet service is realized.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method, system, device, equipment, medium, and product between the cloud and a private network. Background Technology

[0002] With the development of the internet, enterprises are increasingly adopting private network isolation to protect their internal resources (such as business data stored in databases). This creates a need for communication between different networks, such as between public networks (e.g., the cloud) and private networks. A public network is a network built and managed by an internet service provider and open to all users. A private network is a network built and managed by an enterprise, organization, or individual and open only to specific authorized users.

[0003] To facilitate understanding, examples will be provided below.

[0004] As an example, in some scenarios, such as Network as a Service (NaaS), cloud-based users (e.g., NaaS service providers) need to access various protocol services within a private network for NaaS service configuration and management. Meanwhile, private network owners have at least the following requirements: they cannot grant cloud-based users excessive network permissions, and they cannot access the private network's internal structure during maintenance. Therefore, meeting these requirements has become a pressing technical challenge. NaaS is a cloud-based service model. Based on network virtualization technology, NaaS can provide flexible subscription-based network services to enterprises, allowing them to use network infrastructure (such as hardware, software, management tools, licenses, etc.) on demand, providing complete network lifecycle services. Summary of the Invention

[0005] To address the aforementioned technical problems, this application provides a communication method, system, apparatus, device, medium, and product between the cloud and a private network.

[0006] To achieve the above objectives, the technical solution provided in this application is as follows:

[0007] This application provides a communication method between a cloud and a private network. The method is applied to a first server located in the cloud and includes: obtaining first indication information; in response to a proxy server located in the private network having established a first channel between the first server and the proxy server, forwarding the first indication information to the proxy server through the first channel; and the proxy server performing at least one task in the private network according to the first indication information.

[0008] In one possible implementation, the first indication information is a request to create a channel corresponding to an independent long connection for the target object; or, the first indication information is an event message in short connection mode; or, the first indication information is an event message in long connection mode.

[0009] In one possible implementation, the first channel is a channel corresponding to a persistent long connection; the step of performing at least one task in the private network according to the first indication information includes: responding to the request of the first indication information to create a channel corresponding to an independent long connection for a target object, creating a second channel between the first server and the proxy server via the proxy server, wherein the channel corresponding to the independent long connection includes the second channel, and the channel corresponding to the independent long connection is used to implement the data communication process corresponding to the target object.

[0010] In one possible implementation, the step of performing at least one task in the private network according to the first instruction information further includes: creating a third channel between the proxy server and a processing server located in the private network via the proxy server, wherein the processing server uses at least one resource in the private network to process messages sent by the proxy server through the third channel, and the channel corresponding to the independent long connection further includes the third channel.

[0011] In one possible implementation, the method further includes: in response to the completion of channel establishment corresponding to the independent long connection, obtaining second indication information corresponding to the target object; forwarding the second indication information to the proxy server through the second channel, and processing the second indication information through the proxy server; and receiving the processing result of the second indication information fed back by the proxy server through the second channel.

[0012] In one possible implementation, the first indication information is sent through an interface corresponding to the short connection mode; the method further includes: in response to a preset interface located in the cloud receiving a processing result of the first indication information fed back by the proxy server, receiving a processing result of the first indication information forwarded by the preset interface.

[0013] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode; the method further includes: receiving the processing result of the first indication information fed back by the proxy server through the first channel.

[0014] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode; in response to the processing time of the first indication information not exceeding a preset threshold, the proxy server feeds back the processing result of the first indication information through the first channel; in response to the processing time of the first indication information exceeding the preset threshold, the proxy server feeds back the processing result of the first indication information through a preset interface located in the cloud.

[0015] In one possible implementation, the first instruction information is further processed based on preset permission information, which indicates the user who sent the first instruction information to have usage rights to some or all resources in the private network.

[0016] In one possible implementation, the first channel satisfies at least one of the following constraints: the first channel is a channel corresponding to a persistent long connection, and data communication processes under at least one mode are implemented through the first channel, the at least one mode including at least one of a long connection mode and a short connection mode; the message transmitted through the first channel carries at least one identifier, the at least one identifier including at least one of a message identifier, a channel identifier, and a routing identifier; the message transmitted through the first channel is in an encrypted state.

[0017] In one possible implementation, forwarding the first indication information to the proxy server through the first channel includes: in response to the proxy server being in an available state, forwarding the first indication information to the proxy server through the first channel.

[0018] In one possible implementation, obtaining the first indication information includes: in response to a second server located in the cloud receiving the first indication information sent by a caller in the cloud, receiving the first indication information forwarded by the second server.

[0019] In one possible implementation, the first server has unidirectional outbound call control over the proxy server.

[0020] In one possible implementation, the first channel is a channel corresponding to a persistent long-lived connection, and the first channel is in a sustained state while the proxy server is in an available state.

[0021] In one possible implementation, the first server is a server of a Network as a Service (NaaS) service provider, which performs NaaS service configuration or management operations on the private network through the first server and the proxy server.

[0022] This application provides a communication system between a cloud and a private network. The system includes a first server located in the cloud and a proxy server located in the private network. The first server executes the communication method between the cloud and the private network provided in this application.

[0023] This application provides a communication device between a cloud and a private network, comprising: a first acquisition unit for acquiring first instruction information; and a first transmission unit for forwarding the first instruction information to the proxy server through a first channel established between a proxy server located in the private network and a first server located in the cloud, wherein the proxy server performs at least one task in the private network according to the first instruction information.

[0024] This application provides an electronic device, the device comprising: a processor and a memory; the memory for storing instructions or computer programs; the processor for executing the instructions or computer programs in the memory, so that the electronic device performs the cloud-to-private network communication method provided in this application.

[0025] This application provides a computer-readable medium, characterized in that the computer-readable medium stores instructions or computer programs, which, when executed on a device, cause the device to perform the communication method between the cloud and a private network provided in this application.

[0026] This application provides a computer program product including a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the communication method between the cloud and a private network provided in this application.

[0027] Compared with related technologies, this application has at least the following advantages:

[0028] In the communication scheme provided in this application, for the isolated cloud and private network, when the first server (such as the cloud gateway) in the cloud obtains the first instruction information, if the proxy server (such as the intranet proxy) in the private network has established a first channel between the first server and the proxy server, the first server forwards the first instruction information to the proxy server through the first channel. This enables the proxy server to perform at least one task (such as data query, data processing, processing logic call, etc.) in the private network according to the first instruction information. This allows the proxy server to process external messages (such as the first instruction information) according to the logic configured by the private network itself, thereby ensuring that the processing of the external message meets the constraints configured by the private network itself (such as access permissions for resources such as databases). In this way, the service call link within the private network (hereinafter referred to as "internet") can be opened up under the premise of ensuring security through message forwarding, so as to better realize secure and controllable communication between the cloud and the intranet services.

[0029] In addition, the aforementioned first channel is created by a proxy server in the private network, rather than by the first server. This is to better enable the private network to proactively provide a secure and usable channel to the outside world, avoiding the defects caused by the private network's inability to ensure secure communication when the first server proactively creates the channel. This is conducive to achieving secure and controllable communication in the private network. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This application provides a solution for implementing cross-network communication requirements in its embodiments.

[0032] Figure 2 A flowchart illustrating a communication method between a cloud and a private network, provided as an embodiment of this application;

[0033] Figure 3 A schematic diagram illustrating a data communication process that accommodates multiple connection modes, provided as an embodiment of this application;

[0034] Figure 4 This application provides a schematic diagram of the structure of a server deployed in the cloud, as illustrated in an embodiment of the present application.

[0035] Figure 5A schematic diagram of the structure of a proxy deployed in a private network, provided as an embodiment of this application;

[0036] Figure 6 A schematic diagram illustrating a data communication process that accommodates multiple connection modes, provided as an embodiment of this application;

[0037] Figure 7 A schematic diagram illustrating the establishment and usage process of an independent channel provided in this application embodiment;

[0038] Figure 8 A schematic diagram illustrating a short connection event processing flow provided in an embodiment of this application;

[0039] Figure 9 A schematic diagram illustrating a data communication process in a short connection mode, provided as an embodiment of this application;

[0040] Figure 10 A schematic diagram illustrating a data communication process in a short connection mode, provided as an embodiment of this application;

[0041] Figure 11 A schematic diagram illustrating a data communication process in a short connection mode, provided as an embodiment of this application;

[0042] Figure 12 A schematic diagram illustrating a data communication process in a short connection mode, provided as an embodiment of this application;

[0043] Figure 13 A schematic diagram illustrating a data communication process in a short connection mode, provided as an embodiment of this application;

[0044] Figure 14 A schematic diagram of a layered and loosely coupled distributed architecture provided in an embodiment of this application;

[0045] Figure 15 This application provides a schematic diagram of the structure of a communication system between a cloud and a private network, as illustrated in an embodiment of the present application.

[0046] Figure 16 This application provides a schematic diagram of the structure of a communication device between a cloud and a private network, as illustrated in an embodiment of the present application.

[0047] Figure 17 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0048] To facilitate understanding of the technical solution of this application, some technical terms are introduced below.

[0049] A socket is a mechanism for inter-process communication in computer networks. It serves as an interface or endpoint for network communication between different devices. Therefore, for two devices to communicate, a socket needs to be created on each device so that these sockets can be connected in a certain way to form a data transmission channel.

[0050] WebSSH is a technology or tool that enables SSH (Secure Shell) remote connections via a web browser. It allows users to securely connect to and manage remote servers directly through a browser without needing to install dedicated SSH client software locally. SSH is a network security protocol that uses encryption and authentication mechanisms to provide secure remote login, file transfer, and other network services.

[0051] The POST interface is an interface in the Hypertext Transfer Protocol (HTTP) used by clients to submit data to servers.

[0052] WebSocket is a network protocol that enables full-duplex (bidirectional) communication over a single Transmission Control Protocol (TCP) connection. It overcomes the limitation of HTTP, which only allows clients to initiate requests and servers to respond passively, and allows servers to actively push data to clients.

[0053] An Application Programming Interface (API) is a standardized interface for communication and data exchange between different software systems, allowing programs to access specific functions or data through predefined rules.

[0054] Research has revealed that in some scenarios, cloud users may need to perform operational and maintenance tasks on resources within a private network (e.g., updating systems, adding new features), thus requiring communication between the cloud and the private network. In other scenarios, cloud users may need to perform certain analyses on resources within the private network, also requiring communication between the cloud and the private network.

[0055] Research has also found that in some scenarios, Virtual Private Networks (VPNs) can be used to achieve cloud-based (e.g., Figure 1 The communication needs between the cloud (as shown) and the private network. This is due to the caller of the cloud (such as...) Figure 1The client shown can directly access the private network via VPN, allowing the caller to directly view, use, or manipulate various resources (such as business data and services) within the private network. This results in excessive privileges for the caller, leading to high security risks for the private network and ultimately necessitating the adoption of such solutions. Figure 1 The communication solutions shown are becoming increasingly unacceptable to businesses.

[0056] Based on the above research, in order to better improve the cross-network communication effect, this application provides a communication method between the cloud and a private network, which includes: for the cloud and the private network in an isolated state, when a first server (such as a cloud gateway) in the cloud obtains first instruction information, if a proxy server (such as an intranet proxy) in the private network has established a first channel between the first server and the proxy server, then the first server forwards the first instruction information to the proxy server through the first channel, so that the proxy server can perform at least one task (such as data query, data processing, processing logic call, etc.) in the private network according to the first instruction information. This mechanism enables the processing of external messages (such as the first instruction information) according to the pre-configured logic of the private network. This ensures that the processing of external messages meets the constraints configured within the private network (such as access permissions for resources like databases). By using message forwarding, the internal service call links of the private network can be established while maintaining security. This allows for more secure and controllable communication between the cloud and internal network services. Furthermore, this first channel is created by a proxy server within the private network, rather than by a first server. This ensures that the private network proactively provides a secure and usable channel to the outside world, avoiding the shortcomings that can occur when the first server proactively creates a channel due to the private network's inability to guarantee secure communication. This facilitates more secure and controllable communication within the private network.

[0057] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0058] To better understand the technical solution provided in this application, the communication method between the cloud and a private network provided in this application will be explained below with reference to some accompanying drawings. For example... Figure 2 As shown in the embodiments of this application, the communication method between the cloud and a private network is applied to a first server located in the cloud (e.g., Figure 3 (The server shown below), the method includes S1-S2 below.

[0059] S1: The first server obtains the first instruction information.

[0060] Among them, the cloud (such as Figure 3 The cloud shown is provided to some tenants according to the NaaS model.

[0061] The first server (Tunnel-Server) refers to a device deployed in the cloud with information forwarding capabilities (such as a cloud gateway, cloud server, or...) that enables cross-network communication. Figure 3 The server shown is intended to forward messages sent from the caller to the cloud to the cloud via the first server.

[0062] Furthermore, this application does not limit the implementation method of the first server described above. For example, it can be implemented using any device capable of forwarding messages from a network (such as a public network), such as any type of server (such as a standalone server, cluster server, or cloud server), a server of a NaaS service provider, or a server designed based on the Socket forwarding principle that can forward messages outward.

[0063] For example, in one possible implementation, the first server (such as...) Figure 4The server-side component shown may include a ConnectionManager, a Message Router, and a WebSocket API Gateway. The ConnectionManager's functions include some or all of the following: maintaining active connection mappings, managing event IDs to connection relationships, connection lifecycle management, and distributed state synchronization. Furthermore, the ConnectionManager's features include some or all of the following: thread-safe mapping (Map) structure, read-write lock optimization, high concurrency support, automatic cleanup, and load balancing capabilities. The Message Router's functions include some or all of the following: routing messages to corresponding handlers based on message IDs, parsing message headers, implementing reliable delivery, broadcasting, and unicasting. Furthermore, the Message Router's features include some or all of the following: Zinx extension-based features, high-concurrency message queue processing, serialization / deserialization, and message encryption and compression. The gateway's functions include some or all of the following: WebSocket standard interface, long connection maintenance, HTTP POST event reception, authentication and authorization. In addition, the gateway has some or all of the following features: Gorilla WebSocket implementation, WSS (WebSocket Secure) secure connection, connection pool resource reuse, and integrated token authentication.

[0064] The first instruction information refers to information obtained by the first server in a certain way (such as event messages initiated by the first server itself or messages received by the first server from other devices), so that the first instruction information can indicate which tasks to perform in the private network, thereby enabling the first instruction information to represent a certain access requirement for the private network.

[0065] Furthermore, this application does not limit the implementation of the first instruction information mentioned above. For example, it can be implemented using any kind of information that can convey the need to access private network resources through the cloud.

[0066] Furthermore, this application does not limit the method of obtaining the aforementioned first instruction information. For example, in some scenarios (such as when the first server itself has a need to access private network resources), the first instruction information may be generated by the first server itself so that the first instruction information can indicate the first server's own access needs for the private network.

[0067] For example, in some scenarios (such as when other devices in the cloud have a need to access private network resources), the first instruction information can be sent from a server in the cloud other than the first server to the first server, so that the first instruction information can indicate the other server's access needs for the private network.

[0068] For example, in some scenarios (such as when a caller in the cloud needs to access private network resources), the first instruction message can be a message sent by the caller in the cloud, in order to convey the caller's needs through the first instruction message, such as the need to create an independent long connection, the need to handle short connection events, or other needs.

[0069] It is evident that in some scenarios (such as when a caller in the cloud needs to access private network resources), if the first server located in the cloud (such as...) Figure 3 The server shown not only has the function of forwarding messages to the external network, but also the function of directly communicating data with the caller in the cloud. Therefore, S1 can specifically be: In response to the establishment of a channel (such as the channel corresponding to a long connection) between the first server and the caller via the first server, the first server receives the first instruction information sent by the caller through the channel, so that the first server can subsequently provide the first instruction information to other networks (such as the cloud) by forwarding messages to the external network. Figure 3 The private network shown is used for processing.

[0070] It should be noted that the caller in the cloud has a need to access private network resources through the cloud; moreover, this application does not limit the implementation method of the caller. For example, it can use any module capable of calling the cloud, such as a NaaS platform, a cloud management platform, an automation platform, or... Figure 3 The client shown is used for implementation. It is evident that, in one possible implementation, the caller can refer to the client corresponding to the cloud or the business entity of the cloud. It should be noted that this application does not limit the implementation method of the client; for example, the client can be implemented using any terminal device, such as a smartphone, computer, personal digital assistant (PDA), tablet computer, etc.

[0071] S2: In response to the establishment of a first channel between the first server and the proxy server via a proxy server located in the private network, the first server forwards first instruction information to the proxy server through the first channel, and the proxy server performs at least one task in the private network according to the first instruction information.

[0072] Private networks refer to networks with resource security protection requirements, such as corporate intranets or Figure 3 The private network shown is isolated from the cloud to ensure the security of resources within the private network.

[0073] At least one task refers to a task that needs to be executed in a private network, as indicated by the aforementioned first instruction information; and this application does not limit the implementation of the at least one task, for example, it may include some or all of a data query task, a data processing task, and a processing logic call task. Therefore, in one possible implementation, the execution of the at least one task can be carried out using at least one resource in the private network (such as a database, some configured services, processing logic, computing resources, etc.).

[0074] At least one resource in a private network refers to a resource existing in the private network that has security protection requirements; and this application does not limit the implementation of the at least one resource, for example, it may include a database deployed in the private network, some services configured for the private network, and other resources.

[0075] A tunnel proxy server is a device with message processing capabilities deployed within a private network (such as an intranet proxy) to enable cross-network communication. Figure 3 The proxy server shown aims to utilize some or all of the resources in the private network to process messages sent externally, ensuring that the message processing method meets the resource constraints of the private network and thus ensuring the resource security of the private network.

[0076] Furthermore, this application does not limit the implementation method of the above-mentioned proxy server. For example, it can be implemented using any server that can receive messages sent from external networks (such as public networks), such as any server with proxy function or a server designed based on the Socket forwarding principle that can receive messages sent from external networks.

[0077] For example, in one possible implementation, a proxy server (such as...) Figure 5The proxy server shown may include an Event Router, an AgentForwarder, and a ChannelManager. The Event Router's functions include some or all of the following: handling event messages, distinguishing between long and short connections, managing AgentFactory calls, and managing Agent instances and sessions. It also features some or all of the following characteristics: policy pattern processing, hot-swapping of multiple Agent types, and asynchronous or synchronous event processing. The AgentForwarder's functions include some or all of the following: communication between the proxy server and local Agents, support for multiple communication methods, data format / protocol adaptation, and health checks. It also features some or all of the following characteristics: interface abstraction design, connection pool management, load balancing and failover, and timeout retry mechanisms. The ChannelManager's functions include some or all of the following: shared or independent channel management, creation of high-throughput dedicated channels, channel isolation, and performance monitoring. It also features some or all of the following characteristics: channel pooling technology, dynamic channel management, Quality of Service (QoS) control, and channel detection alarms.

[0078] Furthermore, this application does not limit the working principle of the aforementioned proxy server. For example, in some scenarios, the proxy server can not only receive messages from the first server (such as the aforementioned first instruction information), but also process the messages. Thus, in one possible implementation, the proxy server is configured not only to receive messages sent from the external network, but also to process messages, so that after receiving a message forwarded by the first server (such as the aforementioned first instruction information) through the first channel, the proxy server directly processes the message.

[0079] For example, in some scenarios, the proxy server can be responsible for receiving messages from the first server (such as the first instruction information mentioned above), so that the message can be subsequently converted into an actual call to an internal resource (such as an intranet service) within the private network. Therefore, in one possible implementation, a processing server (Agent) is also deployed in the private network, and the processing server operates as follows: in response to receiving a message forwarded by the proxy server, the processing server processes the message using at least one resource within the private network. The processing server and the proxy server communicate via local communication methods, such as HTTP. It should be noted that this application does not limit the implementation of the processing server; for example, it can be any message-processing server located within the private network, such as... Figure 6The processing terminal shown is used for implementation.

[0080] For example, in some scenarios, after the proxy server receives a message from the first server (such as the first indication information mentioned above), if the message meets preset conditions, it can be determined that the processing of the message is relatively simple, so the proxy server can directly process the message; however, if the message does not meet the preset conditions, it can be determined that the processing of the message is relatively complex, so the proxy server forwards the message to the processing server (such as...). Figure 3 The processing server (shown as a processing terminal) enables the processing server to process the message using at least one resource in the private network. The preset conditions indicate the conditions that a message can be directly processed by the proxy server; moreover, these preset conditions can be determined based on the message processing needs in the actual application scenario.

[0081] It should be noted that this application does not limit the process of determining the processing server in the above two paragraphs. For example, in some scenarios, if multiple processing servers with different functions are deployed in a private network, after the proxy server receives the message forwarded by the first server (such as the first indication information mentioned above) through the first channel, the proxy server first searches for a suitable processing server to process the message from these processing servers; then the proxy server forwards the message to the found processing server for processing.

[0082] Furthermore, this application does not limit the method of determining the proxy server in S2 above. For example, in some scenarios, if multiple proxy servers are deployed in a private network, the proxy server in S2 can refer to the proxy server found from these proxy servers that corresponds to the target identifier carried in the first indication information. The target identifier uniquely identifies the proxy server in S2. It should be noted that different proxy servers in the private network may provide the same functions or may have certain differences; this application does not specifically limit this.

[0083] The first channel refers to the connection path established immediately after the proxy server starts, with the aim of achieving cross-network communication through this first channel; moreover, this application does not limit the implementation method of the first channel. For example, the first channel at least satisfies the following constraints: ① The first channel is via a proxy server (such as...). Figure 7 The proxy shown is created by itself to enable active communication between the private network side and the first server (such as...). Figure 7(The server shown) negotiates and establishes a channel to better improve communication controllability; ② The first channel is always in a connection-maintaining state during the period when the proxy server is available, such as [the time when the proxy server starts up, the time when the proxy server stops], so that the first channel can always be used to realize the message forwarding process between the proxy server and the first server.

[0084] Based on the above S1 to S2, the communication scheme based on the forwarding mechanism provided in this application includes: For isolated cloud and private network environments, when a first server (e.g., a cloud gateway) in the cloud receives first instruction information sent by a caller in the cloud, if a proxy server (e.g., an intranet proxy) in the private network has established a first channel between the first server and the proxy server, the first server forwards the first instruction information to the proxy server through the first channel, so that the proxy server can perform at least one task (e.g., data query, data processing, processing logic call, etc.) in the private network according to the first instruction information. The task is to process external messages (such as the first instruction information) according to the logic configured within the private network, ensuring that the processing of these external messages meets the constraints configured within the private network (such as access permissions for resources like databases). This allows for secure and controllable communication between the cloud and internal network services through message forwarding, while maintaining security. This can be achieved without opening excessive private network permissions to the outside world or establishing a global VPN tunnel. Specifically, the first channel is created by a proxy server within the private network, not by a first server. This ensures that the private network proactively provides a secure and usable channel to the outside, avoiding the shortcomings that might occur if the first server proactively creates a channel due to the private network's inability to guarantee secure communication. This facilitates more secure and controllable communication within the private network.

[0085] Furthermore, the communication method between the cloud and the private network provided in this application is applicable to cross-network communication in any network isolation scenario, so that the method is not only applicable to the scenario of accessing the private network from the cloud, but also applicable to other scenarios with cross-network communication requirements. This application does not make any specific limitations on this.

[0086] In addition, in some scenarios (such as NaaS scenarios), the first server mentioned above can be the server of the NaaS service provider. The NaaS service provider uses the first server and the aforementioned proxy server to perform NaaS service configuration or management operations on the private network in order to better improve the security in the NaaS scenario.

[0087] Furthermore, to enhance security, the aforementioned first server can possess unidirectional outbound call control over the proxy server. This ensures that the proxy server can only be controlled by the first server and will not be accessed in reverse. Consequently, the private network deploying the proxy server only provides the function of communication proxying, thus minimizing the resource access permissions offered by the private network. Therefore, this application achieves strict minimum outbound call control (e.g., unidirectional control) on the proxy server side by having the first server forward communication requests to the proxy server, rather than by entering the private network. This fundamentally solves the security risks caused by excessive external access permissions of the private network in the aforementioned VPN solutions.

[0088] Research has found that in some scenarios, in order to better protect the security of private network resources, the owner of the private network can set different resource access permissions for different visitors, so as to precisely control the access permissions of the visitors to the internal resources of the private network and improve security.

[0089] As can be seen from the above, in one possible implementation, the first instruction information is further processed according to preset permission information. The preset permission information instructs the user (such as a caller in the cloud) who sent the first instruction information on the usage rights of some or all resources in the private network. In this way, the preset permission information can be used to accurately constrain the caller's resource usage rights in the private network, so as to realize controllable communication for the caller on the private network side.

[0090] Regarding the aforementioned preset permission information, this preset permission information refers to the access permissions that the owner of the private network pre-configures for each visitor (such as a caller in the cloud) of the private network. This preset permission information can accurately indicate what resources each visitor can use from the private network, so that in subsequent cross-network communication, the preset permission information can be used to accurately restrict the permissions of each visitor, thereby precisely confining each visitor to the resource access range pre-configured by the owner, and thus better achieving controllable communication.

[0091] Furthermore, this application does not limit the usage of the aforementioned preset permission information. For example, in some scenarios, the usage process of the preset permission information may include: after the proxy server receives a message forwarded by the first server (such as the aforementioned first instruction information), the proxy server processes the message according to the preset permission information to determine whether the sender of the message (such as a caller in the cloud) has permission to use resources matching the message in the private network (such as certain data recorded in the database, certain processing code, etc.). If there is no permission, the proxy server sends a prompt message to the first server stating "The sender of the current message does not have permission to use the corresponding resources in the private network," so that the first server can subsequently pass the prompt message to the sender in a certain way. However, if there is permission, the "matching resource" is invoked to process the message, so that the proxy server sends a feedback message to the first server regarding the processing result of the message, so that the first server can subsequently pass the processing result to the sender in a certain way.

[0092] Research has found that in some scenarios, if a private network malfunctions (such as a power outage), some devices deployed in that private network (such as the aforementioned proxy server) become unavailable, thus preventing the public network from accessing resources within the private network.

[0093] Based on the above research, in one possible implementation, the step of "the first server forwards the first instruction information to the proxy server through the first channel" in S2 can be as follows: in response to the proxy server being in an available state, the first server forwards the first instruction information to the proxy server through the first channel. This can realize the detection of the actual state of the proxy server before message forwarding, so as to avoid the defects (such as resource waste) caused by forwarding messages when the proxy server is in an unavailable state.

[0094] Research has found that in some scenarios, in order to better improve the performance of cloud services, the server used when the cloud provides services to its users can be different from the server used when the cloud forwards messages to a private network, so as to distribute different cloud services to different devices.

[0095] Based on the above research, in one possible implementation, S1 can specifically be: responding to a second server located in the cloud (such as...). Figure 6 The server 1 shown receives the first instruction information sent by the caller in the cloud, and the aforementioned first server (such as...) Figure 6 The server 2 shown receives the first instruction information forwarded by the second server, thus enabling the use of different servers to implement different types of services in the cloud, thereby avoiding the defects caused by all services sharing the same server.

[0096] Research has shown that in some scenarios, when a proxy server is detected to be running, a persistent long connection can be established between the proxy server and the first server to facilitate better message forwarding later. Therefore, in one possible implementation, the first channel can be the channel corresponding to the persistent long connection (e.g.,...). Figure 7 The first channel (corresponding to the persistent long connection shown) is in a sustained state while the proxy server is available, so that the first channel can always be connected while the proxy server is available. This allows the channel to be used to realize data communication between the proxy server and the first server during this period without having to repeatedly establish a connection, thus improving the communication effect.

[0097] It should be noted that in network communication, persistent long-lived connections are a communication mode that includes at least the following characteristics: after a connection is established between different ends, the connection is kept active for a long time to continuously transmit data or quickly respond to requests, rather than re-establishing and disconnecting the connection for each communication.

[0098] Based on the above two paragraphs, it can be seen that in one possible implementation, when the first channel is the channel corresponding to a persistent long-term connection (such as...) Figure 7 When the channel corresponding to the persistent long connection is shown, since the channel is always in a connected state, it can be used to implement data communication in long connection mode. Therefore, in some scenarios, the above-mentioned first indication information can be an event message in long connection mode, so that the message can be forwarded through the channel to realize data communication in long connection mode.

[0099] Research has revealed that in some scenarios, the channel corresponding to a persistent long-lived connection (also known as a shared channel) can be used to transmit various types of messages, making it unsuitable for dedicated transmission of large volumes of messages for a specific business purpose. Therefore, to address this issue, the channel can be used to request the creation of a dedicated independent channel for that business from the proxy server (e.g., ...). Figure 7 (The independent channel shown).

[0100] Based on the above research, it can be seen that in one possible implementation, when the first channel is the channel corresponding to a persistent long-term connection (such as...) Figure 7 When the channel corresponding to the persistent long connection shown is mentioned, the aforementioned first indication information (such as from...) Figure 7 An independent channel creation request initiated by the client can be a request to create an independent long-connection channel for a target object. This independent long-connection channel is used (in particular, dedicated to) to implement the data communication process for the target object in order to meet the communication needs of the object.

[0101] Based on the above, in one possible implementation, when the first channel is the channel corresponding to a persistent long-lived connection (such as...) Figure 7 When the persistent long-connection corresponding to the channel shown is invoked, the step of "performing at least one task in the private network according to the first instruction information" may include: in response to the request of the first instruction information to create a channel corresponding to an independent long-connection for a target object (such as a certain business, a certain periodic task, or a certain data stream), and creating a second channel between the first server and the proxy server via a proxy server (such as...). Figure 7 The "independent connection to the server" shown here includes the second channel. The data communication process corresponding to the target object is realized through the channel corresponding to the independent long connection. In this way, a dedicated independent channel can be created for the target object, so that the data communication process corresponding to the target object can be realized through the dedicated independent channel.

[0102] As can be seen, in one possible implementation, when the channel corresponding to the independent long connection established for the target object includes a second channel between the first server and the proxy server (such as...) Figure 7 When the "independent connection to the server" is shown, the communication method between the cloud and the private network described above may include at least the following steps: In response to the completion of the channel establishment corresponding to the aforementioned independent long connection, the first server obtains the second indication information corresponding to the target object (such as...). Figure 7 The first server forwards the second instruction information to the proxy server through the second channel, and the proxy server processes the second instruction information; the first server receives the processing result (such as the business data shown) of the second instruction information fed back by the proxy server through the second channel. Figure 7 (as shown in the response data), thus enabling the processing of all requests related to the target object through the channel corresponding to the independent long connection established for the target object.

[0103] It should be noted that in network communication, independent long connection is a specific connection mode derived from long connection mode. It has at least the following characteristics: a dedicated channel is allocated to a single object (such as a single client, a single business scenario, a single task, or a single data stream), and the channel is not shared with other objects, thus having unique advantages in communication efficiency, data security, and business isolation.

[0104] It should also be noted that the channels corresponding to the independent long connections established for the target object (such as...) Figure 7The independent channel shown is dedicated to providing data communication services for the message sequence corresponding to the target object. It will not provide services for messages corresponding to other objects, so that only the messages recorded in the message sequence will be transmitted in the channel in sequence. Therefore, in order to improve the transmission speed, the messages transmitted in this channel do not need to carry information such as message timestamps, message identifiers, routing identifiers, and channel identifiers, so as to reduce the amount of information transmitted in the channel and improve the transmission efficiency.

[0105] It should also be noted that the second instruction information can instruct the execution of some tasks corresponding to the target object in the private network, so that the second instruction information can indicate the access request of the target object; and this application does not limit the method of obtaining the second instruction information. For example, in some scenarios (such as when the first server itself has a need to access private network resources), the second instruction information may refer to a message generated by the first server itself that can describe the access request of the target object.

[0106] For example, in some scenarios (such as when other devices in the cloud have a need to access private network resources), the second instruction information may refer to a message sent by a server other than the first server in the cloud to the first server that describes the access request of the target object, so that after the first server obtains the processing result of the second instruction information, the first server forwards the processing result to other servers.

[0107] For example, in some scenarios (such as when a caller in the cloud needs to access private network resources), the second instruction information can be a message sent by the caller in the cloud that describes the access request of the target object, so that after the first server obtains the processing result of the second instruction information, the first server forwards the processing result to the caller.

[0108] Research has found that in some scenarios, for proxy servers deployed in private networks (such as...) Figure 3 For the proxy shown, the proxy may need to forward messages received from the external network to the processing server deployed in the private network for processing.

[0109] Based on the above research, in one possible implementation, the step of "performing at least one task in a private network according to the first instruction information" may further include: creating a third channel (e.g., via a proxy server) between the proxy server and the processing server located in the private network. Figure 7The "WebSocket connection to the processing end" shown above refers to a processing server that uses at least one resource in the private network to process messages sent by the proxy server through a third channel. The channel corresponding to the aforementioned independent long connection also includes the third channel to ensure the integrity of the dedicated independent channel created for the target object, so as to better realize the message processing flow for the target object.

[0110] As can be seen, in one possible implementation, when the channel corresponding to the independent long connection established for the target object includes a second channel between the first server and the proxy server (such as...) Figure 7 The "independent connection to the server" shown), and the third channel between the proxy server and the processing server (such as...) Figure 7 When the "WebSocket connection to the processing end" is shown, the communication method between the cloud and the private network described above may include at least the following steps: In response to the completion of the channel establishment corresponding to the above independent long connection, the first server obtains the second indication information (such as...) sent by the caller in the cloud corresponding to the target object. Figure 7 (The business data shown); the first server forwards the second instruction information to the proxy server through the second channel, and the proxy server forwards the second instruction information to the processing server through the third channel, so that the processing server can process the second instruction information according to at least one resource in the private network to obtain the processing result of the second instruction information (such as...). Figure 7 (The response data shown); the processing server feeds back the processing result to the proxy server through the third channel, and the proxy server feeds back the processing result to the first server through the second channel, so that after the first server receives the processing result through the second channel, the first server forwards the processing result of the second instruction information to the caller. In this way, the processing flow of all messages related to the target object can be realized by means of the channel corresponding to the independent long connection established for the target object.

[0111] It should be noted that this application does not limit the creation process of the "third channel between the proxy server and the processing server". For example, in some scenarios (such as when the first indication information indicates that all messages involving the target object are processed using the same processing server), when multiple processing servers are deployed in a private network, the creation process can be as follows: after the proxy server receives the first information, the proxy server first determines the processing server that matches the content carried by the first information from among these processing servers; then the proxy server creates a connection channel to the matching processing server, i.e., the third channel, so that after the proxy server receives the message of successful establishment from the processing server, the proxy server sends a notification of successful creation of the independent channel to the first server.

[0112] Based on the above nine paragraphs, it can be seen that when a persistent long-connection channel (such as a shared channel) has already been established between the first server and the proxy server, the process provided in this application for establishing an independent long-connection channel for the target object (such as...) Figure 7 The independent channel establishment process shown below (1)-(9) may include the processes shown below, with the aim of enabling cloud callers (such as...) to establish a long connection scheme based on WebSocket. Figure 7 The client shown) and Tunnel-Server (such as Figure 7 The persistent session between the server shown or the first terminal mentioned above supports secure bidirectional, high-throughput transmission of business data.

[0113] (1) The caller in the cloud initiates a connection request (such as the first instruction information mentioned above or) Figure 7 The request to create an independent channel (shown) connects to the first server (Tunnel-Server) via WebSocket or HTTP request. This request belongs to the Create_dedicated event. The request carries parameters such as target identifier (such as the unique identifier of the proxy server responsible for handling the request), authentication information, and business type, so that the first server can generate event identifier (EventID) and session identifier (SessionID) based on the request.

[0114] (2) Tunnel-Server connection management and routing: The connection manager in the Tunnel-Server performs authentication, registers sessions in the registry, and checks the status of the proxy server (such as the target Proxy) indicated by the request, such as whether it is available.

[0115] (3) The first server (Tunnel-Server) encapsulates and forwards the message: The first server encapsulates the received request into an EventMessage (MessageID=1) and sends it to the proxy server indicated by the request through an established long connection (such as a persistent long connection).

[0116] (4) The Tunnel-Proxy server handles event processing and Agent scheduling: The event routing processor in the Tunnel-Proxy server parses the messages received by the Tunnel-Proxy server and calls the AgentFactory to create and manage the corresponding Agent sessions. It should be noted that the AgentFactory has at least the following functions: finding the Agent specified by the message from multiple Agents deployed in the private network; determining whether the caller in the cloud has the permission to use the found Agent; if so, creating the session corresponding to the found Agent so that the found Agent can be used to process the message later.

[0117] (5) The Tunnel-Proxy establishes a connection to the Agent so that the Agent can connect to services within the private network according to the business type (such as SSH) to establish actual business channels and execute actual business logic.

[0118] (6) Independent channel creation for the proxy server (Tunnel-Proxy) (optional): In high-throughput scenarios, the proxy can actively negotiate with the Tunnel-Server to establish a dedicated channel for the proxy in order to avoid blocking caused by multiple proxies sharing the same channel.

[0119] (7) Utilize the established independent channel to achieve bidirectional data forwarding across the entire link (e.g.) Figure 7 The bidirectional data forwarding shown above enables data transfer from the caller (such as...) Figure 7 Full-duplex, secure, and reliable data transmission from the client shown to internal services on the private network.

[0120] (8) The system including the first server and the proxy server performs session management and detection: heartbeat detection, timeout handling, log recording, and anomaly recovery to ensure connection stability and reliable traceability.

[0121] (9) Session Closure and Resource Release: For a well-established independent channel, if either party actively disconnects or due to an abnormality, all related resources and states are cleared.

[0122] It is evident that the long-connection mode implemented using the communication method between the cloud and private network provided in this application satisfies at least the following constraints: ① When a long connection such as WebSocket / TCP has been established between the Tunnel-Proxy and the Tunnel-Server, the cloud caller initiates a message such as a command or data request through the Tunnel-Server. The Tunnel-Server forwards the message to the corresponding Tunnel-Proxy (such as the proxy end specified by the message) through the established long connection, thereby achieving bidirectional, real-time, low-latency, and high-throughput full-duplex communication; ② This long-connection mode also supports some scenarios with independent long-connection establishment requirements (such as the WebSSH scenario), specifically: the cloud caller and the service deployed in the cloud that can communicate directly with the caller (such as... Figure 6 The server shown 1) maintains a long connection, which includes services deployed in the cloud that can communicate directly with the caller and services deployed in the cloud that can forward messages to the private network (such as Tunnel-Server). Figure 6 The server shown in Figure 2) maintains a long connection, requests an independent SSH tunnel, and opens an independent tunnel using the Tunnel-Server (such as the tunnel corresponding to the independent long connection). Figure 7 The independent channel session (as shown) forwards data segment by segment to Tunnel-Proxy, which then connects to the local device (or local Agent); the relevant resources are automatically released after the session ends; ③ The channel corresponding to the long connection mode (such as the channel corresponding to the resident long connection or the channel corresponding to the independent long connection) supports synchronous and asynchronous response, heartbeat detection, error recovery, etc. of events and data within the channel.

[0123] Research has revealed the following requirements in certain scenarios: processing low-frequency events, one-off events, and sudden events (such as instant notifications). Therefore, to meet these requirements, a shared channel (such as the channel corresponding to a persistent long connection) can be used to implement data communication in short connection mode.

[0124] Based on the above research, it can be seen that in one possible implementation, when the first channel is the channel corresponding to a persistent long-term connection (such as...) Figure 7 When the channel corresponding to the persistent long connection is shown, if the first indication information is sent through the interface corresponding to the short connection mode (such as the HTTP POST interface), the first indication information can be an event message in the short connection mode, so that the message can be forwarded through the channel to realize data communication in the short connection mode.

[0125] Based on the above, in one possible implementation, if the first indication information is sent through an interface corresponding to the short connection mode (such as an HTTP POST interface), it can be determined that an event message (such as the first indication information) in the short connection mode has been initiated. Therefore, the communication method between the cloud and the private network can include not only S1-S2, but also the following steps: the first server receives the processing result of the first indication information fed back by the proxy server through a first channel (such as a channel corresponding to a persistent long connection). In this way, the response data given for the message can be returned through the original path by means of the established shared channel, thereby improving efficiency.

[0126] As can be seen, in one possible implementation, if the first indication information is sent by the caller in the cloud through the interface corresponding to the short connection mode (such as the HTTP POST interface), it can be determined that the caller initiated the event message (such as the first indication information) in the short connection mode. Therefore, the communication method between the cloud and the private network can include not only S1-S2, but also the following steps: the first server receives the processing result of the first indication information fed back by the proxy server through the first channel (such as the channel corresponding to the persistent long connection), and the first server forwards the processing result of the first indication information to the caller in the cloud. In this way, the response data given for the message can be sent to the caller through the original return method by means of the established shared channel, so as to improve efficiency.

[0127] It should be noted that this application does not limit the implementation scheme of "returning to the original path" in the above two paragraphs. For example, in some scenarios, the content carried by the first instruction information can be used to inform the proxy server that the processing result of the first instruction information needs to be returned to the original path.

[0128] For example, in some scenarios, the return path can be achieved by maintaining the resources (such as sessions) corresponding to the first indication information in the first channel. Thus, in one possible implementation, the shared channel (such as the first channel or the channel corresponding to a persistent long connection) supports bidirectional data communication in short connection mode. Specifically, in response to the first server receiving a request (such as the first indication information) sent by the caller in the cloud through the interface corresponding to the short connection mode, the first server forwards the request to the proxy server through the shared channel. This allows the proxy server to process the request subsequently. Furthermore, the shared channel needs to continuously maintain the resources configured for the short connection mode (such as sessions) during the processing of the request, ensuring that the shared channel is in a state of waiting for the processing result. This ensures that the processing result can be returned to the caller through the shared channel, thereby improving efficiency.

[0129] Research has revealed that in some scenarios, the shared channel needs to perform a large number of message forwards, which puts significant pressure on its message processing. Therefore, to reduce this pressure, the shared channel can be used only to forward requests (such as the first indication information mentioned above) in short connection mode. Once it is determined that the request has been successfully forwarded to the Tunnel-Proxy, the shared channel no longer maintains the resources configured for this short connection mode (such as session resources). This ensures that when the Tunnel-Proxy is used to process the request, the shared channel is no longer waiting for the processing result of the request, but continues to process other messages, thereby improving resource utilization.

[0130] Based on the above research, in one possible implementation, if the first indication information is sent through an interface corresponding to the short connection mode (such as an HTTP POST interface), it can be determined that an event in the short connection mode has been initiated. Therefore, the communication method between the cloud and the private network can include not only S1-S2, but also the following steps: responding to a preset interface located in the cloud (such as... Figure 8 The cloud API shown receives the processing result of the first instruction information fed back by the proxy server. The first server receives the processing result of the first instruction information forwarded by the preset interface. In this way, asynchronous feedback can be achieved by directly calling back to the cloud preset API interface, which greatly simplifies the message response chain, reduces latency, facilitates asynchronous processing and disaster recovery, and reduces the pressure on the shared channel.

[0131] Therefore, in one possible implementation, if the aforementioned first indication information is sent by the caller in the cloud through an interface corresponding to the short connection mode (such as an HTTP POST interface), it can be determined that the event in the short connection mode was initiated by the caller. Thus, the communication method between the cloud and the private network can include not only S1-S2, but also the following steps: responding to a preset interface located in the cloud (such as...) Figure 8 The cloud API shown receives the processing result of the first instruction information fed back by the proxy server. The first server receives the processing result of the first instruction information forwarded by the preset interface. The first server forwards the processing result of the first instruction information to the caller in the cloud. In this way, asynchronous feedback can be achieved by directly calling back to the preset API interface in the cloud, which greatly simplifies the message response chain, reduces latency, facilitates asynchronous processing and disaster recovery, and reduces the pressure on the shared channel.

[0132] It should be noted that this application does not limit the determination process of "asynchronous feedback" in the above two paragraphs. For example, in some scenarios, the content carried by the first instruction information can be used to inform the proxy server that the processing result of the first instruction information needs to be directly called back to the cloud-pre-built API interface for asynchronous feedback.

[0133] For example, in some scenarios, asynchronous feedback can be achieved by directly calling back to the pre-configured API interface in the cloud by not maintaining the resources (such as sessions) corresponding to the first indication information in the first channel. Thus, in one possible implementation, the aforementioned shared channel (such as the first channel or the channel corresponding to a persistent long connection) supports bidirectional data communication in short-connection mode. Specifically, in response to the first server receiving a request (such as the first indication information) sent by the caller in the cloud through the interface corresponding to the short-connection mode, the first server forwards the request to the proxy server (Tunnel-Proxy) through the shared channel. Furthermore, upon determining that the proxy server has received the request, it ceases to maintain the resources configured for the short-connection mode (such as sessions), so that the processing result of the request can be obtained through the proxy server (e.g., ...). Figure 8 After showing the processing result, the processing result is fed back through a direct callback to the cloud-based pre-built API interface (such as...). Figures 9 to 12 (The feedback shown). It should be noted that if the processing result is from a proxy server (such as... Figure 11 or Figure 12 If the result is obtained from the proxy server shown, then the proxy server will directly send the processing result to the API; if the processing result is obtained from the processing server (such as...), then the proxy server will directly send the processing result to the API. Figure 9 or Figure 10 If the result is obtained from the proxy shown, the processing server will directly send the processing result to the API.

[0134] Based on the preceding paragraph, when a shared channel (such as the channel corresponding to a persistent long connection) has been established between the first server and the proxy server, the short connection mode implemented using this shared channel provided in this application can include the processes shown in (I) to (VIII) below. This enables the short connection mode to allow cloud callers to send a one-time send command to the Tunnel-Server, and the Tunnel-Proxy to push the event indicated by the command to the corresponding Agent program for processing. The subsequent processing result obtained by the Agent can then directly call back to the cloud API without going through the shared channel (such as the Tunnel link), making it suitable for low-frequency, asynchronous, monitoring, and configuration push scenarios. The Tunnel link includes at least a Tunnel-Server and a Tunnel-Proxy.

[0135] (a) Cloud-based callers (such as...) Figure 8 The client shown initiates a POST event request: This request is initiated by the caller through the HTTP POST interface, the request carries event parameters, and the request needs to be sent to the first server (Tunnel-Server).

[0136] (ii) The first server (Tunnel-Server) performs target location and verification: The first server searches for the status of the proxy server (such as the target Proxy) indicated by the request based on the request it receives, and the first server verifies whether there are any errors in the parameters carried by the request.

[0137] (iii) The first server (Tunnel-Server) performs event message routing: The first server encapsulates the requests it receives into EventMessage and forwards them to the proxy server (Tunnel-Proxy) through the shared channel.

[0138] (iv) Event type identification by the proxy server (Tunnel-Proxy): The event routing processor in the proxy server parses the event type of EventMessage and initiates short connection event processing based on the type.

[0139] (v) Local HTTP calls of the proxy server (Tunnel-Proxy): The proxy server calls the local agent program via HTTP to transmit event data.

[0140] (vi) Agent Program Business Processing: This agent executes specific business logic and produces result data (such as...). Figure 8 (The processing results are shown).

[0141] (vii) The Agent sends the result data back to the cloud directly: The Agent calls back the cloud API through a pre-configured method, so as to send the result data back to the cloud directly through the HTTP POST response method.

[0142] (viii) The server in the cloud (such as Tunnel-Server) receives and processes the above result data, updates the task status, and triggers subsequent processes.

[0143] It is evident that the short connection mode implemented using the communication method between the cloud and private network provided in this application satisfies at least the following constraints: ① The cloud caller sends the event message to the Tunnel-Server once via the HTTP POST interface. The Tunnel-Server locates the active long connection session of the target Proxy and forwards the event message to the Tunnel-Proxy through the shared channel of the long connection; ② The Tunnel-Proxy has a dedicated short connection message handler so that after receiving the message, the Tunnel-Proxy identifies the event type and pushes the message to the corresponding Agent program for processing via HTTP / Remote Procedure Call (RPC) based on the type. After the Agent completes the processing, the processing result of the message is directly called back via HTTP to the pre-configured API (such as...) on the cloud. Figure 9 or Figure 10 The API shown no longer returns via the Tunnel link, greatly simplifying the message response chain, reducing latency, and facilitating asynchronous processing and disaster recovery.

[0144] In addition, to better balance efficiency and the pressure on the shared channel, when the aforementioned first indication information is sent through an interface corresponding to short connection mode (such as an HTTP POST interface), the proxy server can at least meet the following constraint: the processing time in response to the first indication information does not exceed a preset threshold (such as...). Figure 13 If the processing time of the first indication information is relatively short (as shown in the 10 seconds), then to improve efficiency, the resources configured for this short connection mode (such as session resources) are maintained in the shared channel so that the proxy server can subsequently provide feedback on the processing result of the first indication information through the first channel (such as the shared channel). If the processing time of the first indication information exceeds a preset threshold, then to reduce the pressure on the shared channel, the resources configured for this short connection mode (such as session resources) are no longer maintained in the shared channel, and the asynchronous processing phase begins, allowing the proxy server to process the information through a preset interface located in the cloud (such as...). Figure 13 The API shown provides feedback on the processing result of the first instruction information.

[0145] It should be noted that in some scenarios, the method of feedback of response data (such as the processing result of the first indication information mentioned above) in short connection mode can be directly specified by the caller in the cloud, so that the request sent by the caller (such as the first indication information) carries the feedback method of the response data, so that the proxy server or processing server can provide feedback in this way.

[0146] Based on the above-mentioned content of the first channel (such as the shared channel mentioned above), it can be understood that in one possible implementation, the first channel can at least satisfy the following constraints: the first channel is a channel corresponding to a persistent long connection, and a data communication process in at least one mode is implemented through the first channel. The at least one mode includes at least one of a long connection mode and a short connection mode, so that the communication process implemented based on the first channel can simultaneously support the collaboration of multiple modes to improve the communication effect.

[0147] It should be noted that this application does not limit the application of the different modes mentioned above. For example, in some scenarios, the content carried by the first instruction information can inform the proxy server whether the communication process for the first instruction information belongs to the data communication process in the long connection mode or the data communication process in the short connection mode.

[0148] For example, in some scenarios, different modes of data communication processes can be distinguished by whether the resources (such as sessions) corresponding to the first indication information in the first channel are maintained. Thus, in one possible implementation, for the first channel established between the first server and the proxy server (such as the shared channel mentioned above), if the first server receives a message 1 in long-connection mode sent by the caller in the cloud, it will continuously maintain resource 1 configured for message 1 in the first channel until the processing result of message 1 is fed back to the caller via the first channel, after which resource 1 will be released. If the first server receives a message 2 in short-connection mode sent by the caller, it will continuously maintain resource 2 configured for message 2 in the first channel until the message 2 is forwarded to the proxy server via the first channel, after which resource 2 can be released immediately so that the proxy server can subsequently feed back the processing result of message 2 through a pre-built API in the private network. This enables long-short connection coordination to improve flexibility.

[0149] In addition, to further enhance security, the aforementioned first channel should at least meet the following constraints: the first channel is via a proxy server (such as...). Figure 7 The proxy shown is created to enable active interaction between the private network side and the first server (such as...). Figure 7 The server (as shown) negotiates and establishes a channel corresponding to a persistent long-term connection to better improve communication controllability.

[0150] It should be noted that this application does not limit the creation process of the first channel mentioned above. For example, the creation process of the first channel (such as...) Figure 7 The implementation process for establishing a persistent long-lived connection (as shown) may include: responding to a proxy server (such as...) Figure 7 The proxy server (as shown) switches from an unavailable state to an available state by actively contacting the first server (such as...). Figure 7 The server shown initiates a persistent long connection establishment (e.g., ...). Figure 7 The process of establishing a WebSocket connection is shown so that after the first server authenticates and registers with the proxy server, the first server sends response data back to the proxy server. The response data can transmit the following information to the proxy server: successful connection, channel identifier (ID) of the channel corresponding to the persistent long connection, etc. This enables the establishment of a shared channel between different ends, so that subsequent data communication between different ends can be achieved by using the shared channel.

[0151] It should also be noted that this application does not limit the implementation method of the channel corresponding to the above-mentioned persistent long connection. For example, in some scenarios, if multiple proxy terminals are deployed in a private network, a channel corresponding to the persistent long connection between each proxy terminal and the first server can be established so that different proxy terminals can realize persistent long connections through different channels.

[0152] Research has revealed that in some scenarios, the shared channels mentioned above (such as the channels corresponding to the persistent long connections) need to transmit various types of messages (such as messages in short connection mode and messages in long connection mode). Therefore, in order to prevent data from being misused or modified in different messages, some identifiers can be configured for the messages transmitted by the shared channel, such as message identifiers, channel identifiers, routing identifiers, session identifiers, etc., so that these identifiers can be used to identify the correspondence between different response data and different request data in the future.

[0153] Based on the above research, in one possible implementation, the first channel can at least satisfy the following constraints: messages transmitted through the first channel (such as request data, response data, etc.) carry at least one identifier, which includes at least one of a message identifier, a channel identifier, and a routing identifier. This ensures that different requests do not interfere with each other and prevents data tampering. It should be noted that in some scenarios, to improve flexibility, the at least one identifier includes at least one of a message identifier, a channel identifier, a routing identifier, and a session identifier, to separate the channel ID from the session ID. This allows the same channel to provide data transmission services for different sessions, thereby improving scalability.

[0154] In addition, to further enhance security, the aforementioned first channel can at least satisfy the following constraint: messages transmitted through the first channel (such as request data, response data, etc.) are encrypted to ensure the security of data transmission.

[0155] Based on the above-mentioned communication methods between the cloud and private networks, this application provides a communication scheme based on Socket forwarding capabilities that can be applied to both long and short connections, and this scheme has the following five characteristics.

[0156] Feature one: The communication scheme provided in this application adopts a layered, loosely coupled distributed architecture (such as...). Figure 14 The architecture shown); and this architecture may include cloud-based callers (such as...). Figure 14 The client shown), the first server (such as) Figure 14 The server shown), proxy server (such as Figure 14 The proxy end shown), processing server (such as Figure 14 Each processing terminal shown), and preset interfaces (such as...) Figure 14 The API shown is used to define the API. The caller needs to access resources on a private network (e.g., a private network) via the cloud. The first server refers to the cloud gateway; deployed in the cloud, it acts as a forwarding / routing hub, maintaining long connections with the proxy server and distributing and forwarding upper-layer call requests (e.g., requests initiated by the caller). The proxy server refers to a proxy within the private network, such as an intranet proxy; deployed within the private network, such as on a client device or host within the private network's black box; capable of establishing various long connections with the first server (e.g., persistent long connections, independent long connections), receiving messages from the first server and converting them into actual calls to services within the private network (e.g., intranet services). The processing server refers to a message consumer within the private network, such as an intranet consumer; the proxy server collaborates with the actual processing server (e.g., the target Agent mentioned above) via local communication (e.g., HTTP) to execute actual business logic. This pre-defined interface is responsible for receiving response data generated in short-connection mode from the private network.

[0157] Feature two: The communication solution provided in this application can be applied to long-connection scenarios (such as...). Figure 7 (As shown in the scenario) to implement a long connection solution based on WebSocket, and to realize persistent sessions between cloud callers and cloud gateways, supporting secure transmission of bidirectional, high-throughput business data.

[0158] Feature three: The communication scheme provided in this application can be applied to short-connection scenarios (such as...). Figure 8 (As shown in the scenario) to implement a short connection / event-driven solution, supporting the cloud to send instructions to the cloud gateway at once, and the internal network agent to push the event to the corresponding Agent program. The Agent will directly call back the processing result to the cloud API (without going through the Tunnel link), which is suitable for low-frequency, asynchronous, monitoring, configuration push and other scenarios.

[0159] Thirdly, the communication scheme provided in this application uses a first message protocol, a second message protocol, and a third message protocol. The first message protocol refers to the message protocol of the message wrapper (Web Socket Message). Its functions include some or all of the following: unified message format, serialization / deserialization, integrity verification, compression, and encryption. Its features include some or all of the following: support for Protocol Buffers / JSON, fragment reassembly, deduplication, and order guarantee. The second message protocol refers to the message protocol of the event message (EventMessage). Its functions include some or all of the following: control of events and connection requests, differentiation of connection types, carrying Agent parameters, and event priority. Its features include some or all of the following: EventType / EventID / AgentType, parameter expansion, classification, and status tracking. The third message protocol refers to the message protocol of data messages. The functions of the third message protocol include some or all of the functions such as business data transmission, fragmentation processing, flow control and reliability assurance. The features of the third message protocol include some or all of the features such as support for binary / text format, compression, data integrity verification, and support for pause and resume of streams.

[0160] Feature 4: The security measures used in the communication scheme provided in this application include the following: ① The principle of least privilege: each channel (Tunnel) / session is independent, providing only the necessary communication / proxy capabilities. The Tunnel-Proxy can only be specified and controlled by the Tunnel-Server and will not access it in reverse; ② Identity authentication: all connection establishment and message forwarding require identity authentication. For example, when the Tunnel-Proxy receives a message sent by the Tunnel-Server (such as connection requests, response data, etc.), the Tunnel-Proxy authenticates the Tunnel-Server to avoid defects caused by the existence of a forged Tunnel-Server, thereby improving security; ③ End-to-end encryption: all Tunnel links (including long connections / short connections) are encrypted. ④ Channel encryption is supported for both event push and Proxy-Agent communication; ⑤ Session tracking and auditing: each channel or event has a unique session ID and log tracking for easy tracing, analysis and detection; ⑥ Heartbeat and high availability: long-connection periodic heartbeat detection, automatic recovery / alarm for abnormal disconnection, and support for multi-instance networking of Tunnel-Server and Tunnel-Proxy (such as multiple Tunnel-Servers that serve as backups for each other corresponding to one Tunnel-Proxy, to ensure that there is an available Tunnel-Server and the Tunnel-Proxy that can communicate normally at any time), preventing single point of failure; ⑦ Message isolation: message numbering (such as message ID), channel ID marking, and routing mechanisms ensure that different requests do not interfere with each other, preventing data tampering and modification.

[0161] Fifthly, the communication solution provided in this application can solve the following problems: ① It enables the establishment of a secure and controllable data communication channel between public and private networks, supporting both long and short connection modes to meet different interaction scenarios; ② It enables cloud gateways (such as Tunnel-Server) to securely forward communication requests to internal network proxies (such as Tunnel-Proxy), thereby enabling the establishment of internal network service call links while ensuring security; ③ It ensures that each connection or session has the least privilege, is traceable, and auditable, avoiding the risks of over-authorization and large-granularity VPNs, is compatible with high-concurrency scenarios and high-availability deployments, and supports distributed and highly scalable architectures; ④ It enables end-to-end encryption and authentication of the communication process, meeting enterprise-level security requirements (such as the security requirements of private network owners).

[0162] Sixthly, the communication solution provided in this application is implemented using a layered channel model based on Tunnel-Server + Tunnel-Proxy. It eliminates the need for configuring an internal VPN or providing an external internal gateway, simplifying deployment and significantly improving security. This solution forwards events (short connections) to the Tunnel-Proxy session via the Tunnel-Server, enabling secondary distribution of various events within the Tunnel-Proxy to HTTP, scripts, and in-memory remote procedure calls (RPCs). The internal agent then directly transmits the data back to the cloud via HTTP, resulting in a simplified, efficient, and easily monitored process. The channel ID and session ID are implemented separately to support load balancing for large-scale, high-concurrency connections, ensuring strong scalability. The solution features end-to-end encryption, customizable permissions, and strong authentication, guaranteeing the security of enterprise business data and private networks. Furthermore, the solution grants the Tunnel-Proxy only strict minimum outbound call control (one-way control), fundamentally addressing the security risks of traditional VPNs that grant extensive internal network access.

[0163] Feature 7: The communication solution provided in this application has the following advantages: ① High security: Least privilege forwarding, end-to-end encryption, and strict authentication greatly reduce the risk of internal network exposure and data leakage; ② High flexibility: Long and short connection collaboration supports cloud-initiated WebSSH, API calls, notification push, one-click tasks, and other scenarios to meet different calling needs; ③ Controllable and traceable: Each channel / event has a unique ID and logs are retained, suitable for large-scale multi-tenant and high-security scenarios; ④ Easy to deploy and expand: Supports multi-instance deployment and load balancing of Tunnel-Server and Tunnel-Proxy, with strong horizontal scaling capabilities, suitable for enterprise-level and operational-level complex network environments; ⑤ Compatible with complex heterogeneous internal network systems: Tunnel-Proxy can connect to various local agents to meet the needs of various network devices and business ecosystems; ⑥ Excellent performance: Built-in connection pool, message buffer, and worker pool mechanisms ensure stable throughput and low latency even under continuous high-concurrency scenarios.

[0164] It should be noted that, regarding the requirement for cross-network access, researchers have studied previously attempted solutions and found that: ① Solutions based on VPNs or port forwarding (such as SSH reverse port mapping) still have significant privilege risks and are not as secure and controllable as the Tunnel-Proxy-based controlled one-way solution provided in this application; ② Solutions based on an internal network open API whitelist and NAT (Network Address Translation Traversal) still suffer from vulnerabilities such as vulnerability to attacks, lack of least privilege management, difficulty in traceability, and high availability, making their performance inferior to the communication solution provided in this application; ③ Solutions implemented through asynchronous message queue delivery fail to meet enterprise needs in terms of real-time performance, manageability, and channel security, making their performance inferior to the communication solution provided in this application.

[0165] Based on the communication method between the cloud and a private network provided in the embodiments of this application, the embodiments of this application also provide a communication system between the cloud and a private network, which will be discussed below. Figure 15 Explanation and clarification will be provided. Among them, Figure 15 This is a schematic diagram illustrating the structure of a communication system between a cloud and a private network, provided in an embodiment of this application. It should be noted that for technical details of the communication system between the cloud and a private network provided in this embodiment, please refer to the relevant content above regarding the communication method between the cloud and a private network.

[0166] like Figure 15 As shown, the cloud-private network communication system 1500 provided in this application includes: a first server 1501 located in the cloud and a proxy server 1502 located in the private network. The first server 1501 executes any implementation of the cloud-private network communication method provided in this application.

[0167] In one possible implementation, the first server 1501 is specifically used to: obtain first indication information; and in response to the proxy server 1502 having established a first channel between the first server 1501 and the proxy server 1502, forward the first indication information to the proxy server 1502 through the first channel.

[0168] The proxy server 1502 is specifically used to: perform at least one task in the private network according to the first instruction information.

[0169] In one possible implementation, the first indication information is a request to create a channel corresponding to an independent long connection for the target object; or, the first indication information is an event message in short connection mode; or, the first indication information is an event message in long connection mode.

[0170] In one possible implementation, the first channel is a channel corresponding to a persistent long connection; the proxy server 1502 is specifically used to: in response to the first indication information request to create a channel corresponding to an independent long connection for the target object, create a second channel between the first server 1501 and the proxy server 1502, the channel corresponding to the independent long connection includes the second channel, and the channel corresponding to the independent long connection is used to implement the data communication process corresponding to the target object.

[0171] In one possible implementation, the proxy server 1502 is further configured to: create a third channel between the proxy server 1502 and a processing server located in the private network, wherein the processing server uses at least one resource in the private network to process messages sent by the proxy server 1502 through the third channel, and the channel corresponding to the independent long connection further includes the third channel.

[0172] In one possible implementation, the first server 1501 is further configured to: in response to the completion of the channel establishment corresponding to the independent long connection, obtain second indication information corresponding to the target object; forward the second indication information to the proxy server 1502 through the second channel, and process the second indication information through the proxy server 1502; and receive the processing result of the second indication information fed back by the proxy server 1502 through the second channel.

[0173] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode; the first server 1501 is further configured to: receive the processing result of the first indication information fed back by the proxy server 1502 in response to the preset interface located in the cloud receiving the processing result of the first indication information forwarded by the preset interface.

[0174] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode; the first server 1501 is further configured to: receive the processing result of the first indication information fed back by the proxy server 1502 through the first channel.

[0175] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode; in response to the processing time of the first indication information not exceeding a preset threshold, the proxy server 1502 feeds back the processing result of the first indication information through the first channel; in response to the processing time of the first indication information exceeding the preset threshold, the proxy server 1502 feeds back the processing result of the first indication information through a preset interface located in the cloud.

[0176] In one possible implementation, the first instruction information is further processed based on preset permission information, which indicates the user who sent the first instruction information to have usage rights to some or all resources in the private network.

[0177] In one possible implementation, the first channel satisfies at least one of the following constraints: the first channel is a channel corresponding to a persistent long connection, and data communication processes under at least one mode are implemented through the first channel, the at least one mode including at least one of a long connection mode and a short connection mode; the message transmitted through the first channel carries at least one identifier, the at least one identifier including at least one of a message identifier, a channel identifier, and a routing identifier; the message transmitted through the first channel is in an encrypted state.

[0178] In one possible implementation, the first server 1501 is specifically configured to: forward the first indication information to the proxy server 1502 through the first channel in response to the proxy server 1502 being in an available state.

[0179] In one possible implementation, the first server 1501 is specifically configured to: receive the first instruction information forwarded by the second server in response to the second server located in the cloud receiving the first instruction information sent by the caller.

[0180] In one possible implementation, the first server 1501 has unidirectional outbound call control over the proxy server 1502.

[0181] In one possible implementation, the first channel is the channel corresponding to a persistent long connection, and the first channel is in a sustained state while the proxy server 1502 is in an available state.

[0182] In one possible implementation, the first server 1501 is a server of a Network as a Service (NaaS) service provider, which performs NaaS service configuration or management operations on the private network through the first server 1501 and the proxy server 1502.

[0183] Based on the aforementioned content regarding the communication system 1500 between the cloud and the private network, it can be understood that, for the isolated cloud and private network, the communication system 1500 includes a first server 1501 (e.g., a cloud gateway) located in the cloud and a proxy server 1502 (e.g., an intranet proxy) located in the private network. Furthermore, the working principle of this system 1500 includes: when the first server 1501 receives first instruction information, if the proxy server has already established a first channel between the first server 1501 and the proxy server 1502, then the first server 1501 forwards the first instruction information to the proxy server 1502 through the first channel. A proxy server 1502 is deployed in the private network to execute at least one task (such as data query, data processing, or processing logic call) within the private network according to the first instruction information. This allows the proxy server 1502 to process external messages (such as the first instruction information) according to the logic configured within the private network, ensuring that the processing of these external messages meets the constraints configured within the private network (such as access permissions for resources like databases). This enables the establishment of service call links within the private network while maintaining security through message forwarding between different endpoints, thus better achieving secure and controllable communication between the cloud and internal network services. The first channel is created by the proxy server within the private network, not by a first server. This ensures that the private network proactively provides a secure and usable channel to the outside world, avoiding the shortcomings that might occur if the first server proactively creates a channel due to the private network's inability to guarantee secure communication. This facilitates better secure and controllable communication within the private network.

[0184] Based on the communication method between the cloud and a private network provided in the embodiments of this application, the embodiments of this application also provide a communication device between the cloud and a private network, which will be described below in conjunction with... Figure 16 Explanation and clarification will be provided. Among them, Figure 16 This is a schematic diagram of a communication device between a cloud and a private network provided in an embodiment of this application. It should be noted that for technical details of the communication device between the cloud and a private network provided in this embodiment, please refer to the relevant content above regarding the communication method between the cloud and a private network.

[0185] like Figure 16 As shown in the embodiment of this application, the communication device 1600 between the cloud and a private network includes:

[0186] The first acquisition unit 1601 is used to acquire first indication information;

[0187] The first sending unit 1602 is configured to, in response to a proxy server located in the private network having established a first channel between a first server located in the cloud and the proxy server, forward the first instruction information to the proxy server through the first channel, and the proxy server performs at least one task in the private network according to the first instruction information.

[0188] In one possible implementation, the device 1600 is deployed on the first server; or, the device 1600 is independent of the first server, but the device 1600 is capable of data communication with the first server.

[0189] In one possible implementation, the device 1600 may be implemented using software or hardware (such as a circuit board).

[0190] In one possible implementation, the first indication information is a request to create a channel corresponding to an independent long connection for the target object; or, the first indication information is an event message in short connection mode; or, the first indication information is an event message in long connection mode.

[0191] In one possible implementation, the first channel is a channel corresponding to a persistent long connection; the step of performing at least one task in the private network according to the first indication information includes: responding to the request of the first indication information to create a channel corresponding to an independent long connection for a target object, creating a second channel between the first server and the proxy server via the proxy server, wherein the channel corresponding to the independent long connection includes the second channel, and realizing the data communication process corresponding to the target object through the channel corresponding to the independent long connection.

[0192] In one possible implementation, the step of performing at least one task in the private network according to the first instruction information further includes: creating a third channel between the proxy server and a processing server located in the private network via the proxy server, wherein the processing server uses at least one resource in the private network to process messages sent by the proxy server through the third channel, and the channel corresponding to the independent long connection further includes the third channel.

[0193] In one possible implementation, the device 1600 further includes:

[0194] The second acquisition unit is used to acquire second indication information corresponding to the target object in response to the completion of the channel establishment corresponding to the independent long connection;

[0195] The second sending unit is used to forward the second indication information to the proxy server through the second channel, and to process the second indication information through the proxy server.

[0196] The first receiving unit is used to receive the processing result of the second indication information fed back by the proxy server through the second channel.

[0197] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode;

[0198] The device 1600 further includes:

[0199] The second receiving unit is configured to receive the processing result of the first indication information forwarded by the proxy server in response to the processing result of the first indication information received by the preset interface located in the cloud.

[0200] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode;

[0201] The device 1600 further includes:

[0202] The third receiving unit is used to receive the processing result of the first indication information fed back by the proxy server through the first channel.

[0203] In one possible implementation, the first indication information is sent through the interface corresponding to the short connection mode; in response to the processing time of the first indication information not exceeding a preset threshold, the proxy server feeds back the processing result of the first indication information through the first channel; in response to the processing time of the first indication information exceeding the preset threshold, the proxy server feeds back the processing result of the first indication information through a preset interface located in the cloud.

[0204] In one possible implementation, the first instruction information is further processed based on preset permission information, which indicates the user who sent the first instruction information to have usage rights to some or all resources in the private network.

[0205] In one possible implementation, the first channel satisfies at least one of the following constraints: the first channel is a channel corresponding to a persistent long connection, and data communication processes under at least one mode are implemented through the first channel, the at least one mode including at least one of a long connection mode and a short connection mode; the message transmitted through the first channel carries at least one identifier, the at least one identifier including at least one of a message identifier, a channel identifier, and a routing identifier; the message transmitted through the first channel is in an encrypted state.

[0206] In one possible implementation, the first sending unit 1602 is specifically configured to: forward the first indication information to the proxy server through the first channel in response to the proxy server being in an available state.

[0207] In one possible implementation, the first acquisition unit 1601 is configured to receive the first instruction information forwarded by the second server in response to the second server located in the cloud receiving the first instruction information sent by the caller.

[0208] In one possible implementation, the first server has unidirectional outbound call control over the proxy server.

[0209] In one possible implementation, the first channel is a channel corresponding to a persistent long-lived connection, and the first channel is in a sustained state while the proxy server is in an available state.

[0210] In one possible implementation, the first server is a server of a Network as a Service (NaaS) service provider, which performs NaaS service configuration or management operations on the private network through the first server and the proxy server.

[0211] Based on the aforementioned content of device 1600, it can be understood that device 1600 is specifically used for: for isolated cloud and private networks, when the first server (such as a cloud gateway) in the cloud obtains the first instruction information, if the proxy server (such as an intranet proxy) in the private network has established a first channel between the first server and the proxy server, the first server forwards the first instruction information to the proxy server through the first channel, so that the proxy server can perform at least one task (such as data query, data processing, processing logic call, etc.) in the private network according to the first instruction information, so as to realize the processing of external messages (such as the first instruction information) according to the logic configured by the private network itself, thereby ensuring that the processing of external messages can meet the constraints configured by the private network itself (such as access permissions of resources such as databases). In this way, the intranet service call link can be opened under the premise of ensuring security through message forwarding between different ends, so as to better realize secure and controllable communication between the public network (such as the cloud) and the intranet service. The first channel is created by a proxy server in the private network, rather than by the first server. This is to better enable the private network to proactively provide a secure and usable channel to the outside world, avoiding the defects caused by the private network's inability to ensure secure communication when the first server proactively creates the channel. This is conducive to achieving secure and controllable communication in the private network.

[0212] In addition, this application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device performs any implementation of the cloud-private network communication method provided in this application.

[0213] See Figure 17 The diagram illustrates a structural schematic of an electronic device 1700 suitable for implementing embodiments of the present disclosure. Terminal devices in embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 17 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0214] like Figure 17 As shown, electronic device 1700 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 1701, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1702 or a program loaded from storage device 1708 into random access memory (RAM) 1703. RAM 1703 also stores various programs and data required for the operation of electronic device 1700. Processing unit 1701, ROM 1702, and RAM 1703 are interconnected via bus 1704. Input / output (I / O) interface 1705 is also connected to bus 1704.

[0215] Typically, the following devices can be connected to I / O interface 1705: input devices 1706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 1707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1709. Communication device 1709 allows electronic device 1700 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 17 An electronic device 1700 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0216] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 1709, or installed from storage device 1708, or installed from ROM 1702. When the computer program is executed by processing device 1701, it performs the functions defined in the methods of embodiments of this disclosure.

[0217] The electronic device provided in this embodiment belongs to the same inventive concept as the method provided in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0218] This application also provides a computer-readable medium storing instructions or computer programs that, when executed on a device, cause the device to perform any implementation of the cloud-private network communication method provided in this application.

[0219] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0220] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0221] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0222] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, enable the electronic device to perform the aforementioned methods.

[0223] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0224] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0225] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units / modules do not necessarily limit the specific unit itself.

[0226] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0227] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0228] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

[0229] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0230] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0231] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0232] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A communication method between a cloud and a private network, characterized in that, The method is applied to a first server located in the cloud, and the method includes: Obtain the first instruction information; In response to the proxy server located in the private network having established a first channel between the first server and the proxy server, the first instruction information is forwarded to the proxy server through the first channel, and the proxy server performs at least one task in the private network according to the first instruction information.

2. The method according to claim 1, characterized in that, The first indication is a request to create a channel corresponding to an independent long connection for the target object; or, The first indication information is an event message in short connection mode; or, The first indication information is an event message in long connection mode.

3. The method according to claim 1, characterized in that, The first channel is the channel corresponding to a persistent long-lived connection; The step of performing at least one task in the private network according to the first instruction information includes: In response to the first indication message requesting the creation of a channel corresponding to an independent long connection for the target object, a second channel is created between the first server and the proxy server via the proxy server. The channel corresponding to the independent long connection includes the second channel, and the channel corresponding to the independent long connection is used to implement the data communication process corresponding to the target object.

4. The method according to claim 3, characterized in that, The step of performing at least one task in the private network according to the first indication information further includes: A third channel is created between the proxy server and a processing server located in the private network. The processing server uses at least one resource in the private network to process messages sent by the proxy server through the third channel. The channel corresponding to the independent long connection also includes the third channel.

5. The method according to claim 3, characterized in that, The method further includes: In response to the completion of the channel establishment corresponding to the independent long connection, the second indication information corresponding to the target object is obtained; The second instruction information is forwarded to the proxy server through the second channel, and the second instruction information is processed by the proxy server. The processing result of the second indication information fed back by the proxy server is received through the second channel.

6. The method according to claim 1, characterized in that, The first indication information is sent through the interface corresponding to the short connection mode; The method further includes: In response to the processing result of the first indication information received by the proxy server through the preset interface located in the cloud, the processing result of the first indication information forwarded by the preset interface is received.

7. The method according to claim 1, characterized in that, The first indication information is sent through the interface corresponding to the short connection mode; The method further includes: The first channel receives the processing result of the first indication information fed back by the proxy server.

8. The method according to claim 1, characterized in that, The first indication information is sent through the interface corresponding to the short connection mode; If the processing time of the first indication information does not exceed a preset threshold, the proxy server will feed back the processing result of the first indication information through the first channel. If the processing time of the first indication information exceeds a preset threshold, the proxy server will feed back the processing result of the first indication information through a preset interface located in the cloud.

9. The method according to claim 1, characterized in that, The first instruction information is further processed based on preset permission information, which indicates the user who sent the first instruction information to have usage rights to some or all resources in the private network.

10. The method according to claim 1, characterized in that, The first channel satisfies at least one of the following constraints: The first channel is the channel corresponding to a persistent long connection. Data communication processes in at least one mode are implemented through the first channel. The at least one mode includes at least one of a long connection mode and a short connection mode. The message transmitted through the first channel carries at least one identifier, which includes at least one of a message identifier, a channel identifier, and a routing identifier. Messages transmitted through the first channel are encrypted.

11. The method according to any one of claims 1-10, characterized in that, The step of forwarding the first indication information to the proxy server through the first channel includes: In response to the proxy server being available, the first indication information is forwarded to the proxy server through the first channel; And / or, The acquisition of the first indication information includes: In response to the second server located in the cloud receiving the first instruction information sent by the caller in the cloud, the server receives the first instruction information forwarded by the second server.

12. The method according to any one of claims 1-10, characterized in that, The first server has unidirectional outbound call control over the proxy server; And / or, The first channel is the channel corresponding to a persistent long-lived connection, and the first channel is in a sustained state while the proxy server is in an available state.

13. The method according to any one of claims 1-10, characterized in that, The first server is a server of a Network as a Service (NaaS) service provider, which performs NaaS service configuration or management operations on the private network through the first server and the proxy server.

14. A communication system between a cloud and a private network, characterized in that, The system includes a first server located in the cloud and a proxy server located in the private network, wherein the first server performs the method according to any one of claims 1-14.

15. An electronic device, characterized in that, The device includes: a processor and a memory; The memory is used to store instructions or computer programs; The processor is configured to execute the instructions or computer program in the memory to cause the electronic device to perform the method according to any one of claims 1-13.

16. A computer-readable medium, characterized in that, The computer-readable medium stores instructions or computer programs that, when executed on the device, cause the device to perform the method according to any one of claims 1-13.

17. A computer program product, characterized in that, It includes a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the method of any one of claims 1-13.

Images