Network channel dynamic control method and device, equipment, storage medium and product

Abstract

The embodiment of the invention provides a network channel dynamic control method and device, equipment, a storage medium and a product, and relates to the field of information security and financial science and technology. The method comprises the steps of obtaining an operation state of a target operation; according to the operation state, generating a dynamic control strategy corresponding to the operation state, and generating a network channel opening instruction; sending the network channel opening instruction to a target network device to establish a temporary communication channel in the target network device; and when detecting that the operation state is end, deleting the temporary communication channel. According to the method provided by the invention, the opening state of the network channel is bound with the operation state, so that the communication exposure time of the backup area and the production area is remarkably shortened. The communication channel is ensured to be temporarily opened only during the job execution period, the problem of attack surface expansion caused by long-term opening of the channel in a static policy is avoided, and unauthorized access is effectively prevented. And timeliness and accuracy of strategy adjustment are ensured through an automatic process, so that safer resource isolation is realized.

Description

Technical Field

[0001] This application relates to the fields of information security and financial technology, and in particular to a method, apparatus, device, storage medium and product for dynamic control of network channels. Background Technology

[0002] In enterprise-level data backup systems, the security and isolation of backup data are crucial for ensuring business continuity. With the increasing frequency of data breaches, enterprises have increasingly stringent requirements for protecting backup data. In a typical backup scenario, backup clients in the production environment need to transmit data through a media server (such as a backup storage device or network storage node), and the execution of backup jobs usually depends on the network connectivity between the client and the media server.

[0003] The existing backup architecture has significant security vulnerabilities: when a backup task is not being executed, the network channel between the backup client and the media server remains open, causing backup data to be exposed to potential attack paths for extended periods. Furthermore, traditional backup systems lack dynamic isolation mechanisms and cannot adjust network permissions in real time based on job status, making the backup area a vulnerable point for attackers. Summary of the Invention

[0004] This application provides a method, apparatus, device, storage medium, and product for dynamic control of network channels, which solves the technical problem of establishing a long-term connection between backup clients and media servers through preset firewall rules or routing policies.

[0005] Firstly, this application provides a method for dynamic control of network channels, including:

[0006] Obtain the job status of the target job, including the execution status of the backup task or the execution status of the recovery task;

[0007] Based on the job status, generate a dynamic control strategy corresponding to the job status, and generate a network channel opening instruction;

[0008] Send a network channel opening command to the target network device to establish a temporary communication channel in the target network device;

[0009] Delete the temporary communication channel when the job status is detected as completed.

[0010] Secondly, this application provides a network channel dynamic control device, comprising:

[0011] The acquisition module is used to acquire the job status of the target job, which includes the execution status of the backup task or the execution status of the recovery task.

[0012] The generation module is used to generate dynamic control strategies corresponding to the job status based on the job status, and to generate network channel opening instructions.

[0013] The module is used to send network channel opening instructions to the target network device in order to establish a temporary communication channel in the target network device.

[0014] The deletion module is used to delete temporary communication channels when the job status is detected as "end".

[0015] Thirdly, this application provides an electronic device, including: a processor and a memory communicatively connected to the processor;

[0016] The memory stores the instructions that the computer executes;

[0017] The processor executes computer-executable instructions stored in memory to implement any of the methods of the first aspect.

[0018] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method of any one of the first aspects.

[0019] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method of any one of the first aspects.

[0020] The network channel dynamic control method, apparatus, equipment, storage medium, and product provided in this application bind the opening of network channels to the job status, significantly shortening the communication exposure time between backup and production areas. Through a dynamic control policy generation and distribution mechanism, it ensures that communication channels are only temporarily opened during job execution and immediately closed upon task completion, avoiding the attack surface expansion problem caused by long-term channel openness in traditional static policies. The master server dynamically opens the channel when it detects the start of a backup job and immediately closes it upon task completion, effectively preventing unauthorized access. Furthermore, without manual intervention or reliance on scheduled tasks, the automated process ensures the timeliness and accuracy of policy adjustments, thereby achieving more secure resource isolation. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0022] Figure 1 This is a schematic diagram of the data backup system.

[0023] Figure 2 A flowchart illustrating a network channel dynamic control method provided in an embodiment of this application;

[0024] Figure 3 This is a schematic diagram of the structure of a network channel dynamic control device provided in an embodiment of this application;

[0025] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0026] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0028] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0029] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0030] It should be noted that the network channel dynamic control method, device, equipment, storage medium and product provided in this application can be used in the fields of information security and financial technology, as well as in any field other than information security and financial technology. The application fields of the network channel dynamic control method, device, equipment, storage medium and product in this application are not limited.

[0031] The specific application scenario of this application is an enterprise-level data backup system, which protects the security and isolation of backup data to ensure business continuity. Figure 1 A schematic diagram of the data backup system, such as Figure 1 As shown, a typical network architecture for a data backup system includes deploying backup clients in the production area, deploying media servers in the backup area, and setting up a master server for managing and scheduling services. A long-term connection is established between the backup client and the media server through preset firewall rules or routing policies. The specific process is as follows: after the backup scheduling service initiates a task, the backup client communicates directly with the media server to complete data transmission; after the task is completed, the connection remains open until it is manually or periodically closed.

[0032] Therefore, the existing backup architecture has significant security vulnerabilities: when a backup task is not being executed, the network channel between the backup client and the media server remains open, causing backup data to be exposed to potential attack paths for extended periods. For example, backup data could be obtained through a persistent network connection, or backup files could be modified using unauthorized access. Furthermore, existing backup systems lack dynamic isolation mechanisms and cannot adjust network permissions in real time based on job status, making the backup area a vulnerable point for attackers. In industries with extremely high data sensitivity, such as finance and healthcare, this static connection model is no longer sufficient to meet compliance requirements.

[0033] Specifically, the core shortcomings of the existing static network configuration model are: 1. Continuous exposure of risks: The network channel between the backup client and the media server remains open during non-operational periods, allowing attackers to exploit this channel for persistent attacks or lateral movement. 2. Lack of dynamic control: Existing firewall policies cannot be adjusted in real time according to job status, resulting in the backup area being in a high-risk exposure state for extended periods. 3. High operational complexity: Manual intervention to close connections is required, or reliance on scheduled tasks is necessary, which can easily lead to security vulnerabilities due to configuration errors or delays. 4. Lax access control: Communication permissions between the backup client and the media server are not granularized to specific job instances, posing a risk of unauthorized access. This type of static network configuration model is significantly inadequate in dealing with modern network attacks (such as zero-day vulnerabilities and advanced persistent threats), especially in multi-tenant or hybrid cloud environments, lacking fine-grained isolation capabilities.

[0034] The network channel dynamic control method, apparatus, device, storage medium, and product provided in this application achieve on-demand dynamic control by binding the opening of the network channel to the operation status. The master server generates a dynamic control strategy based on the operation status, and the target network device establishes a temporary communication channel after receiving the dynamic control strategy; when the operation status ends, the master server or the target network device automatically deletes the temporary communication channel, aiming to solve the above-mentioned technical problems of the prior art.

[0035] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0036] Figure 2 This is a flowchart illustrating a network channel dynamic control method provided in an embodiment of this application, as shown below. Figure 2 As shown, the method includes:

[0037] S201. Obtain the job status of the target job.

[0038] In the embodiments of this application, the job status includes the execution status of a backup task or the execution status of a recovery task.

[0039] In one example, the target job status includes the execution status of the backup or restore task, such as "backup job started" or "restore job completed". When the master server detects that the backup scheduling service has initiated a job, it determines that the current job status is "in progress".

[0040] S202. Based on the job status, generate a dynamic control strategy corresponding to the job status and generate a network channel opening instruction.

[0041] In one example, dynamic control policies may include network policy adjustment instructions generated based on changes in job status, such as adding or deleting firewall rules. The master server generates dynamic control policies (such as firewall rules allowing specific client IPs to access the media server) based on job status and sends the policies to target network devices via an application programming interface or a proprietary protocol.

[0042] S203. Send the network channel opening command to the target network device to establish a temporary communication channel in the target network device.

[0043] In one example, the target network device is the network device that executes the dynamic control policy, such as a media server or a firewall device for backup clients. The temporary communication channel includes a network connection path generated by the dynamic control policy that exists only during job execution. Upon receiving the dynamic control policy, the target network device establishes the temporary communication channel.

[0044] S204. When the operation status is detected as completed, delete the temporary communication channel.

[0045] In one example, when the job status ends (e.g., backup data transmission is complete), the master server or target network device automatically deletes the temporary communication channel. The establishment and destruction of the temporary communication channel both depend on changes in the job status of the target job, and the processing objects (including but not limited to dynamic control strategies and temporary communication channels) form a progressive relationship between steps.

[0046] In one implementation scenario, within a data backup system, the following steps can be taken to ensure that the network connection between the backup client and the media server is established only when the backup job is actually executed:

[0047] Step 0: Configure the media server's firewall to only allow the backup master service node to connect, and configure the backup client's firewall to only allow the backup master service node to connect for backup-related firewalls.

[0048] For example, the processing objects include firewall policy configurations for the master server, media server, and backup clients. The firewalls on the master server and media server are configured to allow only the backup master service node to connect, and the firewalls on the backup clients are configured to allow only the backup master service node to connect. For instance, in a financial industry scenario, the master server's firewall policy is set to allow only its IP address to access the media server and backup clients. The default communication channel between the production area and the backup area is blocked, retaining only the master server's administrative privileges. The firewall policy includes network device or software rules used to control data packet transmission permissions. For example, restricting IP address A to only communicate with IP address B. The backup master service node is the central control node responsible for scheduling backup tasks, such as the master server's IP address.

[0049] Step 1: The backup scheduling service initiates a backup job or executes a recovery job.

[0050] For example, in response to job requests generated by the backup scheduling service, the backup scheduling service initiates backup or recovery jobs according to preset strategies (such as time-based scheduling or manual triggering). For instance, a company automatically triggers a full backup task at a fixed time each day, generating backup / recovery job instructions to be executed. The backup scheduling service includes a software module for managing backup task schedules.

[0051] Step 2: The backup master service node obtains information about the backup client and the media server to be connected.

[0052] For example, in response to the job parameters transmitted by the backup scheduling service, the master server parses the job parameters and extracts the IP addresses of the backup client and the media server that need to be connected. The master server then obtains the communication requirements between the client and the media server for the current job.

[0053] Step 3: The backup master service node sends the backup client address information to the media server. For example, it can also send the media server information to the backup client.

[0054] For example, regarding the communication channel between the master server and the media server, the master server sends the client IP address information to the media server through an application programming interface or a dedicated protocol, and the media server learns the client IP address of the current job.

[0055] Step 4: The media server opens the firewall policy of the client based on the received backup client address information. For example, the backup client only opens the firewall policy of the media server that needs to be connected to for this backup job.

[0056] For example, the media server adds a temporary rule to its firewall based on the received client IP address, allowing the IP address to access itself, thereby temporarily opening the communication channel between the client and the media server.

[0057] Step 5: Perform a backup job or a recovery job.

[0058] For example, the backup client and media server transmit data through an established channel. Utilizing this established communication channel ensures efficient job execution.

[0059] Step 6: After the backup data transmission is complete, the media server and backup client will delete or disable the firewall policies enabled in Step 4.

[0060] For example, after detecting that the data transmission is complete, the media server deletes the firewall rule added in step 4, thereby closing the communication channel between the backup client and the media server.

[0061] Step 7: Backup or restore job complete.

[0062] For example, the master server will mark the job status as "completed" and release the relevant resources, and the system will return to the initial isolation state.

[0063] By dynamically adjusting firewall policies in real time, the security of backup data is significantly improved: 1. Reduced exposure time: The communication channel between the backup client and the media server is only open during job execution and immediately closed after the task is completed, avoiding the attack risk caused by long-term exposure. 2. Reduced attack surface: During non-job periods, the production area and backup area are network isolated, preventing attackers from stealing or tampering with backup data through persistent connections. 3. Automated management: No manual intervention or reliance on scheduled tasks is required; the collaborative control of the master server and media server ensures the timeliness and accuracy of policy adjustments. 4. Fine-grained permissions: Firewall policies only open permissions for the client IP address of the current job, preventing unauthorized access or communication. 5. Adaptability to dynamic needs: It can flexibly handle complex scenarios such as multi-tenancy and hybrid cloud, supporting the opening of communication channels between different clients and the media server as needed. Based on the above technical effects, this solution has significant application value in industries with extremely high data security requirements, such as finance and healthcare.

[0064] The network channel dynamic control method provided in this embodiment significantly shortens the communication exposure time between the backup area and the production area by binding the opening of the network channel to the job status. The dynamic control policy generation and distribution mechanism ensures that the communication channel is only temporarily opened during job execution and immediately closed after the task is completed, avoiding the attack surface expansion problem caused by long-term open channels in traditional static policies. The master server dynamically opens the channel when it detects the start of a backup job and immediately closes it after the task is completed, effectively preventing unauthorized access. Furthermore, without manual intervention or reliance on scheduled tasks, the automated process ensures the timeliness and accuracy of policy adjustments, thereby achieving more secure resource isolation.

[0065] Optionally, based on the job status, a dynamic control strategy corresponding to the job status is generated, including: obtaining the job parameters of the target job; parsing the job parameters to obtain the identification information of the target network device; and generating a dynamic control strategy based on the identification information, wherein the dynamic control strategy includes the communication permission configuration of the target network device.

[0066] In one example, job parameters may include job execution parameters passed by the backup scheduling service, such as the client IP address and media server IP address. Communication permission configuration may include defining communication rules for the target network device, such as allowing specific IP addresses to access specific ports.

[0067] For example, dynamic control policies are generated by parsing target network device identification information, such as the backup client IP address and media server IP address, from the job parameters. For instance, after receiving a job request from the backup scheduling service, the master server parses the IP address in the job parameters and generates firewall rules that allow communication based on the IP address. The generated policy is then sent to the target network device (such as the media server's firewall) to establish a temporary communication channel.

[0068] By parsing job parameters to generate dynamic control policies, it ensures that network channel opening instructions match specific job requirements. For example, the master server can precisely control which clients of the current job are allowed to communicate with the media server, avoiding the risk of unauthorized access due to policy generalization, thereby achieving more granular access management.

[0069] Optionally, before generating the dynamic control policy corresponding to the job status, the method further includes: obtaining the job priority of the target job; adjusting the priority level of the dynamic control policy according to the job priority to match the dynamic control policy in the target network device.

[0070] In one example, job priority is used to characterize the urgency level of a target job, such as "high / medium / low". For instance, a high-priority job might be a real-time database backup, while a low-priority job might be a fixed-time batch backup. Priority level is used to characterize the matching order of dynamic control policies in the rule chain of the target network device. For example, a high-priority policy might be inserted at the top of the rule chain.

[0071] For example, before generating a dynamic control policy, the priority level of the dynamic control policy is adjusted according to the job priority of the target job. For instance, after the master server parses the job parameters, if it detects that the job is marked as "high priority", it inserts the generated dynamic control policy into the high priority position of the target network device's rule chain, ensuring that it is matched with priority over low priority policies.

[0072] A priority adjustment mechanism ensures that communication channels for high-priority tasks are opened first, thereby avoiding delays in critical data due to resource contention.

[0073] Optionally, the dynamic control strategy includes at least one of the following: the binding information between the hardware identifier and the Internet Protocol address of the client device corresponding to the target job; and the binding information between the hardware identifier and the Internet Protocol address of the media server corresponding to the target job.

[0074] In one example, the hardware identifier is a unique physical identifier for the target network device, such as its media access control address (MAC address) or hardware serial number. For instance, the dynamic control policy can be refined to bind the hardware identifier of the client or media server to its IP address. For example, when generating the policy, the master server includes not only the IP address but also the client's MAC address, ensuring that only the specified IP address is allowed to communicate.

[0075] Hardware-based identifier binding is used to defend against IP spoofing attacks, ensuring that only the designated device is allowed to communicate via a specified IP address, thereby effectively preventing unauthorized devices from accessing the target network device.

[0076] Optionally, the target network device may include a network firewall device in a cloud environment. The network channel opening instruction may be generated by pushing dynamic control policies to the network firewall device through an interface provided by the cloud platform.

[0077] In one example, the cloud service provider's application programming interface (API) is an interface provided by the cloud platform for managing network resources. For instance, dynamic control policies are pushed to network firewall devices in the cloud environment through the cloud service provider's API.

[0078] Dynamic control policies are pushed to network firewall devices in the cloud environment through interfaces provided by the cloud platform, supporting dynamic policy management in hybrid cloud architectures. This ensures precise isolation of cross-cloud channels, thereby reducing the risk of cross-cloud data leakage.

[0079] Optionally, after deleting the temporary communication channel, the method may also include: deleting the dynamic control policy in the cloud environment through an interface provided by the cloud platform.

[0080] In one example, after deleting the temporary communication channel, the dynamic control policy in the cloud environment is synchronously deleted via the cloud service provider's application programming interface.

[0081] By synchronously deleting dynamic control policies in the cloud environment through the interface provided by the cloud platform, the complete closure of cross-cloud channels is ensured. This prevents channels in the cloud environment from being accidentally opened due to residual policies, thereby achieving stricter cross-cloud isolation.

[0082] Optionally, a network channel opening instruction is generated, including: obtaining the real-time traffic characteristics of the target network device; and adjusting the communication bandwidth allocation corresponding to the dynamic control strategy based on the real-time traffic characteristics.

[0083] In one example, real-time traffic characteristics are used to characterize the dynamic attributes of network traffic on the target network device, such as protocol type, packet size, and traffic rate. By detecting the real-time traffic characteristics of the target network device (such as non-backup protocol packets), communication bandwidth allocation can be dynamically adjusted. For example, after the master server detects abnormal traffic, it reduces the bandwidth of that channel or shuts down the channel completely.

[0084] Dynamic bandwidth allocation is achieved through traffic monitoring. If abnormal traffic not associated with backup protocols is detected, the master server can limit the bandwidth of that channel to prevent attackers from interfering with the execution of critical backup tasks by monopolizing bandwidth.

[0085] Optionally, upon detecting that the job status has ended, the temporary communication channel is deleted, including: upon detecting that the job status has ended, the dynamic control policy is deleted, and the target network device is rolled back to the preset default communication rule corresponding to the target network device.

[0086] In one example, upon completion of the job state, the dynamic control policy is synchronously deleted, and the default communication rules for the target network devices are restored. For instance, after detecting the completion of the backup task, the master server deletes the packet filtering system rules and restores the default policy that only allows communication from the master server.

[0087] By employing a synchronous deletion and rollback mechanism, complete isolation of the network channel is ensured. The channel is immediately closed upon completion of the task, and the default policy is restored, avoiding long-term exposure risks due to policy remnants, thus achieving the most comprehensive backup data protection.

[0088] Figure 3 This is a schematic diagram of the structure of a network channel dynamic control device provided in an embodiment of this application, as shown below. Figure 3 As shown, the network channel dynamic control device 30 provided in this embodiment includes:

[0089] The acquisition module 301 is used to acquire the job status of the target job, including the execution status of the backup task or the execution status of the recovery task.

[0090] The generation module 302 is used to generate a dynamic control strategy corresponding to the job status based on the job status, and to generate a network channel opening instruction.

[0091] Module 303 is used to send a network channel opening command to the target network device in order to establish a temporary communication channel in the target network device;

[0092] The deletion module 304 is used to delete the temporary communication channel when the job status is detected as finished.

[0093] In one possible implementation, the generation module 302 is specifically used to: obtain the job parameters of the target job; parse the job parameters to obtain the identification information of the target network device; and generate a dynamic control strategy based on the identification information, wherein the dynamic control strategy includes the communication permission configuration of the target network device.

[0094] In one possible implementation, the network channel dynamic control device is further specifically used to: obtain the job priority of the target job; and adjust the priority level of the dynamic control strategy according to the job priority, so as to match the dynamic control strategy in the target network device.

[0095] In one possible implementation, the dynamic control strategy includes at least one of the following: binding information between the hardware identifier and the Internet Protocol address of the client device corresponding to the target job; and binding information between the hardware identifier and the Internet Protocol address of the media server corresponding to the target job.

[0096] In one possible implementation, the target network device includes a network firewall device in a cloud environment, and the generation module 302 is further specifically used to: push dynamic control policies to the network firewall device through an interface provided by the cloud platform.

[0097] In one possible implementation, the network channel dynamic control device is also specifically used to: delete the dynamic control policy in the cloud environment through the interface provided by the cloud platform.

[0098] In one possible implementation, the generation module 302 is further specifically used to: obtain the real-time traffic characteristics of the target network device; and adjust the communication bandwidth allocation corresponding to the dynamic control strategy based on the real-time traffic characteristics.

[0099] In one possible implementation, the deletion module 304 is specifically used to: delete the dynamic control strategy when the job status is detected as finished, and roll back the target network device to the preset default communication rule corresponding to the target network device.

[0100] The network channel dynamic control device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0101] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4As shown, the electronic device 40 may include a memory 401 and a processor 402. Optionally, the electronic device may also include a transceiver 403, wherein the memory 401 and the processor 402 communicate with each other; for example, the memory 401, the processor 402 and the transceiver 403 may communicate via a communication bus 404, the memory 401 is used to store a computer program, and the processor 402 executes the computer program to implement the method of the above embodiments.

[0102] Optionally, the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps in the method embodiments disclosed in this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0103] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the methods in any of the above method embodiments.

[0104] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the methods in any of the above method embodiments.

[0105] All or part of the steps in the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0106] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

[0110] In this application, the term "comprising" and its variations can refer to non-limiting inclusion; the term "or" and its variations can refer to "and / or". The terms "first", "second", etc., in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0111] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0112] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0113] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0114] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0115] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0116] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0117] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0118] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0119] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for dynamic control of network tunnels, characterized in that, The method comprises: obtaining a job state of a target job, the job state comprising an execution state of a backup task or an execution state of a recovery task; generating a dynamic control strategy corresponding to the job state according to the job state, and generating a network channel opening instruction; sending the network channel opening instruction to a target network device to establish a temporary communication channel in the target network device; when it is detected that the job state is ended, deleting the temporary communication channel.

2. The method of claim 1, wherein, The generating of the dynamic control strategy corresponding to the job state according to the job state comprises: obtaining a job parameter of the target job; analyzing the job parameter to obtain identification information of the target network device; generating the dynamic control strategy based on the identification information, the dynamic control strategy comprising a communication permission configuration of the target network device.

3. The method of claim 2, wherein, Before the generating of the dynamic control strategy corresponding to the job state, the method further comprises: obtaining a job priority of the target job; adjusting a priority level of the dynamic control strategy according to the job priority to match the dynamic control strategy in the target network device.

4. The method of claim 1, wherein, The dynamic control strategy comprises at least one of the following contents: binding information of a hardware identifier and an Internet Protocol address of a client device corresponding to the target job; binding information of a hardware identifier and an Internet Protocol address of a media server corresponding to the target job.

5. The method of claim 1, wherein, The target network device comprises a network firewall device in a cloud environment, and the generating of the network channel opening instruction comprises: pushing the dynamic control strategy to the network firewall device through an interface provided by a cloud platform.

6. The method of claim 5, wherein, After the deleting of the temporary communication channel, the method further comprises: deleting the dynamic control strategy in the cloud environment through an interface provided by a cloud platform.

7. The method of claim 1, wherein, The generating of the network channel opening instruction comprises: obtaining real-time traffic characteristics of the target network device; adjusting a communication bandwidth allocation corresponding to the dynamic control strategy based on the real-time traffic characteristics.

8. The method of claim 1, wherein, The deleting of the temporary communication channel when it is detected that the job state is ended comprises: when it is detected that the job state is ended, deleting the dynamic control strategy and rolling back the target network device to a preset default communication rule corresponding to the target network device.

9. A network path dynamic control apparatus characterized by comprising: The apparatus comprises: an obtaining module configured to obtain a job state of a target job, the job state comprising an execution state of a backup task or an execution state of a recovery task; a generating module configured to generate a dynamic control strategy corresponding to the job state according to the job state, and generate a network channel opening instruction; an establishing module configured to send the network channel opening instruction to a target network device to establish a temporary communication channel in the target network device; a deleting module configured to delete the temporary communication channel when it is detected that the job state is ended.

10. An electronic device, comprising: comprise: a processor, and a memory connected with the processor in communication; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method according to any one of claims 1 to 8.

11. A computer readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.

12. A computer program product, characterised in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images