A method, apparatus and system for communication between edge cloud and central cloud

Abstract

A kind of edge cloud and the communication method, device and system of central cloud, can guarantee the access of client to cloud service when the connection failure between edge site and cloud management platform.In the method, first, edge site obtains the access authentication information of cloud service from cloud management platform by connection channel, and, edge site records access authentication information.Second, edge site receives the first access request for cloud service sent by the client of edge site.Then, edge site determines that connection channel fails.Then, edge site authenticates first access request according to access authentication information recorded by itself, and allows client to access cloud service in the case where first access request is authenticated.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and in particular to a communication method, apparatus and system for edge cloud and central cloud. Background Technology

[0002] In cloud technology, the cloud management platform located in the central cloud acts as the management plane, used to manage client access to cloud services (such as requesting to start compute instances). When a client needs to access a cloud service, it interacts with the cloud management platform through an edge site on the client side to perform cloud service authentication and other tasks, thereby enabling access to the cloud service.

[0003] The edge site and the cloud management platform are connected via a network. Network failures between the edge site and the cloud management platform, such as fiber optic cable breaks, unpaid bills, or relay equipment malfunctions, can cause the cloud management platform to lose connectivity, thus affecting client access to cloud services; for example, clients may be unable to access some or all cloud services. Summary of the Invention

[0004] This application provides a communication method, apparatus, and system between edge cloud and central cloud, which can ensure client access to cloud services when the connection channel between edge site and cloud management platform fails.

[0005] Firstly, a communication method between an edge cloud and a central cloud is provided. The edge cloud has edge sites, and the central cloud has a cloud management platform. The edge cloud also provides cloud services. In some embodiments, the cloud services are deployed at the edge sites. In some embodiments, the cloud services are deployed outside the edge sites. The cloud management platform manages the access authentication information of the cloud services. A connection channel is established between the edge cloud and the central cloud, which can be used to connect the edge cloud and the central cloud. In some embodiments, the access authentication information includes any one or more of public keys, client information, and context attributes.

[0006] In this method, firstly, the edge site obtains access authentication information for the cloud service from the cloud management platform through a connection channel, and records this access authentication information. Secondly, the edge site receives a first access request for the cloud service sent by a client of the edge site. Next, the edge site determines that the connection channel has failed. Then, the edge site authenticates the first access request based on its recorded access authentication information, and if the first access request is successfully authenticated, allows the client to access the cloud service.

[0007] This method allows the edge site to authenticate client access requests for cloud services based on pre-obtained authentication information from the cloud management platform when the connection between the edge site and the cloud management platform fails. In other words, access requests can still be authenticated even when the connection between the edge site and the cloud management platform is down. If the access request for the cloud service is successfully authenticated, the edge site can allow the client to access the cloud service. Therefore, even when the connection between the edge site and the cloud management platform fails, the client can still access the relevant cloud service, thus mitigating or avoiding the impact of the cloud management platform's downtime on client access to cloud services.

[0008] In one possible implementation, the method further includes: an edge site receiving a second access request for a cloud service sent by a client; the edge site determining that the fault in the connection channel has been repaired; the edge site sending the second access request to a cloud management platform through the connection channel; wherein the cloud management platform is used to authenticate the second access request based on the access authentication information of the cloud services it manages, and allows the client to access the cloud service if the second access request is authenticated.

[0009] In this implementation, once the fault in the connection channel between the edge site and the cloud management platform has been repaired, the cloud management platform authenticates the access requests received by the edge site, thereby saving the computing power of the edge site.

[0010] In one possible implementation, the edge site obtains access authentication information for cloud services from the cloud management platform through a connection channel, including: the edge site periodically obtains access authentication information for cloud services from the cloud management platform through the connection channel; the edge site records the access authentication information, including: the edge site updates the access authentication information recorded by the edge site based on the currently obtained access authentication information for cloud services.

[0011] In this implementation, the edge site can periodically update its own recorded access authentication information to ensure that the access authentication information recorded by the edge site is consistent with the access authentication information in the cloud management platform.

[0012] In one possible implementation, the cloud management platform is also used to manage the access control policy of the cloud service. The method further includes: the edge site obtaining the access control policy from the cloud management platform; the edge site recording the access control policy; wherein the cloud service obtains the access control policy recorded by the edge site and accepts or rejects the access request according to the access control policy.

[0013] In this implementation, the edge site can also obtain and record the access control policies of the cloud service managed by the cloud management platform, enabling the cloud service to obtain access control policies from the edge site. Thus, when it is inconvenient for the cloud service to obtain access control policies from the cloud management platform (e.g., due to network failure between the cloud service and the cloud management platform), the cloud service can obtain access control policies from the edge site, ensuring the cloud service's control over access requests.

[0014] In one possible implementation, the cloud service includes a compute instance management cloud service, where the first access request is used to request compute instance management for the client. For example, the compute instance may be a virtual machine. Compute instance management may involve starting or stopping the compute instance.

[0015] In this implementation, when the connection channel between the edge site and the cloud management platform fails, the computing instance can be managed without waiting for the connection channel to be repaired, thereby enabling timely management of computing instances (such as starting or stopping them) and improving the client experience.

[0016] Secondly, a communication device between an edge cloud and a central cloud is provided. The edge cloud has edge sites, and the central cloud has a cloud management platform. Cloud services are deployed on the edge sites. Access authentication information for the cloud services is managed by the cloud management platform. A connection channel is established between the edge cloud and the central cloud. The communication device is configured at the edge site. The communication device includes: an acquisition module for acquiring access authentication information for the cloud services from the cloud management platform through the connection channel; a recording module for recording the access authentication information; a receiving module for receiving a first access request for the cloud services sent by a client at the edge site; a determination module for determining that the connection channel has failed; and an authentication module for authenticating the first access request based on its own recorded access authentication information, and allowing the client to access the cloud services if the first access request is successfully authenticated.

[0017] In one possible implementation, the logging module is used to cache access authentication information.

[0018] In one possible implementation, the receiving module is further configured to: receive a second access request for the cloud service sent by the client; the determining module is further configured to: determine that the fault of the connection channel has been repaired; the authentication module is further configured to: send the second access request to the cloud management platform through the connection channel; wherein the cloud management platform is configured to authenticate the second access request based on the access authentication information of the cloud services it manages, and allow the client to access the cloud service if the second access request is authenticated.

[0019] In one possible implementation, the acquisition module is used for: the edge site periodically acquiring access authentication information of cloud services from the cloud management platform through the connection channel; the recording module is used for: the edge site updating the access authentication information recorded by the edge site based on the currently acquired access authentication information of cloud services.

[0020] In one possible implementation, the cloud service includes a compute instance management cloud service, and the first access request is used to request compute instance management for the client.

[0021] In one possible implementation, the access authentication information for cloud services includes one or more of the following: public key, client information, and context attributes.

[0022] Thirdly, a computing device cluster is provided, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, such that the computing device cluster performs the method provided in the first aspect.

[0023] Fourthly, a computer-readable storage medium is provided, including computer program instructions that, when executed by a cluster of computing devices, perform the method provided in the first aspect.

[0024] Fifthly, a computer program product containing instructions is provided, which, when executed by a cluster of computer devices, cause the cluster of computer devices to perform the method provided in the first aspect.

[0025] Sixthly, a communication system between an edge cloud and a central cloud is provided. This system includes: an edge cloud with edge stations; and a central cloud with a cloud management platform. The edge stations deploy cloud services. Access authentication information for the cloud services is managed by the cloud management platform. A connection channel is established between the edge cloud and the central cloud. The edge stations are used to obtain access authentication information for the cloud services from the cloud management platform through the connection channel. The edge stations are used to record the access authentication information. The edge stations are used to receive a first access request for the cloud services sent by a client of the edge station. The edge stations are used to determine if the connection channel has failed. The edge stations are used to authenticate the first access request based on their recorded access authentication information, and, if the first access request is successfully authenticated, allow the client to access the cloud services.

[0026] The beneficial effects of aspects two through six can be found in the above description of the beneficial effects of aspect one, and will not be repeated here. Attached Figure Description

[0027] Figure 1A This is a schematic diagram of a system provided in an embodiment of this application;

[0028] Figure 1B This is a schematic diagram of another system provided in an embodiment of this application;

[0029] Figure 2 This is a schematic diagram of yet another system provided in an embodiment of this application;

[0030] Figure 3 This is a schematic diagram of yet another system provided in an embodiment of this application;

[0031] Figure 4 This is a schematic diagram of yet another system provided in an embodiment of this application;

[0032] Figure 5 This is a flowchart illustrating a communication method between an edge cloud and a central cloud, as provided in an embodiment of this application.

[0033] Figure 6 This is a flowchart of another communication method between edge cloud and central cloud provided in an embodiment of this application;

[0034] Figure 7 This is a schematic diagram of the structure of an edge station provided in an embodiment of this application;

[0035] Figure 8 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0036] Figure 9 This is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0037] Figure 10 This is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application. Detailed Implementation

[0038] The solutions provided in the embodiments of this application will now be described with reference to the accompanying drawings. In the embodiments of this application, "multiple" refers to two or more objects, and "various types" refers to two or more types. Terms such as "first," "second," etc., are only used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0039] To facilitate understanding of the solutions provided in the embodiments of this application, the technical terms that may be involved in the embodiments of this application will be introduced first.

[0040] Cloud technology refers to a managed service that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to enable data computing, storage, processing, and sharing.

[0041] Cloud management platform: This is a platform provided by cloud service providers for interacting with clients. Clients can register an account on the management platform and use that account to rent or access computing instances, services, etc. managed by the cloud management platform.

[0042] Edge cloud is a distributed architecture that integrates cloud computing and edge computing. It pushes computing power, storage and other resources to the network edge to form a small-scale cloud data center close to the client, so as to achieve low latency and high response service capabilities.

[0043] Centralized cloud: This is the core form of traditional cloud computing. It adopts a centralized architecture, which aggregates computing, storage and other resources in a large-scale data center, and provides on-demand and elastically scalable cloud services to clients through virtualization technology.

[0044] Client: This refers to the application or software module that runs on the client terminal device (such as IoT device, personal computer, mobile terminal, etc.), and is responsible for interacting with the cloud management platform or edge site to realize functions such as data collection, command execution and service request.

[0045] A data center is a dedicated physical facility used for the centralized storage, processing, and distribution of data. It typically consists of computing devices, storage systems, network equipment, power supplies, and cooling systems. The computing devices can be servers.

[0046] Cloud service refers to a service deployed by a cloud service provider to enable related business operations. Cloud services can include compute instance management services (such as services for starting or stopping compute instances), model inference services (large language model (LLM)), etc. Cloud services can be deployed in edge clouds or central clouds. Cloud services in edge clouds can be deployed at edge sites or in other racks or servers within the edge cloud. For example, cloud services can be provided by applications (APPs), which can run on compute instances. Cloud service providers can deploy compute instances and applications within those instances.

[0047] Access request: This refers to a request used to access a cloud service. Access requests can be used to request cloud services to perform related operations, such as requesting the compute instance management cloud service to start or stop a compute instance.

[0048] A compute instance, also known as a virtual computing device or virtual computing instance, refers to a complete computer system simulated by software, possessing a complete hardware system and running in a completely isolated environment. The hardware system of a compute instance is a virtual hardware system derived from physical hardware. A complete compute instance has an independent virtual computing system (e.g., a central processing unit (CPU)) and a virtual disk. Compute instances that need to communicate with the outside world also have independent virtual network interface cards (NICs). Typical compute instances include virtual machines (VMs), containers, and elastic cloud servers (ECS).

[0049] Computing resources, often simply referred to as resources, refer to the hardware, software, and data that support the operation of cloud services and enable their functions. For example, computing resources can include processor resources, storage resources, and network resources. Processor resources can be central processing units (CPUs), graphics processing units (GPUs), etc. Storage resources can be memory, video memory, hard disks, etc. Network resources can be network interface controllers (NICs), bandwidth, etc. Furthermore, CPUs, GPUs, memory, hard disks, and NICs can be physical hardware or virtualized versions of physical hardware.

[0050] Access authentication information refers to information used to verify the identity of the client making the access request. The client identity refers to the identity of the client issuing the access request. Access authentication information can be used to determine whether the client's identity is legitimate. Typically, when an organization purchases or rents a cloud service, members within that organization are legitimate clients of the cloud service, and members outside the organization deploy legitimate clients of the cloud service. Access authentication information typically includes one or more of the following: public key, client information (user profile), and context attributes. The public key corresponds to the private key; the private key signs the access request, and the public key verifies the signature of the access request. If signature verification fails, the access request is not authenticated. If signature verification succeeds, the access request is authenticated or proceeds to the next step of authentication.

[0051] Access control policy, also known as authentication policy, is a strategy used to determine whether an access request has the necessary permissions to access a cloud service. Different members within an organization may have different roles and different permissions; for example, an administrator's permissions differ from those of a regular client. The cloud service's access control policy specifies which roles have the permission to access the cloud service and which roles do not. The cloud service can accept or deny access requests based on its access control policy. Specifically, if the client issuing the access request has permissions that comply with the access control policy, the cloud service accepts the access request. If the client issuing the access request has permissions that do not comply with the access control policy, the cloud service denies the access request.

[0052] Public network: Also known as the Internet, it is a globally interconnected network that enables interconnection between different Internet service providers (ISPs). The core characteristics of the public network are its global reach and openness; any client with the appropriate permissions and device can access it. Each device connected to the public network has a unique public Internet Protocol (IP) address, allowing devices to communicate directly via their public IP addresses.

[0053] Backbone network: also known as cloud backbone network, is a network deployed by cloud service providers to connect edge sites and central cloud.

[0054] Edge sites are compute nodes, servers, racks, or data centers located in the edge cloud. Edge sites rely on a unified architecture from the cloud provider to offer fully managed cloud services and can access cloud data centers, hosting space, or enterprise server rooms. Edge sites provide application programming interfaces (APIs), consoles, tools, and infrastructure hardware that are completely consistent with the cloud provider's on the client's local machine, enabling consistent cloud services to be provided locally.

[0055] In cloud technology, edge sites are located in edge clouds, while the cloud management platform is located in the central cloud (i.e., the remote end of the client). Edge sites and the cloud management platform are connected via public networks or dedicated lines (such as backbone networks). This connection can fail, for example, due to physical line (e.g., fiber optic cable) breaks or relay equipment (e.g., switch) malfunctions. This connection failure causes the edge site to lose contact with the cloud management platform, resulting in the client being unable to access some or all cloud services. For example, in a cloud desktop (workspace) scenario, the client needs to access the virtual machine management cloud service to start or stop virtual machines. The client sends an access request for the virtual machine management cloud service to the cloud management platform through the edge site. After authenticating the request, the cloud management platform forwards it to the virtual machine management cloud service to request the start or stop of the virtual machine. If the edge site loses contact with the cloud management platform, the access request cannot be authenticated, and therefore cannot be forwarded to the virtual machine management cloud service; thus, the start or stop of the virtual machine cannot be performed. Furthermore, while connection channel failures can be repaired, the repair time exceeds the client's tolerance. Therefore, connection channel failures between edge sites and the cloud management platform negatively impact the client experience.

[0056] This application provides a communication method between an edge cloud and a central cloud. When the connection channel between the edge site and the cloud management platform fails, the edge site can authenticate access requests from clients. If the access request is successfully authenticated, the client is allowed to access the corresponding cloud service, thus ensuring a better user experience.

[0057] Next, the method provided in the embodiments of this application will be described.

[0058] Figure 1 illustrates a system that can be used to implement this method. As shown in Figure 1, the system includes an edge cloud and a central cloud; the edge cloud is equipped with edge sites, and the central cloud is equipped with a cloud management platform. A connection channel is established between the edge sites and the cloud management platform to connect them. In one example, this connection channel can be a public network. In another example, the connection channel can be a backbone network.

[0059] Edge cloud deployments include cloud services. In some embodiments, such as Figure 1A As shown, the cloud service is deployed at the edge site of the edge cloud, meaning that the cloud service is deployed at the edge site. In some embodiments, such as Figure 1B As shown, cloud services in the edge cloud are deployed outside the edge sites of the edge cloud. In other words, cloud services and edge sites are both in the edge cloud, but cloud services and edge sites are deployed independently.

[0060] In some embodiments, the cloud service may be a compute instance management cloud service. This compute instance management cloud service, also known as a compute management component, is used to respond to access requests and perform management operations on compute instances. For example, if the access request is to start or stop a compute instance, the compute instance management service can respond to the access request and start or stop the compute instance accordingly. Exemplarily, a compute instance may be a virtual machine. Exemplarily, a compute instance may be deployed on one or more servers in an edge cloud.

[0061] In some embodiments, the cloud service may be a model inference cloud service, a data storage cloud service, or a rendering cloud service, etc.

[0062] A cloud management platform can be used to manage and store access authentication information for cloud services. For example, it can update public keys. Or, in response to client actions, it can update client information. For instance, as shown in Figure 1, a cloud management platform can include a unified identity and access management (IAM) module. The IAM module is used to manage and store access authentication information for cloud services.

[0063] Clients at the edge site can request access to cloud services. Specifically, a client can issue an access request for a cloud service to access it. For example, this client may be a local client at the edge site.

[0064] like Figure 2 As shown, assuming the connection between the cloud management platform and the edge site is functioning correctly, the cloud management platform authenticates clients accessing the cloud service. The edge site can send access requests from clients to the cloud management platform. Upon receiving an access request, the cloud management platform uses the access authentication information stored within the platform to authenticate the request. If authentication is successful, the cloud management platform allows the client to access the cloud service. Specifically, the cloud management platform can send the access request to the cloud service itself, enabling the client to access the service via this request.

[0065] like Figure 3 As shown, in the event of a connection failure between the edge site and the cloud management platform, the edge site can act as the cloud management platform to authenticate clients accessing cloud services. Specifically, the edge site authenticates the access requests sent by the clients. If authentication is successful, the edge node forwards the access request to the cloud service, allowing the client to access the cloud service through this request.

[0066] If the connection failure between the edge site and the cloud management platform has been resolved, the cloud management platform continues to authenticate clients accessing cloud services. In other words, once the connection failure between the edge site and the cloud management platform is resolved, the edge site can forward client access requests to the cloud management platform. Upon receiving an access request, the cloud management platform can use the access authentication information stored on the cloud management platform to authenticate the request. If authentication is successful, the cloud management platform allows the client to access the cloud service.

[0067] In some embodiments, such as Figure 4 As shown, an edge site may include an authentication module and an information recording module. The authentication module periodically retrieves access authentication information for cloud services from the cloud management platform. The information recording module records the access authentication information obtained by the authentication module. The information recording module has a cache, which can be used to store the access authentication information, thereby achieving the recording of access authentication information. For example, the cache could be a remote dictionary server (Redis).

[0068] In one example of this embodiment, such as Figure 4 As shown, the edge site may also include an information management module. The information management module can trigger the authentication module to retrieve cloud service access authentication information from the cloud management platform. The access authentication information recorded by the information recording module has a lifespan (e.g., 24 hours). The information management module can periodically (e.g., every 12 hours) query the remaining lifespan of the access authentication information recorded by the information recording module. If the remaining lifespan is less than a threshold, it triggers the authentication module to retrieve cloud service authentication information from the cloud management platform. Whenever the authentication module retrieves cloud service access authentication information from the cloud management platform, it updates the cloud service access authentication information recorded by the information recording module based on the currently retrieved cloud service access authentication information.

[0069] like Figure 4 As shown, the edge site also includes a selection module. This module selects either the cloud management platform or the authentication module to authenticate the access request, based on the status of the connection channel between the edge site and the cloud management platform. The connection channel status is categorized as faulty or not faulty. When the connection channel between the edge site and the cloud management platform is faulty, the selection module selects the authentication module to authenticate the access request. When the connection channel between the edge site and the cloud management platform is not faulty or the fault has been repaired, the selection module selects the cloud management platform to authenticate the access request. If the access request is successfully authenticated, either the authentication module or the cloud management platform can send the access request to the cloud service.

[0070] In some embodiments, the authentication module may be an API gateway (APIG). In some embodiments, the information management module may be an edge controller. In some embodiments, the selection module may be a cloud desktop access edge (WKS) component in a cloud desktop scenario. In some embodiments, the selection module may include a virtual private cloud endpoint (VPC EP). The VPC EP can perform conversion between the underlay network and the overlay network. The selection module can send access requests received through the overlay network to the authentication module through the underlay network, thereby forwarding the access requests to the authentication module through the virtual private cloud (VPC) plane.

[0071] The above example illustrates the system provided in the embodiments of this application. Next, the flow of the communication method between the edge cloud and the central cloud provided in the embodiments of this application will be described in conjunction with this system.

[0072] In some embodiments, such as Figure 5 As shown, the method may include the following steps.

[0073] The cloud management platform can perform step 501 to manage access authentication information for cloud services.

[0074] Cloud service access authentication information is used to authenticate access requests to the cloud service. In some embodiments, cloud service access authentication information may include one or more of the following: public key, client information, context attributes, etc.

[0075] The cloud management platform can derive public and private keys based on the client's access key (AK) and secret access key (SK) for cloud services. The public key is managed as the authentication information for cloud service access, while the private key is sent to the client so that the client holds the private key. For example, the private key can be sent to an edge site, which can then hold the private key on behalf of the client.

[0076] For example, client information may include the client's identifier (ID), client name, organization ID, and organization name. The client's identifier can be represented as `user_id` (string), and the client's name as `user_name` (string). The organization ID, also known as the requester's account ID, can be represented as `account_id` (string). The organization name, also known as the requester's account name, can be represented as `account_name` (string).

[0077] For example, context attributes may include the referrer for the Hypertext Transfer Protocol (HTTP), the user_agent field for the HTTP client proxy, the internet protocol (IP) of the request source, and the source IP of the VPC private network request. The HTTP referrer can be represented as a referrer string, the HTTP client proxy field as a user_agent string, the source IP as a source_ip string, and the source IP of the VPC private network request as vpc_source_ip string.

[0078] Managing cloud service access authentication information can include modifying or updating it. For example, to improve public key security, the public key can be updated periodically. Another example is that the cloud management platform can respond to actions from the administrator of the client's organization, modifying client information, context attributes, and other details in the cloud service's access authentication information. Managing cloud service access authentication information can also include storing it. In other words, cloud service access authentication information is recorded at least within the cloud management platform.

[0079] In some embodiments, the cloud management platform can manage access control policies for cloud services, such as modifying and saving access control policies for cloud services. For example, the access control policy for a cloud service may be as follows:

[0080]

[0081] In step 502, the authentication module in the edge site can obtain cloud service access authentication information from the cloud management platform via the connection channel. Then, in step 503, the authentication module sends the cloud service access authentication information obtained from the cloud management platform to the information recording module in the edge site. The information recording module can then execute step 504 to record the cloud service access authentication information. The information recording module can cache the cloud service access authentication information.

[0082] In some embodiments, the authentication module may further obtain the access control policy of the cloud service from the cloud management platform via the connection channel in step 502. Then, the authentication module may further send the access control policy of the cloud service obtained from the cloud management platform to the information recording module in step 503. The information recording module records the access control policy of the cloud service by executing step 504. The information recording module may cache the access control policy of the cloud service.

[0083] In some embodiments, the authentication module can obtain access authentication information and access control policies for cloud services from the cloud management platform based on a specified project ID.

[0084] In some embodiments, the access authentication information and access control policies of cloud services have a lifecycle, such as 24 hours. Access authentication information and access control policies whose lifecycle has not yet expired are in a valid state. If the lifecycle of the access authentication information and access control policies expires, they become invalid.

[0085] The authentication module can periodically execute step 502. That is, the authentication module can periodically obtain access authentication information and access control policies for cloud services from the cloud management platform. In each period, the authentication module can update the access authentication information and access control policies recorded by the information recording module based on the access authentication information and access control policies currently obtained from the cloud management platform (i.e., the access authentication information and access control policies obtained from the cloud management platform in the current period), to ensure that the access authentication information and access control policies recorded by the information recording module are in a valid state and synchronized with the cloud management platform.

[0086] For example, the information management module in the edge site can periodically trigger the authentication module to execute step 502. The information management module can periodically execute step 505 to query the access authentication information and the remaining lifespan of the access control policy recorded by the information recording module.

[0087] If the remaining lifecycle is greater than or equal to the threshold, the information management module may not trigger the authentication module to execute step 502.

[0088] If the remaining lifetime is less than the threshold, or if the access authentication information and access control policy recorded by the information recording module are empty, the information management module can execute step 506, instructing the authentication module to execute step 502 again, so as to trigger the authentication module to execute step 502.

[0089] The threshold can be a preset value, such as one-tenth of the entire life cycle or two-tenths of the entire life cycle.

[0090] Each time the authentication module executes step 502 again, the authentication module can execute step 507 to update the access authentication information and access control policy recorded by the information recording module based on the access authentication information and access control policy currently obtained from the cloud platform management platform.

[0091] The client can issue an access request for the cloud service. The selection module in the edge site can receive this access request through step 508. The selection module can then execute step 509 to determine if the connection channel between the edge site and the cloud management platform is faulty. The selection module can probe the connection channel between the edge site and the cloud management platform; for example, it can probe the connection channel according to the Internet Control Message Protocol (ICMP). For instance, the selection module can periodically probe (e.g., every 5 seconds). When multiple consecutive probes (e.g., 5 times) indicate that the latency of the connection channel exceeds a latency threshold, the connection channel is considered faulty. The latency threshold can be a preset value, such as 1 millisecond or 5 milliseconds.

[0092] When the selection module determines that the connection channel between the edge site and the cloud management platform is faulty, it can perform step 510 to send the access request to the authentication module in the edge site.

[0093] In some embodiments, the selection module may use the private key held by the client to sign the access request, and then send the signed access request to the authentication module through step 510.

[0094] In some embodiments, the address of the authentication module and the uniform resource name (URN) of the cloud service are registered with the selection module. In step 510, if the selection module determines that the access request is for accessing the cloud service represented by the URN and the connection channel between the edge site and the cloud management platform is faulty, it can switch the destination address of the access request to the address of the authentication module, so as to send the access request to the authentication module.

[0095] When the authentication module receives an access request for a cloud service, it can execute step 511 to obtain the access authentication information for the cloud service recorded by the information recording module. Next, the authentication module executes step 512 to authenticate the access request based on the access authentication information for the cloud service. In some embodiments, the access authentication information for the cloud service includes a public key, and the access request is signed with a private key. In step 512, the authentication module uses the public key to verify the signature of the access request. If the verification fails (e.g., the public key has expired or the access request is forged), it is determined that the access request has not been authenticated. If the verification succeeds, it is determined that the access request has been authenticated.

[0096] In some embodiments, if the access request fails authentication, the authentication module can return information indicating authentication failure to the selection module, meaning that the access request has not been authenticated. The selection module can then display this information to the client via the client.

[0097] If the access request is authenticated, the authentication module allows the client to access the cloud service. Specifically, the authentication module can execute step 513, sending the access request to the cloud service to allow the client to access it.

[0098] In some embodiments, the access authentication information for the cloud service may include client information and / or context attributes. After the access request is authenticated, the authentication module may add the client information and / or context attributes to the header of the access request.

[0099] Upon receiving the access request, the cloud service can execute step 516, performing the operation requested in the access request. Taking a compute instance management cloud service as an example, the access request can be used to request the cloud service to perform the operation of starting or stopping a compute instance. The cloud service can respond to the access request, starting or stopping the compute instance. For example, after performing the relevant operation, the cloud service can return indication information to the client. This indication information can indicate the operation result, such as operation success or operation failure. Taking starting a compute instance as an example, the operation result can be successful or failed.

[0100] In some embodiments, before executing step 516, the cloud service needs to authenticate the access request according to its access control policy. If the access request is authenticated, the cloud service executes the operation requested by the access request. If the access request is not authenticated, the cloud service refuses to execute the operation requested by the access request. In other words, the cloud service accepts or rejects the access request according to the access control policy.

[0101] like Figure 5As shown, after receiving an access request, the cloud service can execute step 514 to obtain the access control policy of the cloud service recorded by the information recording module. Then, it executes step 515 to authenticate the access request according to the access control policy.

[0102] The access request carries the permissions of the client issuing the request to the cloud service. In step 515, the cloud service can identify the client's permissions to the cloud service from the access request. If the client's permissions to the cloud service match the access control policy, the access request is deemed to have passed authentication. If the client's permissions to the cloud service do not match the access control policy, the access request is deemed to have failed authentication.

[0103] In some embodiments, as described above, the header of the access request carries client information and / or context attributes. In step 515, it can be determined whether the client information and / or the context attributes match the access control policy. If they match, the access request is determined to have passed authentication. If they do not match, the access request is determined to have failed authentication.

[0104] In some embodiments, the cloud service integrates an IAM software development kit (SDK). The IAM SDK, also known as the local authentication SDK, can include authentication calculation logic, access control policy parsing, and access control policy matching logic. The cloud service can invoke the IAM SDK to authenticate the client information and / or context attributes in the header of the access request according to the access control policy.

[0105] In some embodiments, the cloud service can periodically report its resource usage status (e.g., CPU utilization) to the cloud management platform, enabling the cloud management platform to obtain the resource usage status of the cloud service. Since the infrastructure is located locally at the edge site, this embodiment ensures consistency between the resource usage status obtained from the cloud and the edge.

[0106] In some embodiments, when the selection module receives an access request, if the connection channel between the edge site and the cloud management platform is not faulty or has been repaired, the selection module can send the access request to the cloud management platform. For example, the address of the cloud management platform and the URN of the cloud service are registered with the selection module. If the selection module determines that the access request is for accessing the cloud service represented by the URN, and that the connection channel between the edge site and the cloud management platform is not faulty or has been repaired, it can switch the destination address of the access request to the address of the cloud management platform to send the access request to the cloud management platform.

[0107] When the cloud management platform receives the access request, it can authenticate the request based on the access authentication information of the cloud services managed by the platform. For details on the implementation, please refer to the description of step 512 above.

[0108] If the access request is authenticated, the cloud management platform allows the client to access the cloud service. This can be achieved by sending the access request to the cloud service, allowing the client to access it via the request. The cloud service can authenticate access requests forwarded from the cloud management platform. Specifically, the cloud service can obtain its access control policy from the cloud management platform and authenticate the access request according to the policy. The implementation details for step 515 can be found in the explanation above.

[0109] When the access request is successfully authenticated, the cloud service performs the operation requested in the access request. The implementation details for step 516 can be found in the explanation above.

[0110] In summary, the edge cloud and central cloud communication method provided in this application embodiment enables the edge site to authenticate the access request sent by the client when the connection channel between the edge site and the cloud management platform fails, and allows the client to access cloud services if the access request is successfully authenticated, thereby ensuring the client's access to cloud services and guaranteeing the client's experience.

[0111] In some embodiments, in the event of a connection failure between the edge site and the cloud management platform, the edge site can also support local self-governance through solutions such as local power on / off control to prevent power-on failures from impacting customers' basic business operations.

[0112] In the following description, edge sites may be referred to as edge, and cloud management platforms may be referred to as cloud.

[0113] 1. Management components and gateways can be moved to edge sites. For example, APIG, VPC EP, and Cache can be moved to edge sites.

[0114] 2. Periodically cache certificates (e.g., APIG uses cached certificates to authenticate API requests) and authentication policies (e.g., the IAM SDK uses cached policies for authentication) at edge sites.

[0115] 3. The caller performs routing control: if the cloud-edge link is normal, the cloud-side API is called; if the cloud-edge connection is lost, the edge-local API is called.

[0116] The solution provided in this embodiment can be applied to distributed cloud scenarios. Distributed cloud scenarios include distributed cloud sites and distributed cloud hosts (1U / 2U form factors).

[0117] The proposed solution is as follows.

[0118] Cache related to the authentication phase:

[0119] 1. Move the Edge-Controller down to the edge to be responsible for the lifecycle management of authentication / authorization.

[0120] 2. Move APIG to the edge, so that microservices at the edge can register APIs and provide client access points for services.

[0121] 3. The APIG gateway is a management plane resource and is isolated from the tenant VPC. It needs to be pushed down to the edge of the VPC-Endpoint to provide the conversion from the underlying network to the overlay network. Tenants can access the service interface through the VPC plane.

[0122] 4. Deploy caches (such as Redis) to the edge to provide APIG with caching capabilities for public keys, client information (user profile), and context attributes, as well as the ability for microservices to retrieve relevant caches for authentication and authorization.

[0123] Edge-Controller periodically (e.g., every 12 hours) queries the status of the local cache. If the local cache is about to expire or has already expired, it re-caches the cache.

[0124] If the cache is not found / has expired / is about to expire: Call the APIG active caching interface to cache authentication information.

[0125] The projectID specified by Edge-Controller calls the cached interface of APIG.

[0126] APIG retrieves the public key from the cache. If the public key is not available locally or is about to expire, it calls the IAM interface to retrieve the public key and stores it in the local cache (default cache duration is 24 hours).

[0127] APIG specifies the projectID to retrieve client information from IAM and stores it in the local cache (default cache duration is 24 hours).

[0128] User profile: Client identification information, mainly including the following attributes:

[0129] account_id String The account ID of the requester;

[0130] account_name String The requester's account name;

[0131] user_id String Client ID;

[0132] user_name String Client name.

[0133] APIG obtains access control configuration data from IAM and caches it in the local cache (default cache duration is 24 hours), such as:

[0134]

[0135] Once a service or tenant detects a disconnection between the cloud and the edge, it proactively initiates an API flow switch, and the cloud service performs local authentication.

[0136] Taking workspace as an example, its wksAccessEdge component is responsible for probing the central control plane: if the interval is 5 seconds and it retryes 5 times, if the probe times out, it is considered a link failure. The virtual machine request is switched to the address and service URN registered on the internal APIG to make the API request to start the virtual machine. The public and private key pairs derived from the resource tenant's AK and SK are used, and the private key is used to sign the request.

[0137] After receiving a request, APIG performs signature verification on the request using the locally cached public key. If verification fails (public key expired or request forged), it returns an authentication failure. If verification succeeds, it adds client information and context attributes to the request header.

[0138] Referrer string HTTP protocol referrer;

[0139] user_agent string The HTTP protocol user_agent field;

[0140] source_ip string: The IP address of the request source;

[0141] vpc_source_ip string The source IP address of the VPC private network requested.

[0142] After receiving a request, the computing management component retrieves the authentication policy from the cache, obtains the client information and context attributes from the request header, calls the IAM SDK to perform authentication, performs the corresponding API operation if authentication is successful, and returns the corresponding result.

[0143] IAM SDK: IAM's local authentication SDK, which includes authentication calculation logic, access control policy parsing, and matching.

[0144] The cloud service needs to integrate the IAM SDK to distinguish whether to use local IAM SDK authentication or central IAM authentication through the request body.

[0145] Service resource status synchronization: After the cloud-edge network returns to normal, the client and service perform API flow switching, using the service standard domain name + URN to make API requests.

[0146] In addition, the service periodically reports the status of its resources. After the control plane obtains the latest status of the resources, it synchronizes the status to ensure the consistency of the cloud and edge resources.

[0147] Based on the above description, this application provides another communication method between an edge cloud and a central cloud. The edge cloud is equipped with edge sites, the central cloud is equipped with a cloud management platform, the edge sites deploy cloud services, the access authentication information of the cloud services is managed by the cloud management platform, and the edge cloud and the central cloud are connected by a channel. Figure 6 As shown, the method includes the following steps.

[0148] Step 601: The edge site obtains the access authentication information of the cloud service from the cloud management platform through the connection channel.

[0149] In some embodiments, the access authentication information for the cloud service includes one or more of the following: public key, client information, and context attributes.

[0150] In some embodiments, in step 601, the edge site periodically obtains access authentication information of the cloud service from the cloud management platform through the connection channel; the edge site records the access authentication information, including: the edge site updates the access authentication information recorded by the edge site according to the currently obtained access authentication information of the cloud service.

[0151] In some embodiments, the implementation of step 601 can be referred to the above description. Figure 5 The implementation of steps 502 and / or 506 is described below.

[0152] Step 602: The edge site records the access authentication information.

[0153] In some embodiments, the edge site caches the access authentication information, that is, the edge site records the access authentication information through caching.

[0154] In some embodiments, the implementation of step 602 can be referred to the above description. Figure 5 The implementation of steps 504 and / or 507 is described below.

[0155] Step 603: The edge site receives a first access request for the cloud service sent by the client of the edge site.

[0156] In some embodiments, the cloud service includes a compute instance management cloud service, and the first access request is used to request compute instance management for the client.

[0157] In some embodiments, the implementation of step 603 can be referred to the above description. Figure 5 The implementation of step 508 is described below.

[0158] Step 604: The edge site determines that the connection channel has failed.

[0159] In some embodiments, the implementation of step 604 can be referred to the above description. Figure 5 The implementation of step 509 is described below.

[0160] Step 605: The edge site authenticates the first access request based on its own recorded access authentication information, and if the first access request is successfully authenticated, allows the client to access the cloud service.

[0161] In some embodiments, the implementation of step 605 can be referred to the above description. Figure 5 The implementation of steps 510-516 is described below.

[0162] In some embodiments, the method further includes: the edge site receiving a second access request for the cloud service sent by the client; the edge site determining that the fault of the connection channel has been repaired; the edge site sending the second access request to the cloud management platform through the connection channel; wherein the cloud management platform is used to authenticate the second access request based on the access authentication information of the cloud service it manages, and allow the client to access the cloud service if the second access request is authenticated.

[0163] In some embodiments, the cloud management platform is further configured to manage access control policies for the cloud service. The method further includes: the edge site obtaining the access control policy from the cloud management platform; the edge site recording the access control policy; wherein the cloud service obtains the access control policy recorded by the edge site and accepts or rejects the access request according to the access control policy. Related implementation methods can be found in the above description. Figure 5 The implementation of steps 514-515 is described below.

[0164] Therefore, through the communication method between the edge cloud and the central cloud provided in this application embodiment, when the connection channel between the edge site and the cloud management platform fails, the edge site authenticates the access request sent by the client, enabling the client to access cloud services, thereby ensuring the client experience.

[0165] Based on the above description, this application provides a communication device between an edge cloud and a central cloud. The edge cloud is equipped with an edge site, the central cloud is equipped with a cloud management platform, the edge site deploys cloud services, the access authentication information of the cloud services is managed by the cloud management platform, the edge cloud and the central cloud are connected by a connection channel, and the communication device is configured at the edge site. Figure 7 As shown, the communication device includes:

[0166] The acquisition module is used to obtain access authentication information of the cloud service from the cloud management platform through the connection channel;

[0167] The recording module is used to record the access authentication information;

[0168] A receiving module is used to receive a first access request for the cloud service sent by a client of the edge site;

[0169] The determination module is used to determine if the connection channel has failed;

[0170] The authentication module is used to authenticate the first access request based on the access authentication information it has recorded, and to allow the client to access the cloud service if the first access request is successfully authenticated.

[0171] In some embodiments, the recording module is used to: cache the access authentication information.

[0172] In some embodiments, the receiving module is further configured to: receive a second access request for the cloud service sent by the client; the determining module is further configured to: determine that the fault of the connection channel has been repaired; the authentication module is further configured to: send the second access request to the cloud management platform through the connection channel; wherein the cloud management platform is configured to authenticate the second access request according to the access authentication information of the cloud service it manages, and allow the client to access the cloud service if the second access request is authenticated.

[0173] In some embodiments, the acquisition module is used for: the edge site periodically acquiring access authentication information of the cloud service from the cloud management platform through the connection channel; the recording module is used for: the edge site updating the access authentication information recorded by the edge site based on the currently acquired access authentication information of the cloud service.

[0174] In some embodiments, the cloud service includes a compute instance management cloud service, and the first access request is used to request compute instance management for the client.

[0175] In some embodiments, the access authentication information for the cloud service includes one or more of the following: public key, client information, and context attributes.

[0176] The acquisition module, recording module, receiving module, determining module, and authentication module can all be implemented in software or hardware. For example, the implementation of the acquisition module will be described below. Similarly, the implementation methods of the recording module, receiving module, determining module, and authentication module can refer to the implementation method of the acquisition module.

[0177] As an example of a software functional unit, a module can include code running on a computing instance. A computing instance can include at least one of a physical host (computing device), a virtual machine, or a container. Furthermore, the aforementioned computing instance can be one or more. For example, a module can include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code can be distributed within the same availability zone (AZ) or in different AZs, each AZ comprising one or more geographically proximate data centers. Typically, a region can include multiple AZs.

[0178] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0179] As an example of a hardware functional unit, an acquisition module may include at least one computing device, such as a cloud server. Alternatively, an acquisition module may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The aforementioned PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0180] The acquisition module includes multiple computing devices that can be distributed within the same region or in different regions. Similarly, the acquisition module includes multiple computing devices that can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the acquisition module includes multiple computing devices that can be distributed within the same Virtual Private Cloud (VPC) or multiple VPCs. These multiple computing devices can be any combination of computing devices such as cloud servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0181] It should be noted that, in other embodiments, the acquisition module can be used to perform... Figure 6 The recording module can be used to execute any step in the method shown. Figure 6 The receiving module can be used to execute any step in the method shown. Figure 6 Any step in the method shown determines which module can be used to execute. Figure 6 The authentication module can be used to perform any step in the method shown. Figure 6 Any step in the method shown. The steps implemented by the acquisition module, recording module, receiving module, determination module, and authentication module can be specified as needed, and implemented separately by the acquisition module, recording module, receiving module, determination module, and authentication module. Figure 6 The different steps in the method shown enable the full functionality of the edge site.

[0182] This application also provides a computing device 800. For example... Figure 8 As shown, the computing device 800 includes a bus 802, a processor 804, a memory 806, and a communication interface 808. The processor 804, the memory 806, and the communication interface 808 communicate with each other via the bus 802. The computing device 800 can be a cloud server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 800.

[0183] The 802 bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 8 The bus 802 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 802 may include a path for transmitting information between various components of the computing device 800 (e.g., memory 806, processor 804, communication interface 808).

[0184] Processor 804 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0185] Memory 806 may include volatile memory, such as random access memory (RAM). Memory 806 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0186] The memory 806 stores executable program code, and the processor 804 executes this executable program code to implement the functions of the aforementioned acquisition module, recording module, receiving module, determination module, and authentication module, thereby achieving... Figure 6 The method shown. That is, the memory 806 stores the method for execution. Figure 6 The instructions for the method shown.

[0187] The communication interface 808 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 800 and other devices or communication networks.

[0188] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a cloud server, such as a central cloud server, an edge cloud server, or a local cloud server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0189] like Figure 9 As shown, the computing device cluster includes at least one computing device 800. The memory 806 of one or more computing devices 800 in the computing device cluster may store the same memory for executing... Figure 6 The instructions for the method shown.

[0190] In some possible implementations, the memory 806 of one or more computing devices 800 in the computing device cluster may also store memory for execution. Figure 6 The instructions of the method shown are partial. In other words, a combination of one or more computing devices 800 can jointly execute instructions for performing... Figure 6 The instructions for the method shown.

[0191] It should be noted that the memory 806 in different computing devices 800 within the computing device cluster can store different instructions, each used to execute a portion of the edge site's functions. That is, the instructions stored in the memory 806 of different computing devices 800 can implement the functions of one or more modules among the acquisition module, recording module, receiving module, determination module, and authentication module.

[0192] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 10 One possible implementation is shown. For example... Figure 10 As shown, two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this possible implementation, the memory 806 in computing device 800A stores instructions for executing the functions of the acquisition module and the recording module. Meanwhile, the memory 806 in computing device 800B stores instructions for the functions of the receiving module, the determining module, and the authentication module.

[0193] It should be understood that Figure 10 The functions of the computing device 800A shown can also be performed by multiple computing devices 800. Similarly, the functions of the computing device 800B can also be performed by multiple computing devices 800.

[0194] This application also provides another computing device cluster. The connection relationships between the computing devices in this computing device cluster can be similarly referred to... Figure 9 and Figure 10 The connection method of the computing device cluster is different. In that, the memory 806 of one or more computing devices 800 in this computing device cluster can store the same information for execution. Figure 6 The instructions for the method shown.

[0195] In some possible implementations, the memory 806 of one or more computing devices 800 in the computing device cluster may also store memory for execution. Figure 6 The instructions of the method shown are partial. In other words, a combination of one or more computing devices 800 can jointly execute instructions for performing... Figure 6 The instructions for the method shown.

[0196] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform... Figure 6 The method shown.

[0197] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a host migration device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute... Figure 6 The method shown.

[0198] This application also provides a communication system between an edge cloud and a central cloud, the system comprising: an edge cloud with edge sites and a central cloud with a cloud management platform.

[0199] The edge site is equipped with cloud services, and the access authentication information for the cloud services is managed by the cloud management platform. The edge cloud and the central cloud are connected via a connection channel.

[0200] The edge site is used to obtain access authentication information for the cloud service from the cloud management platform through the connection channel; the edge site is used to record the access authentication information; the edge site is used to receive a first access request for the cloud service sent by the client of the edge site; the edge site is used to determine that the connection channel has failed; the edge site is used to authenticate the first access request based on its own recorded access authentication information, and if the first access request is successfully authenticated, allow the client to access the cloud service.

[0201] The operations performed by the edge site can be referenced in the above text. Figure 5 and / Figure 6 The description of the illustrated embodiments will not be repeated here.

[0202] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

Claims

1. A communication method between an edge cloud and a central cloud, characterized in that, The edge cloud is equipped with edge sites, the central cloud is equipped with a cloud management platform, the edge sites deploy cloud services, the access authentication information of the cloud services is managed by the cloud management platform, and the edge cloud and the central cloud are connected via a connection channel. The method includes: The edge site obtains access authentication information for the cloud service from the cloud management platform through the connection channel; The edge site records the access authentication information; The edge site receives a first access request for the cloud service sent by the client of the edge site; The edge station determines that the connection channel has failed; The edge site authenticates the first access request based on its own recorded access authentication information, and allows the client to access the cloud service if the first access request is successfully authenticated.

2. The method according to claim 1, characterized in that, The edge site records the access authentication information, including: the edge site caches the access authentication information.

3. The method according to claim 1 or 2, characterized in that, The method further includes: The edge site receives a second access request for the cloud service sent by the client; The edge station determined that the fault in the connection channel had been repaired; The edge site sends the second access request to the cloud management platform through the connection channel; The cloud management platform is used to authenticate the second access request based on the access authentication information of the cloud service it manages, and allows the client to access the cloud service if the second access request is successfully authenticated.

4. The method according to any one of claims 1-3, characterized in that, The edge site obtains access authentication information for the cloud service from the cloud management platform through the connection channel, including: the edge site periodically obtains access authentication information for the cloud service from the cloud management platform through the connection channel; The edge site records the access authentication information, including: the edge site updates the access authentication information recorded by the edge site based on the currently obtained access authentication information of the cloud service.

5. The method according to any one of claims 1-4, characterized in that, The cloud service includes a compute instance management cloud service, and the first access request is used to request compute instance management for the client.

6. The method according to any one of claims 1-5, characterized in that, The access authentication information for the cloud service includes one or more of the following: public key, client information, and context attributes.

7. A communication device between an edge cloud and a central cloud, characterized in that, The edge cloud is equipped with edge sites, the central cloud is equipped with a cloud management platform, the edge sites deploy cloud services, the access authentication information of the cloud services is managed by the cloud management platform, the edge cloud and the central cloud are connected by a connection channel, and the communication device is configured at the edge site. The communication device includes: The acquisition module is used to obtain access authentication information of the cloud service from the cloud management platform through the connection channel; The recording module is used to record the access authentication information; A receiving module is used to receive a first access request for the cloud service sent by a client of the edge site; The determination module is used to determine if the connection channel has failed; The authentication module is used to authenticate the first access request based on the access authentication information it has recorded, and to allow the client to access the cloud service if the first access request is successfully authenticated.

8. The communication device according to claim 7, characterized in that, The recording module is used to cache the access authentication information.

9. The communication device according to claim 7 or 8, characterized in that, The receiving module is further configured to: receive a second access request for the cloud service sent by the client; The determining module is also used to: determine that the fault in the connection channel has been repaired; The authentication module is also used to: send the second access request to the cloud management platform through the connection channel; The cloud management platform is used to authenticate the second access request based on the access authentication information of the cloud service it manages, and allows the client to access the cloud service if the second access request is successfully authenticated.

10. The communication device according to any one of claims 7-9, characterized in that, The acquisition module is used for: the edge site periodically acquiring access authentication information for the cloud service from the cloud management platform through the connection channel; The recording module is used to: update the access authentication information recorded by the edge site based on the currently obtained access authentication information of the cloud service.

11. The communication device according to any one of claims 7-10, characterized in that, The cloud service includes a compute instance management cloud service, and the first access request is used to request compute instance management for the client.

12. The communication device according to any one of claims 7-11, characterized in that, The access authentication information for the cloud service includes one or more of the following: public key, client information, and context attributes.

13. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a cluster of computing devices, perform the method as described in any one of claims 1 to 6.

15. A computer program product containing instructions, characterized in that, When the instructions are executed by a cluster of computer devices, the cluster of computer devices performs the method as described in any one of claims 1 to 6.

16. A communication system between an edge cloud and a central cloud, characterized in that, The system includes: Edge cloud with edge sites; A central cloud equipped with a cloud management platform; The edge site is equipped with cloud services, and the access authentication information of the cloud services is managed by the cloud management platform. The edge cloud and the central cloud are connected through a connection channel. The edge site is used to obtain access authentication information for the cloud service from the cloud management platform through the connection channel; The edge site is used to record the access authentication information; The edge site is used to receive a first access request for the cloud service sent by the client of the edge site; The edge station is used to determine if the connection channel has failed; The edge site is used to authenticate the first access request based on the access authentication information it records, and allows the client to access the cloud service if the first access request is successfully authenticated.

Images