Virtual private cloud access method and system, readable storage medium and program

Abstract

The embodiment of the invention provides a virtual private cloud access method and system, a readable storage medium and a program. The virtual private cloud access system comprises an ECI provided with an ECI router and a computing power cluster, the ECI router comprises a flow management router and a first switch on the ECI, and an ECI gateway is arranged on a virtual machine of the computing power cluster and comprises a flow management gateway and a second switch. The traffic management router sets a target address of a data packet as a virtual address of the ECI gateway, and sends the data packet to the ECI gateway through the first switch according to the virtual address, the ECI gateway analyzes the data packet to obtain an inner-layer source address and an outer-layer source address, and when the two addresses are consistent, the traffic management router sends the data packet to the ECI gateway. And sending the data packet to the virtual private cloud of the tenant through the second switch. The source address verification is realized, and the data packet with the successfully verified source address is forwarded to the private cloud of the tenant, so that the legality of the source address can be effectively ensured, and the data security is improved.

Description

Technical Field

[0001] This application relates to the field of cloud-native technology, and in particular to a virtual private cloud access method, system, readable storage medium, and program. Background Technology

[0002] With the widespread adoption of cloud-native technologies, enterprises can deploy platforms and applications through containerized cluster management to provide unified computing resources for multiple tenants. Typically, multi-tenant computing resources are hosted by elastic bare metal and secure containers. When the expansion of elastic bare metal computing resources is limited or GPU computing power is required, ECI (Elastic Container Instance) instances are dynamically created to provide computing resources.

[0003] In the existing technology, when a tenant's ECI needs to access the tenant's VPC (Virtual Private Cloud) resources, the ECI first sends the data packet to the VPCGW (VPCGateway), and the VPCGW forwards the data packet to the corresponding tenant's VPC resources.

[0004] However, the above-mentioned solution has the problem of poor security. Summary of the Invention

[0005] The purpose of this application is to provide a virtual private cloud access method, system, readable storage medium, and program to solve the problem of poor security. The specific technical solution is as follows: In a first aspect of this application, a Virtual Private Cloud (VPC) access method is provided, applied to a VPC access system. The VPC access system includes: Elastic Container Instances (ECIs) and a computing power cluster. An ECI router is configured on the ECI, and the ECI router includes two containerized services: a traffic management router and a first switch. The computing power cluster includes virtual machines, and an ECI gateway is configured on the virtual machines. The ECI gateway includes two containerized services: a traffic management gateway and a second switch. The method includes: The traffic management router sets the destination address of the data packet to be sent to the virtual address of the ECI gateway, and sends the data packet to the ECI gateway through the first switch according to the virtual address; the ECI gateway parses the data packet to obtain the inner source address and the outer source address; when the inner source address and the outer source address are consistent, the traffic management gateway sends the data packet to the tenant's virtual private cloud through the second switch.

[0006] Optionally, it also includes: When the ECI is created, the traffic management router receives environment variables sent by the ECI gateway and extracts the virtual address of the ECI gateway from the environment variables. Different ECI gateways in the computing power cluster share the virtual address.

[0007] Optionally, it also includes: When the traffic management router starts up, it creates a bridge on the first switch and deletes the network address on the lightweight virtual machine where the ECI resides; it adds the network address of the network card on the lightweight virtual machine to the bridge and configures the network address of the lightweight virtual machine on the bridge to start the bridge; it then sends the data packet to the ECI gateway through the first switch according to the virtual address, including: The bridge sends the data packet to the ECI gateway according to the virtual address.

[0008] Optionally, before sending the data packet to the ECI gateway via the first switch according to the virtual address, the method further includes: The traffic management router sets the access traffic for the virtual private cloud corresponding to the ECI; the traffic management router sends the data packets to the first switch according to the access traffic.

[0009] Optionally, it also includes: When the traffic management gateway receives container group information, it extracts the virtual private cloud address and virtual network interface accessed by the container group from the annotations in the container group information; the traffic management gateway sends the virtual private cloud address and virtual network interface to the serverless computing gateway; the traffic management gateway then sends the data packet to the tenant's virtual private cloud through the second switch, including: The traffic management gateway sends the data packet to the serverless computing gateway through the second switch; the serverless computing gateway sends the data packet to the tenant's virtual private cloud via the virtual private cloud gateway through the virtual private cloud address and virtual network interface.

[0010] Optionally, the computing cluster includes at least two virtual machines, each equipped with an ECI gateway, and the method further includes: When the standby ECI gateway does not receive a keep-alive message from the primary ECI gateway, it performs a switchover between the primary and standby ECI gateways, including: enabling the standby ECI gateway and disabling the primary ECI gateway.

[0011] Optionally, it also includes: When the primary ECI gateway receives data traffic greater than or equal to a preset traffic threshold, it activates a backup ECI gateway based on the data traffic. The performance parameters of the activated backup ECI gateway and / or the number of activated backup ECI gateways are positively correlated with the data traffic. When the primary ECI gateway receives data traffic less than the preset traffic threshold, it deactivates the primary ECI gateway based on the data traffic. The performance parameters of the deactivated primary ECI gateway and / or the number of deactivated primary ECI gateways are negatively correlated with the data traffic.

[0012] In a second aspect of this application, a Virtual Private Cloud (VPC) access system is also provided, comprising: an Elastic Container Instance (ECI) and a computing power cluster. An ECI router is configured on the ECI, and the ECI router includes two containerized services: a traffic management router and a first switch. The computing power cluster includes virtual machines, and an ECI gateway is configured on the virtual machines. The ECI gateway includes two containerized services: a traffic management gateway and a second switch. The traffic management router is configured to: set the destination address of a data packet to be sent to the virtual address of the ECI gateway, and send the data packet to the first switch. The first switch is configured to: send the data packet to the ECI gateway according to the virtual address. The ECI gateway is configured to: parse the data packet to obtain an inner source address and an outer source address. The traffic management gateway is configured to: when the inner source address and the outer source address are consistent, send the data packet to the second switch. The second switch is configured to: send the data packet to the tenant's VPC.

[0013] Optionally, the traffic management router is further configured to: When the ECI is created, the system receives environment variables sent by the ECI gateway and extracts the virtual address of the ECI gateway from the environment variables. Different ECI gateways in the computing power cluster share the virtual address.

[0014] Optionally, the traffic management router is further configured to: When the traffic management router starts up, it creates a bridge on the first switch and deletes the network address on the lightweight virtual machine where the ECI is located; it adds the network address of the network card on the lightweight virtual machine to the bridge and configures the network address of the lightweight virtual machine on the bridge to start the bridge; the bridge is also used to send the data packet to the ECI gateway according to the virtual address.

[0015] Optionally, the traffic management router is further configured to: Configure the access traffic for the virtual private cloud corresponding to the ECI; send the data packet to the first switch according to the access traffic.

[0016] Optionally, the traffic management gateway is further configured to: Upon receiving container group information, the virtual private cloud address and virtual network interface accessed by the container group are extracted from the annotations of the container group information; the virtual private cloud address and virtual network interface are sent to the serverless computing gateway; the data packet is sent to the serverless computing gateway through the second switch; the serverless computing gateway is further configured to: send the data packet to the tenant's virtual private cloud via the virtual private cloud gateway through the virtual private cloud address and virtual network interface.

[0017] Optionally, the computing power cluster includes at least two virtual machines each equipped with an ECI gateway. The backup ECI gateway is used to perform a switch between the primary and backup ECI gateways when no keep-alive message is received from the primary ECI gateway, including enabling the backup ECI gateway and disabling the primary ECI gateway.

[0018] Optionally, the primary ECI gateway is also used for: When the received data traffic is greater than or equal to a preset traffic threshold, a backup ECI gateway is activated based on the data traffic. The performance parameters of the activated backup ECI gateway and / or the number of activated backup ECI gateways are positively correlated with the data traffic. When the received data traffic is less than the preset traffic threshold, the primary ECI gateway is deactivated based on the data traffic. The performance parameters of the deactivated primary ECI gateway and / or the number of deactivated primary ECI gateways are negatively correlated with the data traffic.

[0019] In a third aspect of this application, a computer-readable storage medium is also provided, wherein instructions are stored therein, which, when executed on a computer, cause the computer to perform the method described in the first aspect.

[0020] In a fourth aspect of this application, a computer program product comprising instructions is also provided, which, when run on a computer, causes the computer to perform the method described in the first aspect above.

[0021] The Virtual Private Cloud (VPN) access method, system, readable storage medium, and program provided in this application include a VPN access system comprising an ECI (Elastic Compute Service) and a computing cluster. The ECI is equipped with an ECI router, which includes two containerized services: a traffic management router and a first switch. The computing cluster includes virtual machines, each equipped with an ECI gateway. The ECI gateway also includes two containerized services: a traffic management gateway and a second switch. The traffic management router sets the destination address of the data packet to be sent to the virtual address of the ECI gateway and sends the data packet to the ECI gateway via the first switch according to the virtual address. The ECI gateway parses the data packet to obtain the inner and outer source addresses. If the inner and outer source addresses match, the traffic management gateway sends the data packet to the tenant's VPN via the second switch. This verifies the source address and forwards successfully verified data packets to the tenant's VPN. This effectively ensures the legitimacy of the source address and improves data security. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0023] Figure 1 This is a schematic diagram of the structure of a private cloud access system according to an embodiment of this application; Figure 2 This is a flowchart illustrating the steps of a virtual private cloud access method in an embodiment of this application; Figure 3 This is a flowchart illustrating the steps of another virtual private cloud access method in this application embodiment. Detailed Implementation

[0024] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] This application's embodiments are applied to multi-tenant network communication scenarios implemented using cloud-native technologies. Multi-tenant network communication provides logically isolated dedicated network environments for multiple independent tenants by sharing network resources, with the computing resources of these tenants provided by a computing cluster. The computing cluster needs to access the VPC resources of each tenant, such as object storage, file storage, MySQL, Redis, cloud servers, Kafka, etc., meaning the computing cluster needs to implement cross-tenant network communication. Here, the computing cluster can be a Kubernetes cluster.

[0026] The aforementioned computing resources are hosted on elastic bare metal and secure containers. However, when computing resources are scarce, the expansion cycle for elastic bare metal is relatively long; specifically, from purchase to initialization and joining the computing cluster, it takes at least 15 minutes. Especially when the elastic bare metal resource pool is insufficient, cross-datacenter allocation is required, further extending the expansion cycle. Furthermore, when providing AI (Artificial Intelligence) digital session services, elastic bare metal with GPU (Graphics Processing Unit) computing power is required, which is costly.

[0027] In scenarios with limited computing resources or requiring GPU computing power, ECIs can be dynamically created to quickly meet user computing demands. However, ECIs run as runc containers within lightweight virtual machines. When not running in a secure container environment, there is a risk of escape from the container into the lightweight virtual machine. If a malicious user infiltrates the lightweight virtual machine where the ECI resides, they can forge source addresses and attempt to traverse VNI (Virtual Network Interface) numbers. Once a correct VNI number is found, the malicious user can initiate data packets within that virtual machine, directly accessing other tenant virtual private clouds through VPCGW, thus causing data security issues.

[0028] To address the aforementioned issues, this embodiment of the application sets up an ECI router on the ECI and an ECI gateway on the virtual machines of the computing cluster. Data packets are forwarded to the ECI gateway via the ECI router, where the ECI gateway verifies the source address of the data packets. Upon successful verification of the source address, the data packet is forwarded to the virtual private cloud resource. This effectively ensures the legitimacy of the source address and improves data security.

[0029] The virtual private cloud access method of this application will be described in detail below through specific embodiments.

[0030] Figure 1 This is a schematic diagram of the structure of a virtual private cloud access system provided in an embodiment of this application. (Refer to...) Figure 1As shown, the Virtual Private Cloud Access System includes: ECI and a computing power cluster. The ECI is equipped with an ECI router, which includes two containerized services: Traffic Management Router (TMR) and a first switch. The computing power cluster includes virtual machines, on which ECI gateways are configured. The ECI gateways include two containerized services: Traffic Management Gateway and a second switch.

[0031] The aforementioned ECI router and ECI gateway communicate via a connection, for example, through VXLAN (Virtual Extensible Local Area Network). The ECI router sends data packets to the ECI gateway, which verifies the source address in the data packets and forwards them to the VPCGW. The VPCGW can then forward the data packets to the corresponding tenant's virtual private cloud. Similarly, the aforementioned computing cluster and VPCGW also communicate via VXLAN.

[0032] Specifically, the traffic management router is used to manage the transmission of data packets, the first switch is used to send data packets to the ECI gateway, the traffic management gateway is used to verify the source address of the data packets, and the second switch is used to forward the data packets to the VPCGW.

[0033] Both the first and second switches are OVS (Open vSwitch), a highly portable open-source switch service that supports virtualization technology.

[0034] A virtual private cloud access system may include one or more ECIs, each of which is communicatively connected to an ECI gateway. A computing power cluster may include one or more virtual machines. A computing power cluster can access the virtual private clouds of multiple tenants. An ECI can access the virtual private cloud of its own tenant, but cannot access the virtual private clouds of other tenants. Figure 1 The example provides two ECIs: ECI1 and ECI2, two virtual machines: VM1 and VM2, and two tenants: U1 and U2. ECI1 is the ECI of tenant U1, and ECI2 is the ECI of tenant U2. ECI1 can access tenant U1's virtual private cloud through the computing power cluster, and ECI2 can access tenant U2's virtual private cloud through the computing power cluster. ECI1 cannot access tenant U2's virtual private cloud, and ECI2 cannot access tenant U1's virtual private cloud.

[0035] Each of the two virtual machines has an ECI gateway. These ECI gateways can switch between primary and backup modes; the ECI gateway in active mode is the primary ECI gateway, and the ECI gateway in idle mode is the backup ECI gateway. The primary ECI gateway is used to receive data packets sent by the ECI router, for example... Figure 1 The ECI gateway on virtual machine VM1 is the primary ECI gateway, and the ECI gateway on virtual machine VM2 is the backup ECI gateway.

[0036] Figure 2 A flowchart illustrating the steps of a virtual private cloud access method provided in this application embodiment is applied to... Figure 1 In the virtual private cloud access system shown, the method may include the following steps: S101, the traffic management router sets the destination address of the data packet to be sent to the virtual address of the ECI gateway, and sends the data packet to the ECI gateway through the first switch according to the virtual address.

[0037] S102 and ECI gateways parse data packets to obtain the inner source address and outer source address.

[0038] S103. When the inner source address and the outer source address are the same, the traffic management gateway sends the data packet to the tenant's virtual private cloud through the second switch.

[0039] The traffic management router can create OVS flow tables to store packets to be sent. The traffic management router needs to modify the destination address of the packets in the OVS flow table (Flow Entry) to the virtual address of the ECI gateway, then encapsulate the packets in GENEVE (Generic Network Virtualization Encapsulation) format and send them to the first switch. The first switch then forwards the packets to the ECI gateway based on the ECI gateway's virtual address.

[0040] The virtual address of the aforementioned ECI gateway uniquely represents the gateway address of a computing power cluster. Each computing power cluster corresponds to one virtual address, and all ECI gateways within that cluster share this virtual address. This virtual address can be a High-Availability Virtual IP (HAVIP) address, which can be created through the cloud console and bound to a backend server. When the computing power cluster creates an ECI node using the virtual node function, the ECI gateway sends its virtual address to the ECI node. The specific process includes: When an ECI is created, the traffic management router receives environment variables sent by the ECI gateway and extracts the virtual address of the ECI gateway from the environment variables. Different ECI gateways in the computing power cluster share the virtual address. It can be seen that each time a new ECI is added, that ECI needs to connect to the computing power cluster. Therefore, the ECI gateway in the computing power cluster transparently transmits the virtual address to the traffic management router via environment variables. Transmitting the virtual address as an environment variable during ECI creation ensures that the ECI obtains the virtual address as early as possible, avoiding impact on subsequent data transmission.

[0041] When an ECI gateway receives environment variables, it can construct the ECI runtime environment based on these variables, and the virtual address can be set during the environment construction process. Subsequently, when the ECI sends data packets, it can use the locally stored virtual address to send the data packets to this ECI.

[0042] In some possible implementations, when a virtual address changes, the ECI gateway can send the modified virtual address to the traffic management router so that the traffic management router can update the virtual address and send subsequent data packets using the updated virtual address.

[0043] Furthermore, to ensure the security of the virtual address, it can be encrypted before being transmitted to the traffic management router.

[0044] After receiving the virtual address of the aforementioned ECI gateway, the traffic management router sets the destination address of the data packet to the virtual address of the aforementioned ECI gateway and sends the data packet to the first switch, which resides in the same ECI as the traffic management router. Before the first switch sends the data packet, the traffic management router needs to migrate the elastic network interface card (NIC) address of the lightweight virtual machine where the ECI resides to the first switch, so that the first switch can send the data packet to the ECI gateway. Specifically, the migration process includes: When the traffic management router starts up, it creates a bridge on the first switch and deletes the network address on the lightweight virtual machine where the ECI resides; it adds the network address of the network card on the lightweight virtual machine to the bridge and configures the network address of the lightweight virtual machine on the bridge to start the bridge; it then sends data packets to the ECI gateway through the first switch according to the virtual address, including: the bridge sending data packets to the ECI gateway according to the virtual address.

[0045] Understandably, when the bridge is configured with the network address of the network card on the virtual machine and the network address of the lightweight virtual machine, it can communicate through these two addresses and send data packets to the ECI gateway.

[0046] In some possible implementations, before the data packet is sent to the ECI gateway via the first switch according to the virtual address, the following steps are also included: Configure the traffic management router to handle access traffic to the virtual private cloud corresponding to the ECI; The traffic management router sends data packets to the first switch according to the access traffic.

[0047] The access traffic here is used to control the speed at which ECI sends data packets. It can also be understood as priority. The larger the access traffic, the faster the sending speed and the higher the priority; the smaller the access traffic, the slower the sending speed and the lower the priority.

[0048] Typically, access traffic indicates the amount of data sent per unit of time. It can be fixed, with different ECIs within the same computing power cluster having the same access traffic. However, access traffic can also be correlated with the tenant of the ECI, the time period, etc. Different ECIs correspond to different tenants with different access traffic levels. Tenants can set tenant levels, and time periods can also set time period levels. Therefore, access traffic can be positively correlated with tenant level and time period level: the higher the tenant level and the higher the time period level, the higher the access traffic; conversely, the lower the tenant level and the lower the time period level, the lower the access traffic.

[0049] The tenant tiers mentioned above indicate the importance of a tenant, while the time-based tiers are positively correlated with historical traffic, which is the amount of data sent per unit of time. This allows for dynamic control of access traffic based on tenant and time-based tiers, helping to improve data transmission efficiency and success rate.

[0050] In some possible implementations, source address verification can be performed on some data packets. In this case, the traffic management router needs to identify the type of the data packet to set its destination address accordingly. When the data packet type is a destination type, the traffic management router sets the destination address of the data packet to the virtual address of the ECI gateway to send the data packet to the first switch; when the data packet type is not a destination type, the traffic management router sets the destination address of the data packet to the network address of the VPCGW and sends the data packet to the VPCGW.

[0051] The target type mentioned above indicates the data packets that require source address verification and can be flexibly set according to the actual application scenario. For example, the target type can be an IPv4 (Internet Protocol Version) packet, an IPv6 packet, or a packet type classified according to other information.

[0052] When an ECI gateway receives a data packet from an ECI router, its traffic management gateway needs to verify that the inner source address and outer source address are consistent. The inner source address is extracted from the inner data of the data packet, and the outer source address is extracted from the outer data of the data packet. The traffic management gateway can store the extracted inner and outer source addresses in two registers and compare the contents of these two registers. If they match, the data packet is sent to the corresponding tenant's virtual private cloud; if they do not match, the data packet is discarded.

[0053] In some possible implementations, the traffic management gateway can also record dropped packet information, including but not limited to: the time of packet drop, inner source address, outer source address, ECI, tenant identifier corresponding to the ECI, and virtual private cloud identifier corresponding to the ECI. Furthermore, it can generate source address attack logs based on the dropped packet information, specifically including: aggregating at least one of the above dropped packet information to obtain the number of source address attacks. For example, it can aggregate by ECI and time period to obtain the number of source address attacks for a given ECI within a given time period.

[0054] In some possible implementations, refer to Figure 1 As shown, a Serviceless Compute Gateway (FAASGW) is set up between the computing cluster and the VPCGW, and the VPCGW communicates with the tenant's virtual private cloud. The above method also includes: When the traffic management gateway receives container group information, it extracts the virtual private cloud address and virtual network interface accessed by the container group from the annotations in the container group information; the traffic management gateway sends the virtual private cloud address and virtual network interface to the serverless computing gateway; the traffic management gateway sends the data packet to the tenant's virtual private cloud through the second switch, including: the traffic management gateway sends the data packet to the serverless computing gateway through the second switch; the serverless computing gateway sends the data packet to the tenant's virtual private cloud via the VPCGW through the virtual private cloud address and virtual network interface.

[0055] Upon startup, the aforementioned traffic management gateway subscribes to container group information of the computing cluster. A container group (Pod), comprising one or more containers, is the smallest management unit of the computing cluster. When a container group is created or updated, it sends container group information to the traffic management gateway. This embodiment of the application can accurately forward data packets using the aforementioned FAASGW, virtual private cloud address, and virtual network interface.

[0056] In some possible implementations, multiple ECI gateways can be configured within the same computing power cluster, with different ECI gateways located on different virtual machines within the cluster. This reduces the probability of all ECI gateways in the cluster failing. Different ECI gateways communicate with each other via keep-alive messages for primary / standby failover. Specifically, the computing power cluster includes at least two virtual machines, each with its own ECI gateway. The method further includes: When the standby ECI gateway does not receive a keep-alive message from the primary ECI gateway, it performs a switchover between the primary and standby ECI gateways, including: enabling the standby ECI gateway and disabling the primary ECI gateway.

[0057] The keepalive message mentioned above is used to ensure the high availability of the ECI gateway.

[0058] An ECI gateway in an idle state is a backup ECI gateway, while an ECI gateway in an active state is the primary ECI gateway. Under normal circumstances, the backup ECI gateway can receive keep-alive messages sent by the primary ECI gateway. If the primary ECI gateway malfunctions, the backup ECI gateway will not be able to receive keep-alive messages, and the backup ECI gateway can initiate a primary / backup switchover.

[0059] Of course, in another scenario, a separate switching center can be set up. This switching center communicates with the ECI gateway via keep-alive messages and determines whether a primary / standby switch is needed based on the keep-alive messages sent by the primary and standby ECI gateways. Specifically, when a keep-alive message from the primary ECI gateway is received, no primary / standby switch is initiated; when no keep-alive message from the primary ECI gateway is received, but a keep-alive message from the standby ECI gateway is received, a primary / standby switch is initiated; when no keep-alive messages from either the primary or standby ECI gateway are received, an exception message is issued.

[0060] In some possible implementations, when multiple backup ECI gateways exist, a primary ECI gateway needs to be selected from among them after the switchover. This selection strategy can include random selection or selection based on the performance parameters of the backup ECI gateways. Selection based on the performance parameters of the backup ECI gateways can include: obtaining the data traffic of the primary ECI gateway, and selecting one or more backup ECI gateways based on this data traffic and the performance parameters of the backup ECI gateways. The number of selected backup ECI gateways and / or the performance parameters of the backup ECI gateways are positively correlated with the data traffic of the primary ECI gateway. For example, when the data traffic of the primary ECI gateway is low, a backup ECI gateway with lower performance parameters can be selected as the primary ECI gateway; when the data traffic of the primary ECI gateway is high, multiple backup ECI gateways with higher performance parameters can be selected as the primary ECI gateway.

[0061] As can be seen from the above process, when multiple ECI gateways exist in a computing cluster, typically one serves as the primary ECI gateway, while the rest are backup ECI gateways, resulting in wasted resources. To fully utilize ECI gateway resources, the primary ECI gateway can activate backup ECI gateways when the received data traffic exceeds or equals a preset traffic threshold, making them active and thus the primary ECI gateway. For load balancing, each primary ECI gateway can correspond to one or more tenants. Each primary ECI gateway can receive data packets sent by the corresponding tenant's ECI gateway, perform source address verification, and forward the packets.

[0062] The primary ECI gateway can also dynamically decide the number of backup ECI gateways to be activated based on data traffic. Data traffic is positively correlated with the number of backup ECI gateways activated and the performance parameters of the activated backup ECI gateways.

[0063] Of course, the primary ECI gateway can also be deactivated based on data traffic. For example, when data traffic is less than or equal to a preset traffic threshold, some primary ECI gateways can be deactivated, i.e., set to idle state. The number of deactivated ECI gateways can be negatively correlated with data traffic.

[0064] In summary, the embodiments of this application can forward data packets to the ECI gateway through the ECI router, so that the ECI gateway can verify the source address of the data packets, thereby reducing the probability of successful source address attacks and helping to improve data security.

[0065] Figure 3 This is a flowchart illustrating another virtual private cloud access method in this application embodiment. The following steps are performed by the cloud desktop client, as shown below. Figure 3 As shown, the above-mentioned method for accessing a virtual private cloud includes the following steps: S201. When creating an ECI, the traffic management router receives environment variables sent by the ECI gateway and extracts the virtual address of the ECI gateway from the environment variables. Different ECI gateways in the computing power cluster share the virtual address.

[0066] When the S202 traffic management router starts up, it creates a bridge on the first switch and deletes the network address on the lightweight virtual machine where the ECI resides.

[0067] The S203 traffic management router adds the network address of the network card on the lightweight virtual machine to the bridge, configures the network address of the lightweight virtual machine on the bridge, and starts the bridge.

[0068] S204. The traffic management router sets the destination address of the data packet to be sent to the virtual address of the ECI gateway, and sets the access traffic of the virtual private cloud corresponding to ECI.

[0069] S205. The traffic management router sends data packets to the first switch according to the access traffic, and the bridge on the first switch sends the data packets to the ECI gateway according to the virtual address.

[0070] S206. When the traffic management gateway receives container group information, it extracts the virtual private cloud address and virtual network interface accessed by the container group from the annotation of the container group information, and sends the virtual private cloud address and virtual network interface to the serverless computing gateway.

[0071] The S207 and ECI gateways parse the data packets to obtain the inner and outer source addresses. When the inner and outer source addresses match, the traffic management gateway sends the data packet to the serverless computing gateway through the second switch.

[0072] S208, the serverless computing gateway sends data packets to the tenant's virtual private cloud via the virtual private cloud address and virtual network interface.

[0073] S209. When the standby ECI gateway does not receive a keep-alive message from the primary ECI gateway, it performs a switchover between the primary and standby ECI gateways, including: enabling the standby ECI gateway and disabling the primary ECI gateway.

[0074] S210. When the primary ECI gateway receives data traffic greater than or equal to a preset traffic threshold, it activates a backup ECI gateway based on the data traffic. The performance parameters of the activated backup ECI gateway and / or the number of activated backup ECI gateways are positively correlated with the data traffic.

[0075] S211. When the received data traffic is less than a preset traffic threshold, the primary ECI gateway shall be deactivated based on the data traffic. The performance parameters of the deactivated primary ECI gateway and / or the number of deactivated primary ECI gateways shall be negatively correlated with the data traffic.

[0076] It should be noted that S201 to S211 described above can be referred to the foregoing embodiments, and will not be repeated here. In addition, the order of S201 to S211 can be flexibly adjusted on the basis of mutual independence, and the embodiments of this application do not limit the order of them.

[0077] Figure 1 This is a schematic diagram of the structure of a virtual private cloud access system according to an embodiment of this application, including: The system comprises an Elastic Container Instance (ECI) and a compute cluster. The ECI is equipped with an ECI router, which includes two containerized services: a traffic management router and a first switch. The compute cluster includes virtual machines, each equipped with an ECI gateway. The ECI gateway also includes two containerized services: a traffic management gateway and a second switch. The traffic management router sets the destination address of a data packet to be sent to the virtual address of the ECI gateway and sends the data packet to the first switch. The first switch sends the data packet to the ECI gateway according to the virtual address. The ECI gateway parses the data packet to obtain an inner source address and an outer source address. The traffic management gateway, when the inner and outer source addresses match, sends the data packet to the second switch. The second switch then sends the data packet to the tenant's virtual private cloud.

[0078] Optionally, the traffic management router is further configured to: When the ECI is created, the system receives environment variables sent by the ECI gateway and extracts the virtual address of the ECI gateway from the environment variables. Different ECI gateways in the computing power cluster share the virtual address.

[0079] Optionally, the traffic management router is further configured to: When the traffic management router starts up, it creates a bridge on the first switch and deletes the network address on the lightweight virtual machine where the ECI is located; it adds the network address of the network card on the lightweight virtual machine to the bridge and configures the network address of the lightweight virtual machine on the bridge to start the bridge; the bridge is also used to send the data packet to the ECI gateway according to the virtual address.

[0080] Optionally, the traffic management router is further configured to: Configure the access traffic for the virtual private cloud corresponding to the ECI; send the data packet to the first switch according to the access traffic.

[0081] Optionally, the traffic management gateway is further configured to: Upon receiving container group information, the virtual private cloud address and virtual network interface accessed by the container group are extracted from the annotations of the container group information; the virtual private cloud address and virtual network interface are sent to the serverless computing gateway; the data packet is sent to the serverless computing gateway through the second switch; the serverless computing gateway is further configured to: send the data packet to the tenant's virtual private cloud via the virtual private cloud gateway through the virtual private cloud address and virtual network interface.

[0082] Optionally, the computing power cluster includes at least two virtual machines each equipped with an ECI gateway. The backup ECI gateway is used to perform a switch between the primary and backup ECI gateways when no keep-alive message is received from the primary ECI gateway, including enabling the backup ECI gateway and disabling the primary ECI gateway.

[0083] Optionally, the primary ECI gateway is also used for: When the received data traffic is greater than or equal to a preset traffic threshold, a backup ECI gateway is activated based on the data traffic. The performance parameters of the activated backup ECI gateway and / or the number of activated backup ECI gateways are positively correlated with the data traffic. When the received data traffic is less than the preset traffic threshold, the primary ECI gateway is deactivated based on the data traffic. The performance parameters of the deactivated primary ECI gateway and / or the number of deactivated primary ECI gateways are negatively correlated with the data traffic.

[0084] The above system embodiments are device embodiments corresponding to the method embodiments. They can be referred to the description of the foregoing method embodiments and have the same beneficial effects as the method embodiments.

[0085] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform any of the virtual private cloud access methods described in the above embodiments.

[0086] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the virtual private cloud access methods in the above embodiments.

[0087] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0088] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0089] It should be noted that the various data-related processes in the embodiments of this application are carried out in compliance with the relevant data protection laws and policies of the country where the location is located, and with the authorization granted by the owner of the corresponding device.

[0090] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0091] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A method for accessing a virtual private cloud, characterized in that, The method is applied to a Virtual Private Cloud (VPC) access system, which includes Elastic Container Instances (ECIs) and a computing cluster. The ECI is equipped with an ECI router, which includes two containerized services: a traffic management router and a first switch. The computing cluster includes virtual machines, on which ECI gateways are configured. These ECI gateways include two containerized services: a traffic management gateway and a second switch. The traffic management router sets the destination address of the data packet to be sent to the virtual address of the ECI gateway, and sends the data packet to the ECI gateway through the first switch according to the virtual address; The ECI gateway parses the data packet to obtain the inner source address and the outer source address; When the inner source address and the outer source address are the same, the traffic management gateway sends the data packet to the tenant's virtual private cloud through the second switch.

2. The method according to claim 1, characterized in that, Also includes: When the ECI is created, the traffic management router receives environment variables sent by the ECI gateway and extracts the virtual address of the ECI gateway from the environment variables. Different ECI gateways in the computing power cluster share the virtual address.

3. The method according to claim 1, characterized in that, Also includes: When the traffic management router starts up, it creates a bridge on the first switch and deletes the network address on the lightweight virtual machine where the ECI is located. Add the network address of the network card on the lightweight virtual machine to the bridge, and configure the network address of the lightweight virtual machine on the bridge to start the bridge; Sending the data packet to the ECI gateway via the first switch according to the virtual address includes: The bridge sends the data packet to the ECI gateway according to the virtual address.

4. The method according to any one of claims 1 to 3, characterized in that, Before the first switch sends the data packet to the ECI gateway according to the virtual address, the method further includes: The traffic management router sets the access traffic for the virtual private cloud corresponding to the ECI; The traffic management router sends the data packets to the first switch according to the access traffic.

5. The method according to any one of claims 1 to 3, characterized in that, Also includes: When the traffic management gateway receives container group information, it extracts the virtual private cloud address and virtual network interface accessed by the container group from the annotations of the container group information. The traffic management gateway sends the virtual private cloud address and virtual network interface to the serverless computing gateway. The traffic management gateway sends the data packets to the tenant's virtual private cloud via the second switch, including: The traffic management gateway sends the data packet to the serverless computing gateway through the second switch; The serverless computing gateway sends the data packets to the tenant's virtual private cloud via the virtual private cloud address and virtual network interface.

6. The method according to any one of claims 1 to 3, characterized in that, The computing cluster includes at least two virtual machines, each equipped with an ECI gateway, and the method further includes: When the standby ECI gateway does not receive a keep-alive message from the primary ECI gateway, it performs a switchover between the primary and standby ECI gateways, including: enabling the standby ECI gateway and disabling the primary ECI gateway.

7. The method according to claim 6, characterized in that, Also includes: When the primary ECI gateway receives data traffic greater than or equal to a preset traffic threshold, it activates a backup ECI gateway based on the data traffic. The performance parameters of the activated backup ECI gateway and / or the number of activated backup ECI gateways are positively correlated with the data traffic. When the received data traffic is less than a preset traffic threshold, the primary ECI gateway is deactivated based on the data traffic. The performance parameters of the deactivated primary ECI gateway and / or the number of deactivated primary ECI gateways are negatively correlated with the data traffic.

8. A virtual private cloud access system, comprising: Elastic Container Instance (ECI) and computing power cluster, wherein the ECI is equipped with an ECI router, the ECI router includes two containerized services: a traffic management router and a first switch, the computing power cluster includes virtual machines, wherein the virtual machines are equipped with an ECI gateway, the ECI gateway includes two containerized services: a traffic management gateway and a second switch; The traffic management router is used to: set the destination address of the data packet to be sent to the virtual address of the ECI gateway, and send the data packet to the first switch; The first switch is configured to: send the data packet to the ECI gateway according to the virtual address; The ECI gateway is used to: parse the data packet to obtain the inner source address and the outer source address; The traffic management gateway is used to: send the data packet to the second switch when the inner source address and the outer source address are the same; The second switch is used to send the data packets to the tenant's virtual private cloud.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 7.

10. A computer program, characterized in that, The computer program is executed by a computer to implement the method as described in any one of claims 1 to 7.

Images