Request processing method, apparatus, device, and readable storage medium

Abstract

The application discloses a request processing method and device, equipment and a readable storage medium, and relates to the technical field of security. According to the technical scheme, when an inbound request sent by an external device is received, the data packet carried by the inbound request is analyzed, the data packet is matched with the rules corresponding to the management security group, the mutual trust security group and the user security group included in the cloud host, the permission of accessing a target service is opened for the external device when the data information of the data packet meets the rules corresponding to any security group, the multiple security groups included in the cloud host are explicitly divided, the rules corresponding to each security group are determined respectively, and therefore the processing efficiency of the cloud host on the access request is improved.

Description

Technical Field

[0001] This application belongs to the field of security technology, specifically relating to a request processing method, apparatus, device, and readable storage medium. Background Technology

[0002] A cloud server, also known as a cloud host, is a virtualized computing resource based on cloud computing. It allows users to rent and use virtual servers on demand through the infrastructure of a cloud service provider. A security group in a cloud host is a virtual firewall, a set of rules used to control network traffic entering and leaving the cloud host. It helps administrators define which traffic can enter and leave a specific cloud host, thereby enhancing security. In related technologies, a cloud host can include multiple security groups simultaneously; however, the permission boundaries of these security groups are often blurred, and the rules set can conflict, resulting in low efficiency in processing access requests during the cloud host's access request handling process. Summary of the Invention

[0003] This application provides a request processing method, apparatus, device, and readable storage medium, which solves the problem of low processing efficiency for access requests in related technologies.

[0004] Firstly, this application provides a request processing method applied to a cloud server, the method comprising:

[0005] Upon receiving an inbound request from an external device, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host.

[0006] If the data packet matches the rules set by the target security group included in the cloud host, the external device is granted permission to access the target service. The rules set by the target security group are used to restrict the data information of the external device allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external device. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

[0007] Optionally, upon receiving an inbound request from an external device, parsing the inbound request to obtain the data packet carried by the inbound request includes:

[0008] Upon receiving an inbound request from an external device, the identity of the external device is identified to obtain its identity information. The external device is either an external client or a cloud host other than the cloud host itself.

[0009] If the identity information is verified and the verification result indicates that the external device is secure, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes: the Internet Protocol IP address of the external device, the IP address of the target service, the protocol of the external device, the port information of the external device, and the port information of the target service.

[0010] Optionally, before granting the external device access to the target service if the data packet matches the rules set in the target security group included in the cloud host, the method further includes:

[0011] If the IP address of the target service matches the rules set by the management security group, and the port information of the target service matches the rules set by the management security group, then the data packet is determined to match the rules set by the management security group.

[0012] If the IP address of the target service does not match the rules set by the management security group, but the port information of the target service matches the rules set by the management security group, and the IP address of the target service matches the rules set by the mutual trust security group, and the port information of the target service matches the rules set by the mutual trust security group, then it is determined that the data packet matches the rules set by the mutual trust security group.

[0013] If the IP address of the target service does not match the rules set by the management security group, the port information of the target service matches the rules set by the management security group, the IP address of the target service does not match the rules set by the mutual trust security group, the port information of the target service does not match the rules set by the mutual trust security group, and the data packet matches the rules set by the user security group, then it is determined that the data packet matches the rules set by the user security group.

[0014] Optionally, the cloud host further includes a metadata layer and an image storage layer, and the method further includes:

[0015] Upon receiving a modification request, data is written to the metadata layer based on the modification request to obtain a first write result, and data is written to the image storage layer based on the modification request to obtain a second write result. The modification request is used to request modification of the management security group or the mutual trust security group.

[0016] Calculate the first hash value corresponding to the first write result, and calculate the second hash value corresponding to the second write result;

[0017] If the first hash value is different from the second hash value, the modification request is rolled back in the metadata layer and the image storage layer.

[0018] Optionally, before parsing the inbound request to obtain the data packet carried by the inbound request upon receiving an inbound request from an external device, the method further includes:

[0019] During the creation of the cloud host, the management security group is created based on the baseline library of the cloud platform where the cloud host is deployed;

[0020] Obtain multiple service tags corresponding to the multiple services included in the cloud host;

[0021] Calculate the multiple hash values ​​corresponding to the multiple business tags;

[0022] Multiple security subdomains are determined based on the multiple hash values, and the mutual trust security group is created based on the multiple security subdomains;

[0023] The user security group is created based on the management security group and the mutual trust security group.

[0024] Optionally, after determining multiple security subdomains based on the multiple hash values ​​and generating the mutual trust security group according to the multiple security subdomains, the method further includes:

[0025] If the service tag corresponding to the first service is the same as the service tag corresponding to the second service, the first service and the second service are assigned to the same security subdomain, and the data access permissions between the first service and the second service are set to be interoperable. The first service and the second service are any two different services among the plurality of services.

[0026] Secondly, this application provides a request processing apparatus applied to a cloud host, the apparatus comprising:

[0027] The request parsing module is used to parse the inbound request when it receives an inbound request sent by an external device, and obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host.

[0028] The permission opening module is used to grant external devices access to the target service when the data packet matches the rules set by the target security group included in the cloud host. The rules set by the target security group are used to restrict the data information of the external devices allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external devices. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

[0029] Thirdly, this application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method described in the first aspect above.

[0030] Fourthly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0031] Fifthly, this application also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in the first aspect above.

[0032] This application discloses a request processing method, apparatus, device, and readable storage medium, relating to the field of security technology. The technical solution of this application, upon receiving an inbound request from an external device, parses the inbound request to obtain the data packet carried by the inbound request, and then matches the data packet with the rules corresponding to the management security group, mutual trust security group, and user security group included in the cloud host. If the data information of the data packet conforms to the rules corresponding to any one of the security groups, the external device is granted access to the target service. This achieves a clear division of multiple security groups included in the cloud host and determines the rules corresponding to each security group, thereby improving the processing efficiency of the cloud host for access requests. Attached Figure Description

[0033] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A flowchart illustrating a request processing method provided in an embodiment of this application;

[0035] Figure 2 This is a schematic diagram of the data packet matching process provided in an embodiment of this application;

[0036] Figure 3 This is a schematic diagram of the modification rule process provided in the embodiments of this application;

[0037] Figure 4 The overall implementation architecture diagram provided for the embodiments of this application;

[0038] Figure 5 This is a schematic diagram of the structure of a request processing device provided in an embodiment of this application;

[0039] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] The terms "first," "second," etc., used in the embodiments of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices. Additionally, the use of "and / or" in this application indicates at least one of the connected objects, such as A and / or B and / or C, representing seven possibilities: including A alone, B alone, C alone, and the presence of both A and B, both B and C, both A and C, and the presence of A, B, and C.

[0042] See Figure 1 , Figure 1 This is a flowchart illustrating the request processing method provided in an embodiment of this application. For example... Figure 1 As shown, the request processing method may include the following steps:

[0043] Step 101: Upon receiving an inbound request from an external device, parse the inbound request to obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host.

[0044] In this embodiment, the request processing method provided is applied to a cloud host, also known as a cloud server, which is a virtualized computing resource based on cloud computing. It allows users to rent and use virtual servers on demand through the infrastructure of a cloud service provider. When an inbound request is received from an external device, the request needs to be parsed to obtain the data packet carried by the request. This data packet includes network communication information from the external device, such as port information, IP address, etc.

[0045] An inbound request includes a request from an external device to access a target service within a cloud host. The cloud host can execute multiple services in parallel, and the target service can be any one of these services. Upon receiving an inbound request, the system parses the request and determines whether the external device has permission to access the target service based on the data packet.

[0046] Step 102: If the data packet matches the rules set by the target security group included in the cloud host, grant the external device permission to access the target service. The rules set by the target security group are used to restrict the data information of the external device allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external device. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

[0047] In this embodiment, the cloud host is configured with three security groups: a management security group (Baseline Security Group, BSG), a trust domain security group (TDSG), and a user-defined security group (UDSG). The management security group stores the cloud host's basic policies, such as Virtual Private Cloud (VPC) level basic policies (e.g., monitoring ports, audit logs). The trust domain security group enables communication between multiple security subdomains (SSDs) within the cloud host, such as establishing mutual trust between hosts within the same security subdomain. The user security group provides customized services for external devices, such as allowing tenants to customize service policies.

[0048] It should be noted that the management security group, mutual trust security group, and user security group each have corresponding set rules used to match all or part of the data in the data packet to determine whether the data packet conforms to the corresponding set rules, thereby determining whether the external device has the permission to access the target service.

[0049] In this embodiment, if a data packet meets the rules set by any one of the security groups (i.e., the rules set by the target security group), the external device is granted access to the target service. The target security group is any one of the management security group, the mutual trust security group, and the user security group. If the data packet does not meet the rules set by any one of the security groups, the access request from the external device is denied.

[0050] The technical solution of this application, upon receiving an inbound request from an external device, parses the inbound request to obtain the data packet carried by the inbound request, and then matches the data packet with the rules corresponding to the management security group, mutual trust security group, and user security group included in the cloud host. If the data information of the data packet conforms to the rule corresponding to any security group, the external device is granted permission to access the target service. This achieves clear division of multiple security groups included in the cloud host and determines the rules corresponding to each security group, thereby improving the processing efficiency of the cloud host for access requests.

[0051] In some feasible implementations, optionally, upon receiving an inbound request from an external device, parsing the inbound request to obtain the data packet carried by the inbound request includes:

[0052] Upon receiving an inbound request from an external device, the identity of the external device is identified to obtain its identity information. The external device is either an external client or a cloud host other than the cloud host itself.

[0053] If the identity information is verified and the verification result indicates that the external device is secure, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes: the Internet Protocol IP address of the external device, the IP address of the target service, the protocol of the external device, the port information of the external device, and the port information of the target service.

[0054] In this embodiment, upon receiving an inbound request from an external device (which may be an external client or other cloud host), the system first needs to identify the external device. This confirms whether the device sending the request is legitimate and obtains its identity information. The process of securely verifying the identity information includes checking and confirming whether the external device's identity is secure and trustworthy, ensuring that there are no potential security risks.

[0055] If authentication is successful, indicating that the external device's identity is secure, the system will parse the inbound request to obtain the data packet carried in the request. Specifically, in this embodiment, the data packet carries a five-tuple (the external device's Internet Protocol IP address, i.e., the source IP; the target service's IP address, i.e., the destination IP; the external device's protocol; the external device's port information, i.e., the source port; and the target service's port information, i.e., the destination port). It should be noted that the data packet must include all five pieces of data. If the data packet is missing or corrupted, it will be considered an insecure data packet, and the external device's access request will be rejected.

[0056] Optionally, before granting the external device access to the target service if the data packet matches the rules set in the target security group included in the cloud host, the method further includes:

[0057] If the IP address of the target service matches the rules set by the management security group, and the port information of the target service matches the rules set by the management security group, then the data packet is determined to match the rules set by the management security group.

[0058] If the IP address of the target service does not match the rules set by the management security group, but the port information of the target service matches the rules set by the management security group, and the IP address of the target service matches the rules set by the mutual trust security group, and the port information of the target service matches the rules set by the mutual trust security group, then it is determined that the data packet matches the rules set by the mutual trust security group.

[0059] If the IP address of the target service does not match the rules set by the management security group, the port information of the target service matches the rules set by the management security group, the IP address of the target service does not match the rules set by the mutual trust security group, the port information of the target service does not match the rules set by the mutual trust security group, and the data packet matches the rules set by the user security group, then it is determined that the data packet matches the rules set by the user security group.

[0060] In this embodiment, BSG rules have the highest priority (e.g., forcibly opening monitoring ports), TDSG has the second highest priority (ensuring interoperability within the same business domain), and UDSG has the lowest priority (custom business policies).

[0061] In this embodiment, the data packet is first matched against the rules set by the management security group. If the data packet matches the rules set by the management security group, it is allowed to pass directly. Specifically, the IP address and port information of the target service are matched against the rules set by the management security group. For example, the destination port in the rule must exactly match the destination port of the inbound request, and the protocol type must also match.

[0062] If a data packet does not match the rules set in the management security group, it is matched against the rules set in the mutual trust security group. If a match is found, the data packet is allowed to pass. Specifically, the IP address and port information of the target service are matched against the rules set in the mutual trust security group, for example, source host SSD label = destination host SSD label.

[0063] If a data packet does not match the rules set by the management security group and the mutual trust security group, it is matched against the rules set by the user security group. If it matches the rules set by the user security group, the data packet is allowed to pass directly; otherwise, it is discarded. Specifically, the data packet is matched against the rules set by the user security group by including the Internet Protocol (IP) address of the external device, the IP address of the target service, the protocol of the external device, the port information of the external device, and the port information of the target service. For example, a full match of the five-tuple in an inbound request is performed.

[0064] like Figure 2 As shown, Figure 2 This is a flowchart illustrating the process of matching data packets with the rules set for the target security groups included in the cloud host in this embodiment. Each matching result has three possible states: ALLOW, DENY, and NO_MATCH.

[0065] Decision efficiency: The matching process terminates immediately upon any rule being matched at any level (whether ALLOW or DENY). Priority: BSG rules have the highest priority, followed by TDSG, and UDSG has the lowest priority. Once a higher-level rule (BSG > TDSG) is matched, lower-level rules (UDSG) cannot cover it, ensuring that core policies cannot be bypassed. Default rejection: If no match is found at any of the three levels, a default rejection is executed.

[0066] In this embodiment, a fixed binding architecture of management security groups, mutual trust security groups, and user security groups is used to achieve physical-level separation of management policies (operation and maintenance port), mutual trust policies (inter-domain communication), and business policies, thus completely eliminating the root cause of rule conflicts in the dynamically overlaid architecture of related technologies.

[0067] Optionally, the cloud host further includes a metadata layer and an image storage layer, and the method further includes:

[0068] Upon receiving a modification request, data is written to the metadata layer based on the modification request to obtain a first write result, and data is written to the image storage layer based on the modification request to obtain a second write result. The modification request is used to request modification of the management security group or the mutual trust security group.

[0069] Calculate the first hash value corresponding to the first write result, and calculate the second hash value corresponding to the second write result;

[0070] If the first hash value is different from the second hash value, the modification request is rolled back in the metadata layer and the image storage layer.

[0071] In this embodiment, the Permission Isolation Controller (PIC) is deployed on a dedicated security management server (X86 architecture hardware device) on the cloud platform control node, and interacts with the cloud management platform through an API gateway.

[0072] As shown in Table 1, Table 1 lists the permissions corresponding to different security groups:

[0073] Table 1

[0074] BSG Cloud platform administrator Open management ports for TCP / UDP protocols (such as SSH-22 / RDP-3389 / Prometheus-9100). TDSG Security Domain Administrator Allows communication with hosts within the SSD using specific protocols (such as ICMP / MySQL-3306). UDSG tenant Customize HTTP-80 / HTTPS-443 ports, etc.

[0075] When a non-administrator attempts to modify the BSG / TDSG, the system performs the following operations: The PIC rule validator triggers a hardware-level interrupt. The security audit module generates an alarm event (event code: SEC_GROUP_PERM_DENY). A real-time interception notification (including operator account, operator IP, rule content, and timestamp) is pushed to the administrator console.

[0076] When an administrator modifies a BSG / TDSG rule, the system performs the following operations, as follows: Figure 3 As shown, data is written to the metadata layer based on the modification request, resulting in a first write result. Data is also written to the image storage layer based on the modification request, resulting in a second write result. The modification request is used to request modifications to the management security group or the mutual trust security group. A first hash value corresponding to the first write result and a second hash value corresponding to the second write result are calculated. If the first hash value and the second hash value are different, the modification request is rolled back in both the metadata layer and the image storage layer. If they are the same, the modification request is considered successful.

[0077] Specifically, metadata layer writes include recording changes in the security policy metadata database. Image storage layer writes include synchronous updates in the security policy storage area of ​​the cloud host image. Consistency verification involves comparing the write results from two different locations, and the change only takes effect if they are completely consistent. If the verification fails, an alarm is triggered and a rollback is initiated.

[0078] This embodiment avoids single points of failure by synchronizing metadata and mirror storage, and dual storage verification ensures 100% accuracy of policy modifications.

[0079] Optionally, before parsing the inbound request to obtain the data packet carried by the inbound request upon receiving an inbound request from an external device, the method further includes:

[0080] During the creation of the cloud host, the management security group is created based on the baseline library of the cloud platform where the cloud host is deployed;

[0081] Obtain multiple service tags corresponding to the multiple services included in the cloud host;

[0082] Calculate the multiple hash values ​​corresponding to the multiple business tags;

[0083] Multiple security subdomains are determined based on the multiple hash values, and the mutual trust security group is created based on the multiple security subdomains;

[0084] The user security group is created based on the management security group and the mutual trust security group.

[0085] In this embodiment, three security groups are automatically mounted when a cloud host is created: the management security group, which carries VPC-level basic policies (such as monitoring ports and audit logs); the mutual trust security group, which enables mutual trust between hosts within the same security subdomain; and the user security group, which allows tenants to customize business policies. An immutable flag is set: BSG / TDSG prevents users from uninstalling the host via the `immutable_flag`.

[0086] When a host is created, the Permission Isolation Controller (PSE) executes three security group mounting processes: First, it loads BSG rules from the VPC baseline library. Then, it retrieves the host's service tag from the cloud platform's CMDB system, calculates the hash value of the service tag, allocates an SSD based on the hash value, and associates the SSD with a TDSG. Next, it creates an empty UDSG for tenants to define custom service policies. Finally, at the metadata layer, it locks the BSG / TDSG unloading interface by setting the "immutable_flag," preventing users from unloading the BSG / TDSG.

[0087] The Python code implementation is as follows:

[0088] def bind_security_groups(host):

[0089] # Fixed binding to three security groups

[0090] host.attach_group(get_bsg(vpc_id)) # Manage security groups

[0091] host.attach_group(get_tdsg(ssd_id)) # Mutual Trust Security Group

[0092] host.attach_group(create_udsg()) # User security group

[0093] # Set the non-removable flag

[0094] host.set_immutable_flag([BSG, TDSG]).

[0095] Optionally, after determining multiple security subdomains based on the multiple hash values ​​and generating the mutual trust security group according to the multiple security subdomains, the method further includes:

[0096] If the service tag corresponding to the first service and the service tag corresponding to the second service are the same, the first service and the second service are assigned to the same security subdomain, and the data access permissions between the first service and the second service are set to be interoperable. The first service and the second service are any two different services among the plurality of services.

[0097] In this embodiment, a business tag is metadata used to identify a business, and it may be categorized based on the business's type, function, or other characteristics. In this scenario, each business has a corresponding business tag. When two businesses have the same tag, the system assigns them to the same security subdomain. This improves security and simplifies management because businesses within the same subdomain can share the same security policies and access controls. After being assigned to the same subdomain, the data access permissions between the first and second businesses are set to be interoperable. This means that the two businesses can access each other's data, rather than being isolated. This interoperability is typically used to achieve collaboration between businesses, such as data sharing and service calls.

[0098] Specifically, in this embodiment, host business tags (such as payment service clusters / risk control systems) are obtained from the cloud platform CMDB system. The business tags are mapped to SSD numbers (hash space: 0~1023) using a consistent hashing algorithm. Example: Payment service cluster → hash value 357 → SSD_357 (cluster number = 357). In this embodiment, permission separation is implemented through the following strategies: Management policies: BSGs are predefined by the administrator at the VPC level (e.g., audit log collection policies); Business policies: UDSGs are customized by the tenant at the host level (e.g., opening web service ports); Physical isolation: BSG rules are stored in an independent security policy database, physically separated from the user policy database.

[0099] When determining whether a host belongs to the same business unit, the determination is made based on the host deployment topology (Kubernetes Node group / KVM cluster) or by automatic inheritance of business tags (e.g., inheriting the business tags of the project group when the host is created). Zero-trust interoperability is implemented through TDSG built-in rules: allowing traffic within the same SSD (five-tuple restriction) and denying direct connections across SSDs (requiring a security gateway).

[0100] In feasible implementations, such as Figure 4 As shown, Figure 4 This is the overall architecture diagram for this application, including a policy persistence engine, a permission isolation controller, and a security subdomain management module (SSD Manager). The policy persistence engine forces the mounting of Layer 3 security groups when a cloud host is created. The permission isolation controller implements the read-only locking mechanism of BSG / TDSG. The security subdomain management module dynamically divides isolation domains according to business units.

[0101] As shown in Table 2, the physical isolation architecture of the three groups in this application ensures that the BSG is not offloaded, and the related technical solutions do not have hardware-level lock-in. Therefore, the physical isolation architecture in this proposal is irreplaceable. This application uses a hierarchical priority model (also known as a three-layer circuit breaker model) to solidify policy priorities. Traditional solutions cannot guarantee a fixed order of BSG>TDSG>UDSG. Based on the tags of business units, SSDs are automatically partitioned. The automatic synchronization mechanism of SSDs ensures that business unit policies take effect in real time. In existing technologies, tag-based solutions require manual maintenance of policy consistency.

[0102] Table 2

[0103] Strategy Conflict Rate XX Cloud's actual test result: 23.7% The experimental environment measured 0.2%. Reduced by more than 98% The tiered circuit breaker model avoids rule overlap and has clear priorities. Fault location time Average 3.5 hours Average 38 minutes shortened by 82% A fixed three-layer structure reduces the complexity of rule queries to O(1). Access Control Users can modify all rules. BSG / TDSG Administrator Exclusive Achieving the separation of powers The PIC module implements differentiated permission policies for BSG / TDSG / UDSG. Architectural complexity A single host can be bound to 5-20 security groups. Fixed 3 security groups Configuration items reduced by 70% By replacing dynamic group stacking with a three-layer physical isolation model (BSG / TDSG / UDSG), the number of bound groups is reduced to a constant 3.

[0104] The technical solution of this application, upon receiving an inbound request from an external device, parses the inbound request to obtain the data packet carried by the inbound request, and then matches the data packet with the rules corresponding to the management security group, mutual trust security group, and user security group included in the cloud host. If the data information of the data packet conforms to the rule corresponding to any security group, the external device is granted permission to access the target service. This achieves clear division of multiple security groups included in the cloud host and determines the rules corresponding to each security group, thereby improving the processing efficiency of the cloud host for access requests.

[0105] See Figure 5 , Figure 5 This is a structural diagram of the request processing apparatus provided in an embodiment of this application. For example... Figure 5 As shown, the request processing device 500 includes:

[0106] The request parsing module 510 is used to parse the inbound request when it receives an inbound request sent by an external device, and obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host.

[0107] The permission opening module 520 is used to grant the external device permission to access the target service when the data packet matches the rules set by the target security group included in the cloud host. The rules set by the target security group are used to restrict the data information of the external device allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external device. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

[0108] Optionally, the request parsing module includes:

[0109] The identification submodule is used to identify the identity of the external device upon receiving an inbound request from the external device, and obtain identity information. The external device is an external client or a cloud host other than the cloud host.

[0110] The parsing submodule is used to parse the inbound request after the identity information has been securely verified and the verification result indicates that the identity of the external device is secure, to obtain the data packet carried by the inbound request. The data packet includes: the Internet Protocol IP address of the external device, the IP address of the target service, the protocol of the external device, the port information of the external device, and the port information of the target service.

[0111] Optional, also includes:

[0112] The first matching module is used to determine that the data packet matches the rules set by the management security group when the IP address of the target service matches the rules set by the management security group and the port information of the target service matches the rules set by the management security group.

[0113] The second matching module is used to determine that the data packet matches the rules set by the mutual trust security group when the IP address of the target service does not match the rules set by the management security group, the port information of the target service matches the rules set by the management security group, the IP address of the target service matches the rules set by the mutual trust security group, and the port information of the target service matches the rules set by the mutual trust security group.

[0114] The third matching module is used to determine that the data packet matches the rules set by the user security group when the IP address of the target service does not match the rules set by the management security group, the port information of the target service matches the rules set by the management security group, the IP address of the target service does not match the rules set by the mutual trust security group, and the data packet matches the rules set by the user security group.

[0115] Optionally, the cloud host further includes a metadata layer and an image storage layer, and also includes:

[0116] The writing module is used to write data to the metadata layer based on the modification request when a modification request is received, to obtain a first writing result, and to write data to the image storage layer based on the modification request, to obtain a second writing result. The modification request is used to request modification of the management security group or the mutual trust security group.

[0117] The first calculation module is used to calculate the first hash value corresponding to the first write result and to calculate the second hash value corresponding to the second write result;

[0118] The rollback module is used to roll back the modification request in the metadata layer and the image storage layer if the first hash value is different from the second hash value.

[0119] Optional, also includes:

[0120] The first creation module is used to create the management security group based on the baseline library of the cloud platform on which the cloud host is deployed during the creation of the cloud host.

[0121] The acquisition module is used to acquire multiple service tags corresponding to the multiple services included in the cloud host;

[0122] The second calculation module is used to calculate the multiple hash values ​​corresponding to the multiple business tags;

[0123] The determination module is used to determine multiple security subdomains based on the multiple hash values, and to create the mutual trust security group according to the multiple security subdomains;

[0124] The second creation module is used to create the user security group based on the management security group and the mutual trust security group.

[0125] Optional, also includes:

[0126] The allocation module is used to allocate the first service and the second service to the same security subdomain when the service tags corresponding to the first service and the second service are the same, and to set the data access permissions between the first service and the second service to be interoperable, wherein the first service and the second service are any two different services among the plurality of services.

[0127] The technical solution of this application, upon receiving an inbound request from an external device, parses the inbound request to obtain the data packet carried by the inbound request, and then matches the data packet with the rules corresponding to the management security group, mutual trust security group, and user security group included in the cloud host. If the data information of the data packet conforms to the rule corresponding to any security group, the external device is granted permission to access the target service. This achieves clear division of multiple security groups included in the cloud host and determines the rules corresponding to each security group, thereby improving the processing efficiency of the cloud host for access requests.

[0128] This application also provides an electronic device. Please refer to... Figure 6 The electronic device may include a processor 601, a memory 602, and a program 6021 stored in the memory 602 and capable of running on the processor 601.

[0129] When program 6021 is executed by processor 601, it can achieve the following: Figure 1 Any step in the corresponding method embodiment:

[0130] Upon receiving an inbound request from an external device, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host.

[0131] If the data packet matches the rules set by the target security group included in the cloud host, the external device is granted permission to access the target service. The rules set by the target security group are used to restrict the data information of the external device that is allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external device. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

[0132] Optionally, upon receiving an inbound request from an external device, parsing the inbound request to obtain the data packet carried by the inbound request includes:

[0133] Upon receiving an inbound request from an external device, the identity of the external device is identified to obtain its identity information. The external device is either an external client or a cloud host other than the cloud host mentioned above.

[0134] If the identity information is verified and the verification result indicates that the external device is secure, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes: the Internet Protocol IP address of the external device, the IP address of the target service, the protocol of the external device, the port information of the external device, and the port information of the target service.

[0135] Optionally, before granting the external device access to the target service if the data packet matches the rules set in the target security group included in the cloud host, the method further includes:

[0136] If the IP address of the target service matches the rules set by the management security group, and the port information of the target service matches the rules set by the management security group, then the data packet is determined to match the rules set by the management security group.

[0137] If the IP address of the target service does not match the rules set by the management security group, but the port information of the target service matches the rules set by the management security group, and the IP address of the target service matches the rules set by the mutual trust security group, and the port information of the target service matches the rules set by the mutual trust security group, then it is determined that the data packet matches the rules set by the mutual trust security group.

[0138] If the IP address of the target service does not match the rules set by the management security group, the port information of the target service matches the rules set by the management security group, the IP address of the target service does not match the rules set by the mutual trust security group, the port information of the target service does not match the rules set by the mutual trust security group, and the data packet matches the rules set by the user security group, then it is determined that the data packet matches the rules set by the user security group.

[0139] Optionally, the cloud host further includes a metadata layer and an image storage layer, and the method further includes:

[0140] Upon receiving a modification request, data is written to the metadata layer based on the modification request to obtain a first write result, and data is written to the image storage layer based on the modification request to obtain a second write result. The modification request is used to request modification of the management security group or the mutual trust security group.

[0141] Calculate the first hash value corresponding to the first write result, and calculate the second hash value corresponding to the second write result;

[0142] If the first hash value is different from the second hash value, the modification request is rolled back in the metadata layer and the image storage layer.

[0143] Optionally, before parsing the inbound request to obtain the data packet carried by the inbound request upon receiving an inbound request from an external device, the method further includes:

[0144] During the creation of the cloud host, the management security group is created based on the baseline library of the cloud platform where the cloud host is deployed;

[0145] Obtain multiple service tags corresponding to the multiple services included in the cloud host;

[0146] Calculate the multiple hash values ​​corresponding to the multiple business tags;

[0147] Multiple security subdomains are determined based on the multiple hash values, and the mutual trust security group is created based on the multiple security subdomains;

[0148] The user security group is created based on the management security group and the mutual trust security group.

[0149] Optionally, after determining multiple security subdomains based on the multiple hash values ​​and generating the mutual trust security group according to the multiple security subdomains, the method further includes:

[0150] If the service tag corresponding to the first service is the same as the service tag corresponding to the second service, the first service and the second service are assigned to the same security subdomain, and the data access permissions between the first service and the second service are set to be interoperable. The first service and the second service are any two different services among the plurality of services.

[0151] The technical solution of this application, upon receiving an inbound request from an external device, parses the inbound request to obtain the data packet carried by the inbound request, and then matches the data packet with the rules corresponding to the management security group, mutual trust security group, and user security group included in the cloud host. If the data information of the data packet conforms to the rule corresponding to any security group, the external device is granted permission to access the target service. This achieves clear division of multiple security groups included in the cloud host and determines the rules corresponding to each security group, thereby improving the processing efficiency of the cloud host for access requests.

[0152] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described request processing embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0153] This application also provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above-described request processing method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0154] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0155] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a communication device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0156] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A request processing method, characterized in that, Applied to cloud servers, the method includes: Upon receiving an inbound request from an external device, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host. If the data packet matches the rules set by the target security group included in the cloud host, the external device is granted permission to access the target service. The rules set by the target security group are used to restrict the data information of the external device allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external device. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

2. The method according to claim 1, characterized in that, Upon receiving an inbound request from an external device, the inbound request is parsed to obtain the data packet carried by the inbound request, including: Upon receiving an inbound request from an external device, the identity of the external device is identified to obtain its identity information. The external device is either an external client or a cloud host other than the cloud host itself. If the identity information is verified and the verification result indicates that the external device is secure, the inbound request is parsed to obtain the data packet carried by the inbound request. The data packet includes: the Internet Protocol IP address of the external device, the IP address of the target service, the protocol of the external device, the port information of the external device, and the port information of the target service.

3. The method according to claim 2, characterized in that, Before granting the external device access to the target service when the data packet matches the rules set in the target security group included in the cloud host, the method further includes: If the IP address of the target service matches the rules set by the management security group, and the port information of the target service matches the rules set by the management security group, then the data packet is determined to match the rules set by the management security group. If the IP address of the target service does not match the rules set by the management security group, but the port information of the target service matches the rules set by the management security group, and the IP address of the target service matches the rules set by the mutual trust security group, and the port information of the target service matches the rules set by the mutual trust security group, then it is determined that the data packet matches the rules set by the mutual trust security group. If the IP address of the target service does not match the rules set by the management security group, the port information of the target service matches the rules set by the management security group, the IP address of the target service does not match the rules set by the mutual trust security group, and the data packet matches the rules set by the user security group, then it is determined that the data packet matches the rules set by the user security group.

4. The method according to claim 1, characterized in that, The cloud host also includes a metadata layer and an image storage layer, and the method further includes: Upon receiving a modification request, data is written to the metadata layer based on the modification request to obtain a first write result, and data is written to the image storage layer based on the modification request to obtain a second write result. The modification request is used to request modification of the management security group or the mutual trust security group. Calculate the first hash value corresponding to the first write result, and calculate the second hash value corresponding to the second write result; If the first hash value is different from the second hash value, the modification request is rolled back in the metadata layer and the image storage layer.

5. The method according to claim 1, characterized in that, Before parsing the inbound request to obtain the data packet carried by the inbound request upon receiving an inbound request from an external device, the method further includes: During the creation of the cloud host, the management security group is created based on the baseline library of the cloud platform where the cloud host is deployed; Obtain multiple service tags corresponding to the multiple services included in the cloud host; Calculate the multiple hash values ​​corresponding to the multiple business tags; Multiple security subdomains are determined based on the multiple hash values, and the mutual trust security group is created based on the multiple security subdomains; The user security group is created based on the management security group and the mutual trust security group.

6. The method according to claim 5, characterized in that, After determining multiple security subdomains based on the multiple hash values ​​and generating the mutual trust security group according to the multiple security subdomains, the method further includes: If the service tag corresponding to the first service is the same as the service tag corresponding to the second service, the first service and the second service are assigned to the same security subdomain, and the data access permissions between the first service and the second service are set to be interoperable. The first service and the second service are any two different services among the plurality of services.

7. A request processing apparatus, characterized in that, Applied to cloud servers, the device includes: The request parsing module is used to parse the inbound request when it receives an inbound request sent by an external device, and obtain the data packet carried by the inbound request. The data packet includes data information of the external device for network communication. The inbound request is used to request access to the target service in the cloud host. The permission opening module is used to grant external devices access to the target service when the data packet matches the rules set by the target security group included in the cloud host. The rules set by the target security group are used to restrict the data information of the external devices allowed to access the target service for network communication. The cloud host includes a management security group, a mutual trust security group, and a user security group. The management security group is used to store the basic policies of the cloud host. The mutual trust security group is used to enable communication among multiple security subdomains within the cloud host. The user security group is used to provide customized services for the external devices. The target security group is any one of the management security group, the mutual trust security group, and the user security group.

8. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 6.

Images