Cloud service management and control method and device, computer program product and storage medium

Abstract

The embodiment of the invention provides a cloud service management and control method and device, a computer program product and a storage medium. In the embodiment of the invention, a cloud service management and control system can create a second private network in a first area where a cloud service provider is located as a cross-area access entrance of a cloud service provider side, and can create an exclusive fourth private network for the cloud service provider in other areas as required according to an access request of a user; as a cross-regional access exit of a user side, users in other regions except the region where the cloud service provider is located are supported to access any service provided by the cloud service provider in a cross-regional mode. Therefore, flexible expansion and contraction of the service area can be realized for the cloud service provider, and the cloud service provider does not need to deploy services in multiple areas, so that the service cost can be effectively saved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a cloud service management method, device, computer program product, and storage medium. Background Technology

[0002] In the field of cloud computing, cloud service providers can provide a variety of user-facing cloud services through cloud computing resources. The cloud services provided by cloud service providers usually have regional attributes, that is, cloud service providers usually deploy their cloud services in a certain region. More specifically, cloud services are usually deployed in a Virtual Private Cloud (VPC) used by the cloud service provider in a certain region.

[0003] Currently, cloud services only support access for users in their own region, and do not support access for users in other regions. This forces cloud service providers to deploy the same cloud service in multiple regions, resulting in excessively high service costs. Summary of the Invention

[0004] This application provides a cloud service management method, device, computer program product, and storage medium to support cross-regional access to cloud services.

[0005] This application provides a cloud service management method applicable to a cloud service management system. Service instances of cloud services provided by a cloud service provider are deployed in a first private network within a first region. A second private network dedicated to the cloud service provider is also deployed within the first region. The second private network is connected to the service instance access point of the first private network. The method includes:

[0006] In response to a user initiating an access request for a target cloud service provided by the cloud service provider, the second region where the user is located is determined, wherein the access request is initiated from a third private network used by the user in the second region;

[0007] If the first region and the second region are different and there is no private network dedicated to the cloud service provider in the second region, then a fourth private network dedicated to the cloud service provider is created in the second region.

[0008] Based on the third private network, the fourth private network, the second private network, and the first private network, a network link is constructed for the user to connect to the service instance corresponding to the target cloud service in the first private network;

[0009] The access request is transmitted to the service instance corresponding to the target cloud service in the first private network through the network link, so that the user can access the target cloud service.

[0010] Furthermore, based on the third private network, the fourth private network, the second private network, and the first private network, a network link is constructed for the user to connect to the service instance corresponding to the target cloud service in the first private network, including:

[0011] Connect the third private network and the fourth private network;

[0012] Connect the second private network and the fourth private network to obtain the network link.

[0013] Furthermore, the method also includes:

[0014] In response to the user's request to disconnect from the target cloud service, the connection between the third private network and the fourth private network is disconnected.

[0015] Detect whether there are other users in the second region besides the user who need to access any cloud service provided by the cloud service provider through the fourth private network;

[0016] If it does not exist, then delete the fourth private network.

[0017] Furthermore, connecting the third private network and the fourth private network includes:

[0018] In the fourth private network, a dedicated first terminal node service is created for the cloud service provider.

[0019] A first terminal node corresponding to the target cloud service is created in the third private network and associated with the first terminal node service.

[0020] Furthermore, connecting the second private network and the fourth private network includes:

[0021] A dedicated relay gateway is created and configured for the cloud service provider in the fourth private network. The relay gateway is used to forward the access request received by the first terminal node service to a preset access terminal in the second private network.

[0022] The access terminal is used to forward the access request received from the relay gateway to the first private network.

[0023] Furthermore, the method also includes:

[0024] Through peer-to-peer connections via private networks, the third private network, the fourth private network, the second private network, and the first private network are sequentially connected in the network layer.

[0025] Further, the access request is transmitted to the service instance corresponding to the target cloud service in the first private network via the network link, including:

[0026] The service domain name indicated in the access request is resolved into an access address pointing to the first terminal node, wherein the service domain name is predefined for the target cloud service;

[0027] The access address of the first terminal node is returned to the user instance that initiated the access request in the third private network, so as to trigger the user instance to send the access request to the first terminal node, where the first terminal node is the starting point of the network link.

[0028] Furthermore, other users besides the registered user need to access any cloud service provided by the cloud service provider through the fourth private network, including:

[0029] If it is detected that there is still a terminal node created for the target cloud service in the private network used by any user in the second region, then it is determined that there is a user in the second region who needs to access the target cloud service through the fourth private network.

[0030] Furthermore, the method also includes:

[0031] In response to a cross-regional publishing request for the target cloud service initiated by the cloud service provider, if it is detected that there is no dedicated private network created for the cloud service provider in the first region, then a second private network is created for the cloud service provider in the first region.

[0032] Connect the second private network to the service instance access point in the first private network.

[0033] Furthermore, connecting the second private network to the service instance access point in the first private network includes:

[0034] Create a second terminal node for the cloud service provider in the second private network;

[0035] In the first private network, a second terminal node service is created for the cloud service provider and associated with the second terminal node;

[0036] The second terminal node is associated with the service instance access point in the first private network, so as to connect the second private network to the service instance access point in the first private network at the transport layer;

[0037] The second terminal node is used to receive the access request forwarded by the fourth private network and forward the received access request to the second terminal node service.

[0038] Furthermore, associating the second terminal node with the service instance access point in the first private network includes:

[0039] Connect the second terminal node service to the load balancing component deployed by the cloud service provider in the first private network;

[0040] The second terminal node service is used to forward the received access request to the load balancing component, and the load balancing component is configured to forward the received access request to the service instance corresponding to the requested cloud service.

[0041] Furthermore, the description also includes:

[0042] Upon receiving the cross-regional publishing request, a service domain name is defined for the target cloud service;

[0043] The target cloud service is published according to the service domain name to support users in other regions outside the first region to initiate access requests for the target cloud service based on the service domain name.

[0044] This application also provides a cloud service management system, including a memory, a processor, and communication components;

[0045] The memory is used to store one or more computer instructions;

[0046] The processor is coupled to the memory and the communication component to execute one or more computer instructions for performing the aforementioned cloud service management method.

[0047] This application also provides a computer-readable storage medium for storing a computer program, which, when executed by one or more processors, causes the one or more processors to perform the aforementioned cloud service management method.

[0048] This application also provides a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to execute the aforementioned cloud service management method.

[0049] In this embodiment, the cloud service management system is improved to support cloud service providers in enabling cross-regional access. In this mode, the cloud service provider can deploy service instances of its cloud services in a first private network within a first region. The cloud service management system can then create a dedicated second private network for the cloud service provider in the first region. This second private network connects to the service instance access point in the first private network. Based on this, if a user in the second region wishes to access a target cloud service provided by the cloud service provider, the cloud service management system can create a dedicated fourth private network for the cloud service provider in the second region. Based on the user's third private network, the fourth private network, the second private network, and the first private network, a network link is constructed connecting the user to the service instance corresponding to the target cloud service in the first private network. The user's access request for the target cloud service can then be transmitted to the first private network through this network link, thereby enabling access to the desired target cloud service. Accordingly, in this embodiment, the cloud service management system can create a second private network in the first region where the cloud service provider is located, serving as a cross-regional access entry point for the cloud service provider. Furthermore, based on user access requests, it can create a dedicated fourth private network in other regions as needed, serving as a cross-regional access exit point for the user. This allows users in regions outside the cloud service provider's location to access any service offered by the cloud service provider across regions. This enables cloud service providers to flexibly expand and shrink their service areas, eliminating the need for them to deploy services across multiple regions, thus effectively saving service costs. Attached Figure Description

[0050] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0051] Figure 1 A flowchart illustrating a cloud service management method provided as an exemplary embodiment of this application;

[0052] Figure 2 A logical diagram illustrating a cloud service management method provided for an exemplary embodiment of this application;

[0053] Figure 3 A logical schematic diagram of an optional implementation scheme of a cloud service management method provided for an exemplary embodiment of this application;

[0054] Figure 4 A schematic diagram illustrating an application scenario provided for an exemplary embodiment of this application;

[0055] Figure 5This is a schematic diagram of the structure of a cloud service management system provided as another exemplary embodiment of this application. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] Before proceeding with a detailed description of the technical solutions provided in the various embodiments of this application, the following is a brief explanation of several technical concepts involved in this application.

[0058] Cloud services are a delivery model for computing resources and applications provided over the internet. It encompasses various types of computing services, including storage, analytics, computing, applications, and software development.

[0059] A cloud service provider is responsible for maintaining remote data centers and providing cloud services to users via the Internet.

[0060] A cloud service management system is a service management system open to both cloud service providers and users. Based on this system, cloud service providers can better deploy, deliver, and manage cloud services in the cloud, while users can centrally manage the various cloud services they subscribe to. The cloud service management system is provided by cloud resource providers, who are responsible for the various hardware and software resources required for cloud computing. Cloud services are deployed on the cloud resources provided by these providers. Cloud resources may include, but are not limited to, computing and storage resources; further examples are not provided here.

[0061] A private network, also known as a virtual private cloud (VPC), is a logically isolated virtual network environment built for cloud resources such as cloud servers, cloud containers, and cloud databases. It is configured and managed by the user and aims to improve the security of resources and simplify network deployment.

[0062] A region refers to a geographical area allocated by a cloud resource provider globally. The internal networks of different regions are completely isolated to ensure maximum stability and fault tolerance between them.

[0063] During their research, the inventors discovered that cloud service providers typically deploy their cloud services in private networks to ensure security. Furthermore, currently, cloud service deployment and access are region-specific; a deployed cloud service only supports access from users in its designated region, not from users in other regions. This forces cloud service providers to deploy the same cloud service across multiple regions, resulting in excessively high service costs.

[0064] Therefore, this application proposes a cloud service management scheme to support cross-regional access to cloud services.

[0065] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0066] Figure 1 This is a flowchart illustrating a cloud service management method provided as an exemplary embodiment of the present application. The method can be executed by a cloud service management system, which can be implemented as software, hardware, or a combination of software and hardware. The cloud service management system can be deployed on a single physical server or in a cloud computing cluster, and this embodiment does not limit it in this way.

[0067] In this embodiment, the cloud service management system has undergone functional improvements. As mentioned earlier, the cloud service management system in this embodiment is a service management system open to cloud service providers and users. The cloud service providers in this embodiment may include, but are not limited to, enterprise application service providers, IT integration service providers, delivery service providers, and management service providers, etc., without further examples. The cloud services provided by cloud service providers include, but are not limited to, database services, message queue services, caching services, etc., without specific examples of the types and names of cloud services. The users in this embodiment can be individual users or enterprise users, etc.

[0068] It is worth emphasizing that the cloud service management system in this embodiment is provided and maintained by the cloud resource provider. Since the cloud resource provider is the provider of the cloud resources required by the cloud service provider, it possesses global management authority and capabilities over the cloud resources, without being limited by region. Correspondingly, the cloud service management system in this embodiment has the ability to manage the various regions allocated by the cloud resource provider, without being limited by region. In practical applications, dedicated communication channels exist between different regions for the cloud service management system to use, supporting seamless management of different regions by the cloud service management system.

[0069] In this embodiment, the cloud service management system can adopt a publish-subscribe model for cloud service management. Cloud service providers can publish their developed cloud services on the cloud service management system, while users can subscribe to the cloud services they need through the cloud service management system.

[0070] As mentioned earlier, the deployment and access of cloud services are differentiated by region. For ease of description, the region where the cloud service provider is located will be described as Region 1, and the region where the user who needs to access any service provided by the cloud service provider is located will be described as Region 2.

[0071] Figure 2 This is a logical diagram illustrating a cloud service management method provided as an exemplary embodiment of this application. (Reference) Figure 2 Cloud service providers can deploy service instances of their cloud services in the first private network within the first region. This deployment can be understood as creating service instances for the cloud service within the first private network. A service instance refers to a specific running instance of a cloud service. A cloud service provider can deploy multiple service instances for a single cloud service. These service instances can be physical servers, virtual machines, or containers, etc. No specific limitations are placed on the implementation form of the service instance here.

[0072] In this embodiment, cloud service providers are supported in enabling cross-regional access mode, and cross-regional access can be enabled by cloud service providers on a per-cloud-service basis. To this end, in this embodiment, a cloud service provider can initiate a cross-regional publishing request for a target cloud service. Upon receiving this cross-regional publishing request, the cloud service management system can detect whether a dedicated private network created for the cloud service provider already exists in the first region. If it does not exist, the cloud service management system can create a dedicated second private network for the cloud service provider in the first region and connect the second private network to the service instance access portal in the first private network. Thus, referring to... Figure 2 In this embodiment, the second private network will serve as the cross-regional access point on the cloud service provider side.

[0073] Based on this, refer to Figure 1 The cloud service management method in this embodiment may include:

[0074] Step 100: In response to the user's access request for the target cloud service provided by the cloud service provider, determine the second region where the user is located, wherein the access request is initiated from the third private network used by the user in the second region;

[0075] Step 101: If the first region and the second region are different and there is no private network dedicated to the cloud service provider in the second region, then create a fourth private network dedicated to the cloud service provider in the second region.

[0076] Step 102: Based on the third private network, the fourth private network, the second private network, and the first private network, construct a network link for the user to connect to the service instance corresponding to the target cloud service in the first private network;

[0077] Step 103: Through this network link, the access request is transmitted to the service instance corresponding to the target cloud service in the first private network so that the user can access the target cloud service.

[0078] For ease of description, this embodiment will explain the cloud service management scheme from the perspective of a user in the second region. It should be understood that the second region can be any region, and the user can be any user in the second region.

[0079] refer to Figure 2 The user is located in the second region. The user instance corresponding to this user is typically deployed on a private network. Based on this, refer to... Figure 2 The user instance corresponding to this user is deployed in a third private network within the second region. A user instance is a type of cloud instance, a computing resource provided by a cloud resource provider to a user. It has an independent operating system, computing power, and storage space. Users can create user instances to run their own applications. Applications running within a user instance can initiate access requests for required cloud services on demand to utilize those services.

[0080] For ease of description, this embodiment will use the target cloud service provided by a cloud service provider as an example to illustrate the technical solution. It should be understood that the cloud service provider can be any cloud service provider, and the target cloud service can be any cloud service provided by the cloud service provider.

[0081] refer to Figure 1 In step 100, the user can initiate an access request for the target cloud service. In practical applications, the user can select their region and configure the information of their private network on the user access page provided by the cloud service management system to initiate an access request for the target cloud service. Furthermore, this access request is typically initiated from the third private network used by the user within the second region. That is, the access request is initiated by the user instance within the third private network. After receiving the access request, the cloud service management system can first determine the user's region, which is the second region.

[0082] Continue to refer to Figure 1 In step 101, the cloud service management system can detect whether the first region and the second region are the same. If they are different, it can continue to monitor whether there is a private network dedicated to the cloud service provider in the second region. If not, it can create a fourth private network dedicated to the cloud service provider in the second region.

[0083] refer to Figure 2In this embodiment, if the first region and the second region are different, the user needs to cross regions to access the target cloud service. In this case, the cloud service management system will continue to check whether the second region has been prepared for cross-regional access to the cloud service provider, that is, whether a dedicated private network has been created for the cloud service provider. If it has not been created, it indicates that the user is the first user in the second region to initiate an access request for the cloud service provided by the cloud service provider, and the cloud service management system can create a dedicated fourth private network for the cloud service provider in the second region.

[0084] In this embodiment, the fourth private network will serve as the cross-regional access exit on the user side. It is worth noting that in this embodiment, multiple users in the second region may need to access the cloud services provided by the cloud service provider. These users can share the fourth private network, all using it as the cross-regional access exit for the cloud service provider. Furthermore, in the second region, different dedicated private networks can be deployed for different cloud service providers to provide separate cross-regional access exits for each service provider.

[0085] Following on from the previous section, a second private network has already been deployed in the first region, serving as a cross-regional access point for the cloud service provider. Based on this, in this embodiment, in step 102, the cloud service management system can construct a network link for the user to the service instance corresponding to the target cloud service in the first private network, based on the third private network, the fourth private network, the second private network, and the first private network.

[0086] In addition, in this embodiment, when the cloud service management system creates the second private network and the fourth private network for the cloud service provider, it can set non-overlapping address ranges in the second private network and the fourth private network to avoid communication failures caused by address range duplication during cross-regional communication.

[0087] refer to Figure 1 and Figure 2 In step 102 at Zhennanguan, the cloud service management platform can connect to the second and fourth private networks, thus connecting the cross-regional access gateway and cross-regional access exit designed for the cloud service provider. In step 102, the cloud service management system can also connect to the third and fourth private networks. This allows the user's private network to connect to the cross-regional access exit corresponding to the cloud service provider.

[0088] Thus, in this embodiment, the cloud service management system can sequentially connect the third private network, the fourth private network, and the second private network, and add the service instance access point in the first private network that is already connected to the second private network, thereby constructing a network link for the user that can connect to the service instance in the first private network corresponding to the target cloud service.

[0089] refer to Figure 1 and Figure 2 The cloud service management system can use this network link to forward the user's access request to the first private network, thereby enabling the user to access the target cloud service. (Reference) Figure 2 The access request arrives in the first private network and can be specifically passed to the service instance corresponding to the target cloud service in the first private network. The service instance can respond to the access request to complete the service access. Based on this, the user can use the target cloud service across regions.

[0090] At this point, the cloud service management system has completed a regional expansion for the cloud service provider. The cloud service provider does not need to deploy the target cloud service to the second region. Users in the second region can access the target cloud service across regions through the dedicated fourth private network created for the cloud service provider in this embodiment. Similarly, in this embodiment, the cloud service management system can also perform more regional expansions for the cloud service provider as needed, thereby enabling the cloud service provider to flexibly expand the regions it supports.

[0091] In addition, in this embodiment, the user can also initiate a disconnection request for the target cloud service that has already been accessed. Upon receiving the disconnection request, the cloud service management system can disconnect the connection between the third private network and the fourth private network. The cloud service management system can also detect whether there are other users in the second area besides the aforementioned user who need to access any cloud service provided by the cloud service provider through the fourth private network. If they no longer exist, the fourth private network can be deleted.

[0092] As can be seen, in this embodiment, dedicated private networks can be created or deleted for cloud service providers as needed in the second region. Creation allows for regional expansion, while deletion allows for regional reduction. In other words, in this embodiment, the cloud service management system can flexibly expand and shrink the service area for cloud service providers.

[0093] In summary, this embodiment improves the cloud service management system by supporting cloud service providers to enable cross-regional access. In this mode, the cloud service provider can deploy service instances of its cloud services within a first private network in a first region. The cloud service management system can then create a dedicated second private network for the cloud service provider in the first region. This second private network connects to the service instance access point in the first private network. Based on this, if a user in the second region wishes to access a target cloud service provided by the cloud service provider, the cloud service management system can create a dedicated fourth private network for the cloud service provider in the second region. Based on the user's third private network, the fourth private network, the second private network, and the first private network, a network link is constructed connecting the user to the service instance corresponding to the target cloud service in the first private network. The user's access request for the target cloud service can then be transmitted to the first private network through this network link, thereby enabling access to the desired target cloud service. Accordingly, in this embodiment, the cloud service management system can create a second private network in the first region where the cloud service provider is located, serving as a cross-regional access entry point for the cloud service provider. Furthermore, based on user access requests, it can create a dedicated fourth private network in other regions as needed, serving as a cross-regional access exit point for the user. This allows users in regions outside the cloud service provider's location to access any service offered by the cloud service provider across regions. This enables cloud service providers to flexibly expand and shrink their service areas, eliminating the need for them to deploy services across multiple regions, thus effectively saving service costs.

[0094] In the above or following embodiments, various implementation methods can be used to connect the private networks. One optional implementation method is provided below. Figure 3 A logical diagram illustrating an optional implementation of a cloud service management method provided for an exemplary embodiment of this application.

[0095] First, let's introduce the connectivity scheme between the third and fourth private networks.

[0096] refer to Figure 3 In this optional implementation: the cloud service management system can create a dedicated first terminal node service for the cloud service provider in the fourth private network according to the private network connection technology; create a first terminal node corresponding to the target cloud service in the third private network and associate it with the first terminal node service, so as to connect the third private network and the fourth private network in the transport layer.

[0097] PrivateLink is a technology that establishes private network connections between endpoints and endpoint services, aiming to enable private network access to service resources between different Virtual Private Clouds (VPCs). Connections established through PrivateLink are private, avoiding the security risks that public network access may pose, and improving data transmission security. PrivateLink supports access control at the source IP range, individual user, and individual connection granularity, making access control between different private networks more secure and flexible.

[0098] This alternative implementation proposes using private network connectivity technology to achieve connectivity between the third and fourth private networks. (See reference) Figure 3 In this optional implementation, a first terminal node corresponding to the target cloud service is created in a third private network. A dedicated first terminal node service for the cloud service is created in a fourth private network. An association is established between the first terminal node and the first terminal node service, enabling connectivity between the third and fourth private networks at the transport layer.

[0099] It's worth noting that in the third private network, besides requesting cross-regional access to the target cloud service, the user can also request cross-regional access to other services provided by the same cloud service provider. For these other services, the cloud service management system also needs to create corresponding endpoints within the third private network. In other words, different endpoints need to be created within the third private network for each different cloud service requested by the user for cross-regional access. These endpoints serve as the starting point for cross-regional access. Therefore, within the third private network, the cross-regional access starting points for different cloud services will be different, and consequently, the network links formed for different cloud services will also be different. In other words, the formed network links are oriented towards a single user and a single service.

[0100] Continue to refer to Figure 3 The first terminal node service created in the fourth private network can be shared by users in the second region who need to access any cloud service provided by the cloud service provider across regions. That is, terminal nodes created by users in the second region for any cloud service provided by the cloud service provider can be associated with the first terminal node service. In this way, the first terminal node service can be associated with multiple terminal nodes in the second region, and these multiple terminal nodes are located in the private networks used by different users.

[0101] Accordingly, in this optional implementation, private network connection technology can be used to connect the third private network and the fourth private network at the transport layer. This ensures single-user, single-service, and unidirectional communication between the third and fourth private networks at the transport layer, thereby better guaranteeing the security of access requests during the transmission from the third private network to the fourth private network.

[0102] The following describes the connectivity scheme between the fourth private network and the second private network.

[0103] refer to Figure 3 In this optional implementation, it is proposed that the cloud service management system can create a dedicated relay gateway for the cloud service provider in the fourth private network; the relay gateway is configured to forward access requests received from the first terminal node service to a preset access terminal in the second private network, so as to connect the second private network and the fourth private network at the transport layer. The access terminal is used to forward access requests received from the relay gateway to the first private network.

[0104] Here, the relay gateway can be a network load balancer (NLB) or an application load balancer (ALB), etc. The relay gateway also operates at the transport layer, and the cloud service management system can configure routing information for it to ensure that the relay gateway can correctly forward access requests received from the user's private network.

[0105] For the user exemplified in this embodiment, the cloud service management system can configure the aforementioned first terminal node service in the fourth private network as the upstream node of the relay gateway; and configure the aforementioned pre-set access terminal in the second private network as the downstream node of the relay gateway. This allows the relay gateway to correctly forward the received access request to the access terminal in the second private network after receiving it from the first terminal node service.

[0106] Accordingly, in this optional implementation, by deploying a transit gateway in the fourth private network and configuring routing information on the transit gateway, the fourth private network and the second private network can be connected at the transport layer.

[0107] The following describes the connectivity scheme between the second private network and the first private network.

[0108] Continue to refer to Figure 3 In this optional implementation, it is also proposed that: after creating a dedicated second private network for the cloud service provider, the cloud service management system can create a second terminal node for the cloud service provider in the second private network according to the private network connection technology; create a second terminal node service for the cloud service provider in the first private network and associate it with the second terminal node to connect the first private network and the second private network in the transport layer; wherein, the second terminal node is used to receive access requests forwarded by the fourth private network and forward the received access requests to the second terminal node service, and the second terminal node service is connected to the service instance access entry in the first private network.

[0109] Here, the second terminal node created for the cloud service provider in the second private network can serve as the aforementioned access point. Following the relay gateway mentioned earlier, the cloud service management system can configure the relay gateway to forward access requests received from the first terminal node service to the second terminal node in the second private network.

[0110] Accordingly, in this optional implementation, private network connection technology can be used to connect the second private network and the first private network at the transport layer. This ensures single-user, single-service, and unidirectional communication between the second and first private networks at the transport layer, thereby better guaranteeing the security of access requests transmitted from the second private network to the first private network.

[0111] More preferably, the cloud service management system can also connect the aforementioned second terminal node service to a load balancing component deployed by the cloud service provider in the first private network. The cloud service management system can configure the second terminal node service to forward received access requests to the load balancing component, and the load balancing component can be configured to forward the received access requests to the service instance corresponding to the requested cloud service. Here, the load balancing component is the service instance access point in the first private network. Taking the target cloud service as an example, after receiving an access request for the target cloud service from another second terminal node in the second private network, the second terminal node can forward the access request to the load balancing component in the first private network, which can then forward the access request to the service instance corresponding to the target cloud service.

[0112] It is worth noting that other implementation methods can also be used in this embodiment to sequentially connect the private networks in the transport layer, and are not limited to the optional implementation methods described above. For example, in addition to using private network connection technology to achieve connectivity between the first and second private networks and between the third and fourth private networks in the transport layer, technologies such as Virtual Private Network Gateway (VPN gateway) can also be used to achieve connectivity. These will not be elaborated upon here, nor will further examples be provided.

[0113] Furthermore, the above description outlines the implementation method of sequentially connecting the third, fourth, second, and first private networks at the transport layer. This embodiment is not limited to the implementation method of sequentially connecting the third, fourth, second, and first private networks at the network layer. For example, Virtual Private Network (VPC) peering technology can be used to sequentially connect the third, fourth, second, and first private networks at the network layer. VPC peering is a network service that allows two private networks to establish a peer-to-peer relationship, enabling resource sharing and interoperability. Through VPC peering, VPCs in the same or different regions can communicate directly without going through the Internet or public networks, thereby improving the security and efficiency of data transmission. Of course, besides VPC peering technology, other implementation methods can also be used in this embodiment to sequentially connect the third, fourth, second, and first private networks at the network layer; these are not limited here, nor will further examples be provided.

[0114] In summary, the optional implementation provided in this embodiment can create a dedicated relay gateway for the cloud service provider in the fourth private network, and can combine private network connection technology to sequentially connect the third, fourth, second, and first private networks at the transport layer. The resulting network link is single-user, single-service, and unidirectional, effectively ensuring that user access requests for cross-regional cloud services are accurately transmitted to the private network where the cloud service resides. Furthermore, the endpoint of the network link uses a load balancing component within the private network where the cloud service resides. Thus, for the cloud service provider, it only needs to expose the load balancing component externally, without exposing the complete data plane, which effectively ensures the resource security in the first private network.

[0115] In the above or following embodiments, following the optional implementation of sequentially connecting the third private network, the fourth private network, the second private network and the first private network, a preferred design is provided to achieve regional reduction for cloud service providers.

[0116] In this preferred design, the cloud service management system can respond to a user's request to disconnect from the target cloud service by deleting the first terminal node corresponding to the target cloud service in the third private network, thereby disconnecting the connection between the third private network and the fourth private network.

[0117] As described in the preceding embodiments regarding this optional implementation: In the second region, the first terminal node service can be associated with multiple terminal nodes, which are located in private networks used by different users. Based on this one-to-many association structure: the cloud service management system can detect whether there are any terminal nodes created for the target cloud service in the private networks used by any user in the second region. If so, it can be determined that there are users in the second region who need to access the target cloud service through the fourth private network.

[0118] Thus, in this embodiment, within the second region, this one-to-many association structure allows for a convenient and quick determination of whether the fourth private network (or the first terminal node service) is no longer needed, enabling the timely deletion of the fourth private network and the release of cloud resources it occupies. This makes the reduction of service areas more efficient and convenient.

[0119] In the above or below embodiments, various implementation methods can be used to transmit the user's access request for the target cloud service to the first private network through the aforementioned network link. The following provides an optional implementation method.

[0120] In this optional implementation: the cloud service management system can customize the service domain names for each cloud service that needs cross-regional access. Taking the target cloud service as an example again, after receiving a cross-regional publishing request for the target cloud service, the cloud service management system can define a service domain name for the target cloud service; and publish the target cloud service according to the service domain name to support users in other regions outside the first region to initiate access requests for the target cloud service based on the service domain name.

[0121] Based on this, users in regions other than the first region can indicate the service domain name of the target cloud service in the user access interface provided by the cloud service management system, and as mentioned above, select their own region and configure the information of their private network to initiate an access request for the target cloud service.

[0122] refer to Figure 3 In this optional implementation, a set of service domain names can be maintained for different users in the second region. The set of service domain names contains the service domain names corresponding to the various cloud services that the users need to access.

[0123] In this optional implementation: For the cloud service management system, after receiving the access request initiated by the user for the target cloud service, it can resolve the service domain name indicated in the access request to the access address of the first terminal node corresponding to the target cloud service in the first private network; and return the access address of the first terminal node to the user instance that initiated the access request in the third private network, so as to trigger the user instance to send the access request to the first terminal node, which is the starting point of the network link corresponding to the user.

[0124] The optional implementation method used to connect the third private network and the fourth private network in the aforementioned embodiments for the first terminal node can be referred to, and will not be explained again here.

[0125] In this optional implementation, the cloud service management system can record resolution rules for the customized service domain names. These rules record the relationship between the service domain name and the access address of the user's access point. The aforementioned first terminal node is an example of an access point. Furthermore, for the same service domain name, an access request initiated by a user will be resolved to point to the access point corresponding to that service domain name (i.e., the cloud service) within the user's private network. Therefore, for the same service domain name, access requests initiated by different users will be resolved to different access points. This more clearly demonstrates that in the second region, for access requests initiated by different users for the target cloud service, the resulting network links will be different due to the different access points.

[0126] The cloud service management system can return the access address of the parsed access starting point to the requesting end (such as the aforementioned user instance). In this way, the requesting end can pass the access request to the first private network along the network link established by the cloud service management system for the access request, specifically to the service instance in the first private network corresponding to the target cloud service.

[0127] Continuing with the network link created for the user in this embodiment, refer to... Figure 3 The transmission path of the access request sent by the user is roughly as follows: user instance in the third private network - first terminal node - first terminal node service - transit gateway in the fourth private network - second terminal node - second terminal node service - load balancing component in the first private network - service instance corresponding to the target cloud service.

[0128] Accordingly, in this embodiment, by customizing the service domain name and managing the pointing relationship between the service domain name and the access starting point of different users, different network links can be constructed for access requests initiated by different users for the target cloud service, ensuring the isolation of different access requests and thus ensuring the security of the cloud service.

[0129] Figure 4 This is a schematic diagram illustrating an application scenario provided by an exemplary embodiment of this application. The following will use... Figure 4 Taking the application scenario shown as an example, the cloud service management solution provided by the cloud service management system is explained from the perspective of the linkage process between the control plane and the data plane.

[0130] refer to Figure 4 The data plane of the cloud service management system carries users' daily access traffic and is built using standard network element products. The data plane of the cloud service management system may include the following components:

[0131] 1. Region: Figure 4 The diagram illustrates two exemplary regions: Region A and Region B. A cloud service provider deploys its cloud services in Region A, while a user who needs to access any service offered by that cloud service provider is located in Region B.

[0132] 2. Private network: Figure 4 Four VPCs are shown in the image;

[0133] o Provider VPC: This is the VPC of a cloud service provider, used to deploy cloud services;

[0134] oInterconnected VPC1: Interconnected VPC in Region A, used to establish a private network link to the provider's VPC on the cloud service provider side;

[0135] o Interconnected VPC2: Interconnected VPC in Region B, used to establish a private network link to Interconnected VPC1 on the user side;

[0136] o User VPC: Used to create user computing resources (such as ECS user instances), deploy user applications, and establish a private network link with interconnected VPC1.

[0137] 3. Private network connectivity:

[0138] o Private Network Peering: Used to establish cross-regional networks between multiple interconnected VPCs at the network layer.

[0139] PrivateLink: Used at the transport layer to connect a user's VPC and an interconnected VPC2, where end nodes are created in the user's VPC and end node services are provided in the interconnected VPC2; Also used at the transport layer to connect interconnected VPC1 and a provider's VPC, where end nodes are created in interconnected VPC1 and end node services are distributed on demand across provider VPCs.

[0140] 4. Network Load Balancing Gateway (NLB):

[0141] NLB serves as a Layer 4 service forwarding resource, configured upstream as a service for terminal nodes in Interconnected VPC2, and configured downstream as a service resource for terminal nodes in Interconnected VPC1.

[0142] 5. PrivateZone, a collection of private network service domain names:

[0143] The cloud service management system defines a service domain name for each cloud service. The service domain name that a single user needs to access can be recorded in the set of private network service domain names corresponding to the user.

[0144] refer to Figure 4 The control plane of a cloud service management system may include the following components:

[0145] 1. Interconnect Plane: Used to build various network resources (interconnected VPCs and terminal nodes, etc.) on the data plane, establish cross-domain interconnection, and build network links for different users; expand or shrink regions for cloud service providers as needed.

[0146] 2. Service Publishing: Provides access interfaces and cross-domain publishing interfaces for cloud services; and provides configuration activation interfaces to apply the configurations of cloud service providers.

[0147] 3. Service Access: Provides a user access interface for creating network links from a user's VPC to interconnected VPCs in the same region in real time; and a service domain name binding interface for maintaining service domain name sets for different users.

[0148] The following describes the linkage process between the control plane and the data plane to illustrate two important flows:

[0149] Service area scaling: This section mainly describes how to manage link resources through the control plane to support on-demand scaling at the region level and minimize costs.

[0150] Cross-regional user access: This section mainly describes the detailed process of a user initiating an access request, passing through key link components, and accessing the cloud services provided by the cloud service provider.

[0151] Service area expansion and contraction process It can generally include:

[0152] Preliminary preparation can include the following three key sub-steps:

[0153] 1. Complete the creation of the provider's VPC and the deployment of services (i.e., create the relevant service instances) for cloud services, and provide the various cloud services of the cloud service provider to users in the form of end-node services.

[0154] 2. The cloud service provider has connected to the cloud service management system and can configure the above-mentioned terminal node service as managed multi-tenant resource information to register the terminal node service created in the previous step to the cloud service management system.

[0155] 3. Cloud service providers can enable cross-region access mode. Specifically, cross-region access mode can be enabled in the cloud service provider access interface. In this case, the cloud service management system can create an interconnected VPC1 in region A and create an endpoint in the interconnected VPC1, which is associated with the endpoint service created in step 1.

[0156] 4. Service Area Expansion: This step is triggered by a user-initiated access request. The key steps are as follows:

[0157] a. User VPC Selection: In the user access interface, users can select their region, provide information about their user VPC and the service domain name of the target cloud service they wish to access, in order to initiate an access request for the target cloud service.

[0158] b. Cross-region deployment: Through the cross-region deployment interface, the cloud service management system can monitor whether there are already cross-region deployment resources (i.e., interconnected VPCs dedicated to cloud service providers) in region B. If not, proceed to the next step.

[0159] c. Interconnected VPC Creation: Create a dedicated Interconnected VPC2 for this cloud service provider in Region B.

[0160] d. Create an NLB in the interconnected VPC2: Create an NLB in the created interconnected VPC2 and configure the backend service resources of the NLB to the endpoint nodes created in step 3.

[0161] e. Create an endpoint service in Interconnected VPC2: Configure the backend service resources of this endpoint service as NLB resources. Here, you can create and configure it under the cloud service provider account by role-playing the cloud service provider account.

[0162] f. Create an endpoint in the user's VPC and connect it to the endpoint service in the interconnected VPC2.

[0163] 5. Service Area Reduction: This step is triggered by a user initiating a disconnection request. The key steps are as follows:

[0164] a. The user initiates a disconnection request on the relevant page provided by the cloud service management system.

[0165] b. Region Reduction Judgment: Determine whether this user access is the only user in Region B who needs to access the provider's VPC. If so, the conditions for region reduction have been met, and proceed to the next step. The steps are similar to those for service region expansion, but executed in reverse order.

[0166] c. Delete the terminal node created under the user's VPC.

[0167] d. Delete the endpoint service within the interconnected VPC2 on the user side.

[0168] e. Within the interconnected VPC2 on the user side, delete NLB.

[0169] f. Delete the interconnected VPC2 on the user side.

[0170] At this point, the service area reduction is complete, and there are no longer any chargeable network resources, achieving zero cost.

[0171] User cross-regional access process It can generally include:

[0172] 1. Request Initiation: An access request to the target cloud service is initiated within the ECS instance of the user's VPC. This access request will be sent to the endpoint node in the user's VPC on the network link.

[0173] 2. Request forwarding: After receiving the access request, the endpoint in the user's VPC will automatically forward it to the endpoint service in the interconnected VPC2.

[0174] 3. Request Acceptance: After receiving the access request, the terminal node service forwards the access request to the configured backend service resource - NLB.

[0175] 4. Intelligent Scheduling: After receiving the access request, NLB uses the configured scheduling strategy algorithm, such as consistent hashing or round-robin scheduling, to schedule the access request to the terminal node in the configured backend service resource - Interconnected VPC2.

[0176] 5. Cross-regional transmission: Since the two interconnected VPCs are interconnected through VPC Peering cross-regional transmission technology, the access request from the previous step can be directly transmitted across regions to the terminal node in the interconnected VPC2.

[0177] 6. Traffic forwarding: Access requests arriving at the endpoints in the Interconnected VPC2 can be directly forwarded to the endpoint services in the provider's VPC.

[0178] 7. Request Acceptance: The terminal node service forwards the access request to the configured backend service resource - the load balancer (LB) of the cloud service provider.

[0179] 8. Request Scheduling: The load balancing component can schedule the access request to a specific service instance according to the scheduling algorithm.

[0180] 9. Service Response: Upon receiving the access request, the service instance can provide response data and, along the aforementioned network link path, reverse the flow to the user instance on the user side.

[0181] Based on the above description of the application scenarios, it can be seen that the cloud service management solution provided in this embodiment can produce at least the following technical effects:

[0182] • Simplified Deployment: Enables simplified deployment of cloud services, requiring only the construction of interconnected VPCs, endpoints, and endpoint services within the same region as the cloud service.

[0183] • Service area scaling: Cross-regional resources can be dynamically scaled up or down based on user distribution and service instance status, achieving on-demand regional elasticity, further saving costs, and eliminating the need to pre-create service resources (i.e., interconnected VPCs on the user side).

[0184] • Configurable and scalable: The link can be built directly based on stable network element products, and the configuration management capabilities of network element products can be directly applied, resulting in higher stability.

[0185] • Cross-region deployment: Supports the ability to dynamically deploy services across all regions, greatly simplifying the threshold for users to access cloud services across regions.

[0186] • Cost advantage: Using the cross-regional publishing-access model can replace public network cross-regional access, achieving a cost reduction of at least 25%.

[0187] It should be noted that some processes described in the above embodiments and accompanying drawings include multiple operations appearing in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear in this document, or they may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should also be noted that the descriptions such as "first" and "second" in this document are used to distinguish different regions and private networks, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0188] Figure 5 This is a schematic diagram of the structure of a cloud service management system provided as another exemplary embodiment of this application. For example... Figure 5 As shown, the cloud service management system may include a memory 50 and a processor 51. The processor 51 is coupled to the memory 50 and is used to execute computer programs stored in the memory 50.

[0189] The cloud service instances provided by the cloud service provider are deployed in a first private network within a first region. A second private network dedicated to the cloud service provider is also deployed within the first region, and the second private network connects to the service instance access point of the first private network. Based on this, the processor 51 can be used for:

[0190] In response to a user initiating an access request for a target cloud service provided by the cloud service provider, the second region where the user is located is determined, wherein the access request is initiated from a third private network used by the user in the second region;

[0191] If the first region and the second region are detected to be different and there is no private network dedicated to the cloud service provider in the second region, then a fourth private network dedicated to the cloud service provider is created in the second region.

[0192] Based on the third private network, the fourth private network, the second private network, and the first private network, a network link is constructed for the user to connect to the service instance corresponding to the target cloud service in the first private network;

[0193] The access request is transmitted to the service instance corresponding to the target cloud service in the first private network through the network link, so that the user can access the target cloud service.

[0194] In an optional embodiment, when the processor 51 constructs a network link for the user to the service instance corresponding to the target cloud service in the first private network based on the third private network, the fourth private network, the second private network, and the first private network, it can be specifically used for:

[0195] Connecting the third and fourth private networks;

[0196] Connect the second and fourth private networks to build a network link for the user to the service instance corresponding to the target cloud service in the first private network.

[0197] In an alternative embodiment, processor 51 may also be used for:

[0198] In response to the user's request to disconnect from the target cloud service, the connection between the third private network and the fourth private network is disconnected.

[0199] Detect whether there are other users in the second region besides the user who need to access any cloud service provided by the cloud service provider through the fourth private network;

[0200] If it does not exist, then delete the fourth private network.

[0201] In an optional embodiment, when the processor 51 is connected to the third private network and the fourth private network, it can be used to:

[0202] In the fourth private network, a dedicated first terminal node service is created for the cloud service provider.

[0203] A first terminal node corresponding to the target cloud service is created in the third private network and associated with the first terminal node service to connect the third private network and the fourth private network in the transport layer.

[0204] In an optional embodiment, when the processor 51 is connecting the second private network and the fourth private network, it can be used to:

[0205] A dedicated relay gateway is created and configured for the cloud service provider in the fourth private network. The relay gateway is used to forward the access request received by the first terminal node service to a preset access terminal in the second private network, so as to connect the second private network and the fourth private network in the transport layer.

[0206] The access terminal is used to forward the access request received from the relay gateway to the first private network.

[0207] In an alternative embodiment, processor 51 may also be used for:

[0208] Through peer-to-peer connections in private networks, the third private network, the fourth private network, the second private network, and the first private network are sequentially connected in the network layer.

[0209] In an alternative embodiment, processor 51 may also be used for:

[0210] Upon receiving the access request, the service domain name indicated in the access request is resolved into an access address pointing to the first terminal node. The service domain name is pre-defined for the target cloud service.

[0211] The access address of the first terminal node is returned to the user instance that initiated the access request in the third private network, so as to trigger the user instance to send the access request to the first terminal node.

[0212] In an optional embodiment, when the processor 51 detects whether there are other users besides the user in the second area who need to access any cloud service provided by the cloud service provider through the fourth private network, it may specifically be used to:

[0213] If it is detected that there is still a terminal node created for the target cloud service in the private network used by any user in the second region, then it is determined that there is a user in the second region who needs to access the target cloud service through the fourth private network.

[0214] In an alternative embodiment, processor 51 may also be used for:

[0215] In response to a cross-regional publishing request for the target cloud service initiated by the cloud service provider, if it is detected that there is no dedicated private network created for the cloud service provider in the first region, then a second private network is created for the cloud service provider in the first region.

[0216] Connect the second private network to the service instance access point in the first private network.

[0217] In an optional embodiment, when the processor 51 connects the second private network to the service instance access point in the first private network, it can be used to:

[0218] Create a second terminal node for the cloud service provider in the second private network;

[0219] In the first private network, a second terminal node service is created for the cloud service provider and associated with the second terminal node;

[0220] The second terminal node is associated with the service instance access point in the first private network, so as to connect the second private network to the service instance access point in the first private network at the transport layer.

[0221] The second terminal node is used to receive the access request forwarded by the fourth private network and forward the received access request to the second terminal node service.

[0222] In an optional embodiment, when the processor 51 associates the second terminal node with the service instance access point in the first private network, it may specifically be used to:

[0223] Connect the second terminal node service to the load balancing component deployed by the cloud service provider in the first private network;

[0224] The second terminal node service is used to forward the received access request to the load balancing component, and the load balancing component is configured to forward the received access request to the service instance corresponding to the requested cloud service.

[0225] In an alternative embodiment, processor 51 may also be used for:

[0226] Upon receiving the cross-regional publishing request, a service domain name is defined for the target cloud service;

[0227] The target cloud service is published according to the service domain name to support users in other regions outside the first region to initiate access requests for the target cloud service based on the service domain name.

[0228] In one alternative embodiment, different users in the second region share the fourth private network; in the second region, different network links are formed for access requests initiated by different users for the target cloud service.

[0229] Furthermore, such as Figure 5 As shown, the cloud service management system may also include other components such as communication component 52 and power component 53. Figure 5 The diagram only shows a portion of the components and does not imply that the cloud service management system only includes... Figure 5 The components shown.

[0230] It is worth noting that the technical details of the above-mentioned embodiments of the cloud service management system can be referred to the relevant descriptions in the foregoing method embodiments. To save space, they will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0231] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed, can implement the steps in the above method embodiments.

[0232] Accordingly, this application also provides a computer program product, which, when executed, can implement the steps in the above method embodiments.

[0233] The above Figure 5 The memory in a computer system is used to store computer programs and can be configured to store various other data to support operation on the computing system. Examples of this data include instructions for any application or method used to operate on the computing system, contact data, phone book data, messages, pictures, videos, etc. The memory can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disks, or optical disks.

[0234] The above Figure 5The communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA) technology, Ultra-Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0235] The above Figure 5 The power supply component provides power to the various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0236] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0237] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0238] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0239] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0240] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0241] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0242] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A cloud service management and control method, characterized in that, Applicable to a cloud service management system, the service instances of cloud services provided by a cloud service provider are deployed in a first private network within a first region. A second private network dedicated to the cloud service provider is also deployed within the first region, and the second private network is connected to the service instance access point in the first private network. The method includes: In response to a user initiating an access request for a target cloud service provided by the cloud service provider, the second region where the user is located is determined, wherein the access request is initiated from a third private network used by the user in the second region; If the first region and the second region are different and there is no private network dedicated to the cloud service provider in the second region, then a fourth private network dedicated to the cloud service provider is created in the second region. Based on the third private network, the fourth private network, the second private network, and the first private network, a network link is constructed for the user to connect to the service instance corresponding to the target cloud service in the first private network; The access request is transmitted to the service instance corresponding to the target cloud service in the first private network through the network link, so that the user can access the target cloud service.

2. The method according to claim 1, characterized in that, Based on the third private network, the fourth private network, the second private network, and the first private network, a network link is constructed for the user to connect to the service instance corresponding to the target cloud service in the first private network, including: Connect the third private network and the fourth private network; Connect the second private network and the third private network to construct a network link for the user to the service instance in the first private network corresponding to the target cloud service.

3. The method according to claim 1 or 2, characterized in that, Also includes: In response to the user's request to disconnect from the target cloud service, the connection between the third private network and the fourth private network is disconnected. Detect whether there are other users in the second region besides the user who need to access any cloud service provided by the cloud service provider through the fourth private network; If it does not exist, then delete the fourth private network.

4. The method according to claim 3, characterized in that, Connecting the third private network and the fourth private network includes: In the fourth private network, a dedicated first terminal node service is created for the cloud service provider. A first terminal node corresponding to the target cloud service is created in the third private network and associated with the first terminal node service.

5. The method according to claim 4, characterized in that, Connecting the second private network and the fourth private network includes: A dedicated relay gateway is created and configured for the cloud service provider in the fourth private network. The relay gateway is used to forward the access request received by the first terminal node service to a preset access terminal in the second private network. The access terminal is used to forward the access request received from the relay gateway to the first private network.

6. The method according to claim 1, characterized in that, Also includes: Through peer-to-peer connections via private networks, the third private network, the fourth private network, the second private network, and the first private network are sequentially connected in the network layer.

7. The method according to claim 4, characterized in that, The method further includes: The service domain name indicated in the access request is resolved into an access address pointing to the first terminal node, wherein the service domain name is pre-defined for the target cloud service; The access address of the first terminal node is returned to the user instance that initiated the access request in the third private network, so as to trigger the user instance to send the access request to the first terminal node, where the first terminal node is the starting point of the network link.

8. The method according to claim 4, characterized in that, Detecting whether there are other users in the second region besides the stated user who need to access any cloud service provided by the cloud service provider through the fourth private network includes: If it is detected that any user in the second region still has a terminal node created for the target cloud service in their private network, then it is determined that there is a user in the second region who needs to access the target cloud service through the fourth private network.

9. The method according to claim 1, characterized in that, Also includes: In response to a cross-regional publishing request for the target cloud service initiated by the cloud service provider, if it is detected that there is no dedicated private network created for the cloud service provider in the first region, then a second private network is created for the cloud service provider in the first region. Connect the second private network to the service instance access point in the first private network.

10. The method according to claim 9, characterized in that, Connecting the second private network to the service instance access point in the first private network includes: Create a second terminal node for the cloud service provider in the second private network; In the first private network, a second terminal node service is created for the cloud service provider and associated with the second terminal node; The second terminal node is associated with the service instance access point in the first private network, so as to connect the second private network to the service instance access point in the first private network at the transport layer; The second terminal node is used to receive the access request forwarded by the fourth private network and forward the received access request to the second terminal node service.

11. The method according to claim 10, characterized in that, Associating the second terminal node with the service instance access point in the first private network includes: Connect the second terminal node service to the load balancing component deployed by the cloud service provider in the first private network; The second terminal node service is used to forward the received access request to the load balancing component, and the load balancing component is configured to forward the received access request to the service instance corresponding to the requested cloud service.

12. The method according to claim 9, characterized in that, Also includes: Upon receiving the cross-regional publishing request, a service domain name is defined for the target cloud service; The target cloud service is published according to the service domain name to support users in other regions outside the first region to initiate access requests for the target cloud service based on the service domain name.

13. A cloud service management and control system, characterized in that, Includes memory, processor, and communication components; The memory is used to store one or more computer instructions; The processor is coupled to the memory and the communication component to execute one or more computer instructions for performing the cloud service management method according to any one of claims 1-12.

14. A computer-readable storage medium for storing a computer program, characterized in that, When the computer program is executed by one or more processors, the one or more processors perform the cloud service management method according to any one of claims 1-12.

15. A computer program product, characterized in that, The method includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the cloud service management method according to any one of claims 1-12.

Images