Construction method for access link, access method, system, device, and storage medium

Abstract

The present disclosure provides a construction method for an access link, an access method, a system, a device, a storage medium, and a product. The construction method for an access link is applied to a gateway server, and comprises: maintaining at least one communication channel between the gateway server and a gateway client, wherein the communication channel is established by the gateway client with the gateway server on the basis of a public network access address provided by a public cloud environment, and the communication channel carries an identifier of the gateway client; obtaining an identifier of a specified gateway client inputted by a user and an access address of a specified database in a private domain environment; and on the basis of the communication channel indicated by the identifier of the specified gateway client and the access address of the specified database, constructing an access link between the public cloud environment and the private domain environment.

Description

TECHNICAL FIELD OF THE INVENTION: Method for constructing access link, access method, system, device and storage medium

[0001] One or more embodiments of the present disclosure relate to the field of data access technology, and more particularly to a method for constructing an access link, an access method based on an access link, an access system, an electronic device, a computer-readable storage medium, and a computer program product.

[0002] In related technologies, tool products (DMS, DTS, DBS) need to access user databases for data management, data migration, or data backup. In one application scenario, the tool product is located in a public cloud environment, while the user database is located in a private domain. The public cloud environment and the private domain environment are not connected, so a method to access the database in the private domain environment is needed.

[0003] In view of this, one or more embodiments of the present disclosure provide a method for constructing an access link, an access method based on an access link, an access system, an electronic device, a computer-readable storage medium, and a computer program product.

[0004] To achieve the above objectives, one or more embodiments of the present disclosure provide the following technical solutions:

[0005] According to a first aspect of one or more embodiments of the present disclosure, a method for establishing an access link is provided. The access link is used to enable an application in a public cloud environment to access a database in a private domain environment through the access link. A gateway server assigned a public network access address is deployed in the public cloud environment. At least one gateway client is deployed in the private domain environment. The method, applied to the gateway server, includes:

[0006] Maintaining at least one communication channel between the gateway server and the gateway client; the communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries an identifier of the gateway client;

[0007] Obtaining an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user;

[0008] Based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, an access link is constructed between the public cloud environment and the private domain environment. According to a second aspect of one or more embodiments of the present disclosure, an access method based on an access link is proposed. The access link is based on the first aspect of A method for constructing an access link is constructed; the method is applied to a gateway server and includes:

[0009] Receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment;

[0010] transmitting the access request through an access link corresponding to the target database, and receiving an access response returned by the target database based on the access request;

[0011] The access response is forwarded to the application in the public cloud environment.

[0012] According to a third aspect of an embodiment of the present disclosure, an access system is provided, comprising a gateway server and a gateway client; the gateway server is deployed in a public cloud environment and is assigned a public network access address; the gateway client is deployed in a private domain environment;

[0013] The gateway client is configured to establish at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, wherein the communication channel carries an identifier of the gateway client;

[0014] The gateway server is configured to maintain at least one communication channel between itself and the gateway client; obtain an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user; and construct an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, so that applications in the public cloud environment can access the database in the private domain environment through the access link.

[0015] According to a fourth aspect of an embodiment of the present disclosure, an electronic device is provided, including:

[0016] processor;

[0017] a memory for storing processor-executable instructions;

[0018] When the processor executes the executable instructions, it is used to implement the method described in the first aspect or the second aspect.

[0019] According to a fifth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the steps of any of the above methods are implemented.

[0020] According to a sixth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0021] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0022] In the embodiment of the present disclosure, it is only necessary to deploy the gateway server in the public cloud environment and the gateway client in the private domain environment. There is no need to directly open the database port or build a complex VPN or other network connection method. This simplifies deployment and management. Furthermore, only the gateway client can actively establish a communication connection with the gateway server based on the public network access address, ensuring that the private domain environment only provides access to trusted public cloud environments. This avoids the data security risks associated with directly opening database ports on the public network. Furthermore, the gateway server can only access the designated database in the private domain environment through authorized gateway clients, enhancing data security. The gateway server maintains at least one communication channel between the gateway server and the gateway client. The gateway server then obtains the user-entered identifier of the designated gateway client and the access address of the designated database in the private domain environment. Based on the communication channel and the access address of the designated database, the gateway server establishes an access link between the public cloud environment and the private domain environment. Users only need to enter the designated gateway client identifier and the access address of the designated database in the private domain environment in the public cloud environment as needed, eliminating the need for complex configuration and streamlining user configuration.

[0023] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory and cannot limit the present disclosure.

[0024] FIG1 is a schematic structural diagram of an interactive system provided by an exemplary embodiment.

[0025] FIG2 is a schematic structural diagram of another interactive system provided by an exemplary embodiment.

[0026] FIG3 is a schematic structural diagram of another interactive system provided by an exemplary embodiment.

[0027] FIG4 is a schematic diagram of interactions for establishing an access link provided by an exemplary embodiment.

[0028] FIG5 is another interactive diagram of establishing an access link provided by an exemplary embodiment.

[0029] FIG6 is a schematic diagram of access based on an access link provided by an exemplary embodiment.

[0030] FIG7 is a schematic flow chart of a method for establishing an access link provided by an exemplary embodiment.

[0031] FIG8 is a schematic flow chart of an access method based on an access link provided by an exemplary embodiment.

[0032] FIG9 is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment.

[0033] Here, exemplary embodiments will be described in detail, with examples shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of the present disclosure. Rather, they are merely examples of apparatus and methods consistent with some aspects of one or more embodiments of the present disclosure as recited in the appended claims.

[34] It should be noted that in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this disclosure. In some other embodiments, the method may include more or fewer steps than those described in this disclosure. In addition, a single step described in this disclosure may be broken down into multiple steps for description in other embodiments; and multiple steps described in this disclosure may be combined into a single step for description in other embodiments.

[0035] In related technologies, tool products (DMS, DTS, DBS) need to access user databases for data management, data migration, or data backup.

[0036] A Database Management System (DMS) is a database management system that provides a graphical interface and tools for managing and monitoring databases. It helps administrators perform operations such as creating, configuring, and backing up databases, while also offering features such as performance optimization, security management, and fault recovery. DMS supports a variety of database engines, including MySQL, Oracle, and SQL Server.

[0037] DTS (Data Transmission Service) is a data transmission service used to migrate, synchronize, and transfer data between different databases. It supports data migration between different database engines and data synchronization between different data centers. DTS provides a simplified configuration interface and tools, making data migration and synchronization more convenient and reliable.

[0038] Database Backup Service (DBS) is a database backup service that regularly backs up databases and protects data security. It provides features such as automatic, incremental, and full backups, and supports cross-region and cross-account backups to ensure data reliability and recoverability. DBS also provides visual backup monitoring and recovery capabilities, allowing administrators to easily manage and operate backup data.

[0039] In one application scenario, tool products are located in a public cloud environment, and user databases are located in a private domain environment. The public cloud environment and the private domain environment are not connected, so a method is needed to access the database in the private domain environment.

[0040] For example, a public cloud environment refers to a cloud computing platform provided by a third-party cloud service provider. In a public cloud environment, users can access and use computing resources provided by the cloud service provider, such as virtual machines, storage space, and databases, via the internet. Public cloud environments are elastic, scalable, and flexible, allowing users to dynamically allocate and release computing resources based on demand while enjoying the high availability, security, and manageability provided by the cloud service provider.

[0041] Private On-Premises Environment refers to the deployment in a self-built data center or enterprise Computing resources in a private domain environment are completely owned and managed by the enterprise itself, and users can access and use these resources within the internal network. Private domain environments are typically used in scenarios requiring stricter control and data protection, such as those involving sensitive information in enterprises and institutions. Private domain environments can be customized to meet specific security and performance requirements, but they also require enterprises to invest significant costs and effort in maintenance and management.

[0042] In related technologies, methods for accessing databases in private domain environments include but are not limited to:

[0043] (1) Users directly open the server address to the public network. However, directly opening the database port on the public network increases the risk of being attacked and reduces data security.

[0044] (2) Users build a dedicated network between the public cloud environment and the private domain environment or use a VPN. VPN (Virtual Private Network) is a technology that establishes an encrypted and secure connection through a public network (such as the Internet). However, this method is complex to build, requires a complex configuration process, and is cumbersome to operate.

[0045] Based on this, embodiments of the present disclosure provide a method for establishing an access link, enabling applications in a public cloud environment to access databases in a private domain environment through the established access link. This method utilizes a gateway server and a gateway client. A gateway server assigned a public network access address can be deployed in the public cloud environment, while at least one gateway client can be deployed in the private domain environment.

[0046] The gateway client actively establishes at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, so that the gateway server can maintain at least one communication channel between the gateway server and the gateway client. The gateway server then obtains the identifier of the designated gateway client entered by the user and the access address of the designated database in the private domain environment; based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, an access link is established between the public cloud environment and the private domain environment.

[0047] In this embodiment, the gateway server in the public cloud environment is unaware of the access address of the private domain environment. The gateway client must proactively establish a communication connection with the gateway server based on the public network access address. This ensures that the private domain environment only provides access rights to trusted public cloud environments, avoiding data security risks associated with directly opening database ports on the public network. Furthermore, the gateway server can only access the designated database in the private domain environment through authorized gateway clients, thereby improving data security. Furthermore, only the gateway server needs to be deployed in the public cloud environment and the gateway client in the private domain environment, eliminating the need to directly open database ports or establish complex network connections such as VPNs. This simplifies deployment and management. Users only need to enter the identifier of the designated gateway client and the access address of the designated database in the private domain environment in the public cloud environment as needed, eliminating the need for complex configuration and simplifying user configuration operations.

[0048] The embodiment of the present disclosure also provides an access method based on an access link, which is implemented by establishing the above-mentioned access link. Afterwards, applications in the public cloud environment can access the database in the private domain environment through this access link.

[0049] The following is an illustrative description of the technical solutions provided by the embodiments of the present disclosure from a system perspective:

[0050] Referring to FIG1 , an embodiment of the present disclosure provides an access system including a gateway server 10 and a gateway client 20. The gateway server 10 is deployed in a public cloud environment and is assigned a public network access address 11. The gateway client 20 is deployed in a private domain environment. The public cloud environment also has one or more applications 12 deployed, such as the aforementioned tool products. (DMS, DTS, DBS). One or more databases 21 are deployed in the private domain environment.

[0051] The gateway client 20 is used to establish at least one communication channel with the gateway server 10 based on the public network access address 11 provided by the public cloud environment. The communication channel carries the identifier of the gateway client 20.

[0052] The gateway server 10 is configured to maintain at least one communication channel between itself and the gateway client 20; obtain an identifier of the designated gateway client 20 and an access address of a designated database 21 in the private domain environment, both input by a user; and establish an access link between the public cloud environment and the private domain environment based on the communication channel indicated by the identifier of the designated gateway client 20 and the access address of the designated database 21, so that an application 12 in the public cloud environment can access the database 21 in the private domain environment through the access link.

[0053] In this embodiment, it is only necessary to deploy the gateway server 10 in the public cloud environment and the gateway client 20 in the private domain environment. Through the above implementation process, the effects of improving data security, simplifying deployment and management work, and simplifying user configuration operations can be achieved.

[0054] For example, please refer to FIG. 2 , which exemplarily shows two private domain environments. In the case of multiple private domain environments, at least one gateway client 20 can be deployed in each private domain environment. The gateway client 20 in each private domain environment establishes at least one communication channel with the gateway server 10 through the public network access address 11 provided by the public cloud environment.

[0055] Here, the deployment process of the gateway client 20 is first exemplified, referring to FIG. 3 . The access system may further include a gateway control component 30 connected to the gateway server 10, and the gateway control component 30 is deployed in a public cloud environment.

[0056] 4 , the gateway control component 30 can respond to the user operation (1) and provide the user with information such as the download link of the installation package of the gateway client 20, the deployment command, the public network access address 11, and the token issued to the gateway client 20 (2.1).

[0057] In addition, when the gateway control component 30 provides the token issued to the gateway client 20 to the user, it writes the token into the token database 50 (2.2) for subsequent verification.

[0058] The user obtains the download link of the installation package of the gateway client 20, the deployment command, the public network access address 11 and the issuance After the token and other information are sent to the gateway client 20, any electronic device (3) in the private domain environment can execute the following steps: download the download link of the installation package of the gateway client 20 from the second storage medium 40 based on the download link (4), and then run the installation package corresponding to the gateway client 20 in the private domain environment in response to the deployment command provided by the gateway control component 30 to realize the deployment of at least one gateway client 20 in the private domain environment (5).

[0059] Any electronic device in the private domain environment can deploy multiple gateway clients 20 in the same private domain environment to achieve the purpose of load balancing.

[0060] Each gateway client 20 can access the public network access address 11 provided by the gateway control component 30 to establish at least one communication channel with the gateway server 10. Each communication channel carries the identifier of the gateway client 20. Exemplarily, the established communication channel includes a TCP communication channel. The TCP (Transmission Control Protocol) communication channel is a reliable, connection-oriented communication protocol widely used in computer networks. It provides reliable data transmission and error recovery mechanisms, ensuring data accuracy and integrity.

[0061] It is understood that gateway client 20 directly accesses public network access address 11. During this time, traffic from the private domain to the public network automatically passes through the private domain's public network NAT component (not shown). The public network NAT component is a network device that maps internal private IP addresses to public IP addresses to enable communication between the private domain's internal network and the public Internet.

[0062] After establishing a communication channel with the gateway server 10, each gateway client 20 can send a token issued by the gateway control component 30 through the communication channel. The gateway server 10 receives the token issued by the public cloud environment and sends it through the communication channel. It authenticates the gateway client 20 based on the token and returns the verification result to the gateway client 20. In this embodiment, by using the token for authentication, the gateway server 10 can confirm the legitimacy of the gateway client 20, helping to prevent unauthorized access and potential security threats. Furthermore, by using the token for authentication, the gateway server 10 can centrally manage and control access rights. Token issuance and revocation can be performed on the gateway server 10, eliminating the need for independent configuration and management of each gateway client 20, thereby simplifying management operations and maintenance.

[0063] For example, referring to FIG4 , after establishing a communication channel with the gateway server 10, each gateway client 20 can send a token (6) issued by the gateway control component 30 through the communication channel. After receiving the token to be detected sent by the gateway client 20 through the communication channel established by it, the gateway server 10 sends the token to be detected to the token database 50 for verification (7), and the token database 50 returns a verification result (8). For example, the database management system of the token database 50 detects whether the token to be detected exists in the token database 50. If it exists, the verification result is verification passed; if it does not exist, the verification result is verification failed. The gateway server 10 can return the verification result (9) to the gateway client 20.

[0064] If the token verification result indicates that the token has passed, the gateway server 10 can maintain the communication channel corresponding to the token; otherwise, the communication channel corresponding to the token is disconnected. In this embodiment, once the token verification is passed, the gateway server 10 maintains the communication channel corresponding to the token. This means that the gateway client 20 can continuously communicate with the public cloud environment without having to reestablish a connection for each request, improving communication efficiency and response speed. If the token verification fails or is revoked, the gateway server 10 can disconnect the communication channel corresponding to the token, preventing unauthorized access and promptly terminating connections with potentially risky clients.

[0065] During the configuration process, the user can input the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment according to actual needs in the public cloud environment. For example, referring to FIG5 , the user can input the identifier of the designated gateway client 20 and the access address (11) of the designated database 21 in the private domain environment in the gateway control component 30. The gateway control component 30 is connected to the gateway server 10 and can send the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment input by the user to the gateway server 10. (12), so that the gateway server 10 can obtain the identifier of the designated gateway client 20 input by the user and the access address of the designated database 21 in the private domain environment; then, based on the communication channel pointed to by the identifier of the designated gateway client 20 and the access address of the designated database 21, an access link between the public cloud environment and the private domain environment is constructed.

[0066] It is understandable that the embodiments of the present disclosure do not impose any restrictions on the user's input method, and the user may use a touch screen, a mouse, a stylus, a keyboard, a physical button, a voice input device, or a somatosensory input device, etc.

[0067] For example, referring to FIG5 , in order to improve configuration accuracy, after obtaining the identifier of the designated gateway client 20 and the access address of the designated database 21 in the private domain environment input by the user, the gateway server 10 can send a detection command (13) to the designated gateway client 20 through the communication channel pointed to by the identifier of the designated gateway client 20. The detection command carries the access address of the designated database 21, so that the designated gateway client 20 responds to the detection command, detects the operation status of the designated database 21 (14) and returns a detection response (15) to the gateway server 10. By sending the detection command and receiving the detection response, the gateway server 10 can monitor the operation status of the designated database 21 in real time, which helps to timely discover whether the database 21 is operating normally, whether there are faults or instability, etc. Furthermore, when the detection response indicates that the designated database 21 is operating normally, the gateway client 20 can automatically build an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client 20 and the access address of the designated database 21. This embodiment enables automatic creation of access links without manual intervention during system operation, thereby simplifying the configuration and management process.

[0068] In some possible implementations, see FIG5 , in the process of creating an access link, the gateway server 10 may allocate a reverse proxy address (16) for the application 12 in the public cloud environment to the access address of the designated database 21, and then allocate a reverse proxy address (16) for the application 12 in the public cloud environment based on the reverse proxy address, the communication channel pointed to by the identifier of the designated gateway client 20, and the designated database 21. The access address is used to establish an access link between application 12 in the public cloud environment and database 21 in the private domain environment. The reverse proxy address refers to the address of an intermediate server (or reverse proxy server) that forwards access requests from application 12 in the public cloud environment to servers in the private domain environment. However, for application 12 in the public cloud environment, the reverse proxy server is equivalent to the target server (i.e., the server in the private domain environment). That is, application 12 in the public cloud environment can obtain the resources of the target server by directly accessing the reverse proxy server. Furthermore, application 12 in the public cloud environment does not need to know the address of the target server and does not need to perform any settings.

[0069] After building an access link between the application 12 in the public cloud environment and the database 21 in the private domain environment, the gateway server 10 can record the link information of the access link in the first storage medium 31 of the public cloud environment. The link information includes the mapping relationship between the reverse proxy address, the identifier of the specified gateway client 20, and the access address of the specified database 21.

[0070] Exemplarily, referring to FIG5 , the gateway service end 10 may send the link information (17) of the access link to the gateway control component 30 so that the gateway control component 30 records the link information (18) of the access link in the first storage medium 31 of the public cloud environment.

[0071] After the access link is established, the gateway server 10 can receive an access request from an application 12 in the public cloud environment for a target database 21 in the private domain. The gateway server 10 then transmits the access request via the access link corresponding to the target database 21 and receives an access response from the target database 21 based on the access request. Finally, the gateway server 10 forwards the access response to the application 12 in the public cloud environment. This allows the application 12 in the public cloud environment to access the database 21 in the private domain.

[0072] For example, referring to FIG. 6 , the gateway client 20 receives an access request (24) from an application 12 in a public cloud environment to a target database 21 in a private domain environment, and sends the request to the reverse proxy address corresponding to the target database 21. The reverse proxy address corresponding to the target database 21 is obtained from a storage medium storing link information of an access link corresponding to the target database 21.

[0073] For example, a user initiates an access request (21) for a target database 21 in an application 12 in a public cloud environment. The access request carries the access address of the target database 21. The application 12 in the public cloud environment calls a gateway control component 30 (22), so that the gateway control component 30 obtains the reverse proxy address (23) corresponding to the target database 21 from a first storage medium 31 storing link information of an access link corresponding to the target database 21 and returns the reverse proxy address to the application 12 in the public cloud environment. For example, the application 12 in the public cloud environment calls the gateway control component 30 and passes the access address of the target database 21 to the gateway control component 30. The gateway control component 30 searches for the reverse proxy address corresponding to the target database 21 from the mapping relationship stored in the first database 21 based on the access address of the target database 21 and returns the reverse proxy address to the application 12 in the public cloud environment.

[0074] After obtaining the reverse proxy address corresponding to the target database 21, the application 12 in the public cloud environment can directly send an access request (24) to the reverse proxy address.

[0075] After receiving an access request sent by an application 12 in a public cloud environment to a reverse proxy address corresponding to a target database 21, the gateway server 10 obtains the identifier of the target gateway client 20 corresponding to the target database 21 from the second storage medium 40 storing link information of the access link corresponding to the target database 21, and sends an access request (25) to the target gateway client 20 through the communication channel pointed to by the identifier of the target gateway client 20, so that the target gateway client 20 forwards the access request to the target database 21 for processing. Exemplarily, the access request carries the access address of the target database 21. The target gateway client 20 can establish a connection with the target database 21 based on the access address of the target database 21 and forward the access request to the target database 21 for processing. The target database 21 can return the access response generated after processing to the target gateway client 20 (26). Next, the target gateway client 20 receives the access response from the target database 21 and returns the access response to the gateway server 10 based on the above communication channel (27). The gateway server 10 forwards the access response to the application 12 in the public cloud environment based on the reverse proxy address corresponding to the target database 21 (28).

[0076] It is understandable that the gateway control component 30 may not be provided in the access system, but the functions of the gateway control component 30 may be integrated into the gateway server 10, and the gateway server 10 may perform the relevant functions of the gateway control component 30, such as the function of interacting with the user.

[0077] The various technical features in the above embodiments can be arbitrarily combined as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, any combination of the various technical features in the above embodiments also falls within the scope of this disclosure.

[0078] In some embodiments, referring to FIG. 7 , embodiments of the present disclosure provide a method for constructing an access link, wherein the access link is used to enable an application in a public cloud environment to access a database in a private domain environment through the access link. A gateway server assigned a public network access address is deployed in the public cloud environment; at least one gateway client is deployed in the private domain environment. The method is applied to the gateway server and includes:

[0079] In S101, at least one communication channel is maintained between the gateway server and the gateway client. The communication channel is established between the gateway client and the gateway server based on a public network access address provided by the public cloud environment, and the communication channel carries an identifier of the gateway client.

[0080] In S102 , the identifier of the designated gateway client and the access address of the designated database in the private domain environment input by the user are obtained.

[0081] In S103, based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, Build access links between public cloud environments and private domain environments.

[0082] Based on the communication channel pointed to by the specified gateway client identifier and the access address of the specified database, an access link is established between the public cloud environment and the private domain environment, including:

[0083] Assign a reverse proxy address for applications in the public cloud environment to the access address of the specified database;

[0084] In some embodiments, an access link between an application in a public cloud environment and a database in a private domain environment is established based on a reverse proxy address, a communication channel pointed to by an identifier of a designated gateway client, and an access address of a designated database.

[0085] In some embodiments, the method further comprises:

[0086] Link information of the access link is recorded in a first storage medium in the public cloud environment, where the link information includes a mapping relationship between a reverse proxy address, an identifier of a designated gateway client, and an access address of a designated database.

[0087] In some embodiments, before establishing an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, the method further includes:

[0088] Sending a detection command to the designated gateway client through the communication channel pointed to by the identifier of the designated gateway client, the detection command carrying the access address of the designated database, so that the designated gateway client responds to the detection command, detects the operation status of the designated database and returns a detection response to the gateway server;

[0089] Based on the communication channel pointed to by the specified gateway client identifier and the access address of the specified database, an access link is established between the public cloud environment and the private domain environment, including:

[0090] If the detection response indicates that the specified database is operating normally, an access link is established between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the specified gateway client and the access address of the specified database.

[0091] In some embodiments, the gateway client deployed in the private domain environment is obtained by running an installation package corresponding to the gateway client in the private domain environment in response to a deployment command provided by the public cloud environment; wherein the installation package corresponding to the gateway client is downloaded from the second storage medium based on a download link provided by the public cloud environment.

[0092] In some embodiments, before maintaining at least one communication channel between the gateway server and the gateway client, the method further includes: receiving a token issued by the public cloud environment and sent by the gateway client through the communication channel after the communication channel is established; authenticating the gateway client based on the token, and returning a verification result to the gateway client. Maintaining at least one communication channel between the gateway server and the gateway client includes: maintaining the communication channel corresponding to the token in response to the verification result indicating that the token verification has passed; otherwise, disconnecting the communication channel corresponding to the token.

[0093] In some embodiments, a gateway control component connected to a gateway server is deployed in a public cloud environment; The entry address, download link, deployment command, and token are provided by the gateway control component.

[0094] In some embodiments, the communication channel comprises a TCP channel.

[0095] Referring to FIG. 8 , an embodiment of the present disclosure further provides an access method based on an access link, wherein the access link is constructed based on any of the above-mentioned access link construction methods; the method is applied to a gateway server and includes:

[0096] In S201 , an access request sent by an application in a public cloud environment to a target database in a private domain environment is received.

[0097] In S202, an access request is transmitted through an access link corresponding to a target database, and an access response returned by the target database based on the access request is received.

[0098] In S203, the access response is forwarded to the application in the public cloud environment.

[0099] In some embodiments, receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment includes:

[0100] An access request is received from an application in a public cloud environment to a target database in a private domain environment, and is sent to a reverse proxy address corresponding to the target database; wherein the reverse proxy address is obtained from a first storage medium storing link information of an access link corresponding to the target database.

[0101] In some embodiments, transmitting an access request through an access link corresponding to a target database includes:

[0102] Acquire an identifier of a target gateway client corresponding to the target database from a first storage medium storing link information of an access link corresponding to the target database;

[0103] An access request is sent to the target gateway client through the communication channel pointed to by the identifier of the target gateway client, so that the target gateway client forwards the access request to the target database for processing.

[0104] The various technical features in the above embodiments can be arbitrarily combined as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, any combination of the various technical features in the above embodiments also falls within the scope of this disclosure.

[0105] In some embodiments of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor implements any one of the above methods by running the executable instructions.

[0106] FIG9 is a schematic diagram of a device provided by an exemplary embodiment. Referring to FIG9, at the hardware level, the device includes a processor 902, an internal bus 904, a network interface 906, a memory 908, and a non-volatile memory 910. Of course, it may also include hardware required for other scenarios. One or more embodiments of the present disclosure may be based on software. The processing is implemented in a manner such as by the processor 902 reading the corresponding computer program from the non-volatile memory 910 into the memory 908 and then executing the program. Of course, in addition to software implementation, one or more embodiments of the present disclosure do not exclude other implementations, such as logic devices or a combination of software and hardware. In other words, the execution subject of the following processing flow is not limited to individual logic units, but may also be hardware or logic devices.

[0107] In some embodiments, the present disclosure further provides a computer-readable storage medium having computer instructions stored thereon, which implement the steps of any of the above methods when executed by a processor.

[0108] In some embodiments, the present disclosure further provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[109] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse.

[0110] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0111] In a typical configuration, a computer includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0112] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0113] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, Tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission media, can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0114] It should also be noted that the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, product, or apparatus comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, product, or apparatus. In the absence of further limitations, elements defined by the phrase "comprising a ..." do not preclude the presence of additional identical elements in the process, method, product, or apparatus comprising the elements.

[0115] The foregoing description describes specific embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] The terminology used in one or more embodiments of the present disclosure is for the purpose of describing specific embodiments only and is not intended to limit the present disclosure. As used in one or more embodiments of the present disclosure and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0117] It should be understood that while one or more embodiments of the present disclosure may employ terms such as first, second, and third to describe various types of information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, without departing from the scope of one or more embodiments of the present disclosure, first information may be referred to as second information, and similarly, second information may be referred to as first information. Depending on the context, the term "if" as used herein may be interpreted as "at the time of," "when," or "in response to a determination."

[0118] The above description is merely a preferred embodiment of one or more embodiments of the present disclosure and is not intended to limit the one or more embodiments of the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present disclosure shall be included in the scope of protection of one or more embodiments of the present disclosure.

Claims

Claims 1. A method for constructing an access link, wherein the access link is used to enable an application in a public cloud environment to access a database in a private domain environment through the access link; A gateway server allocated with a public network access address is deployed in the public cloud environment; at least one gateway client is deployed in the private domain environment; The method is applied to a gateway server, and includes: maintaining at least one communication channel between the gateway server and the gateway client; The communication channel is established by the gateway client and the gateway server based on the public network access address provided by the public cloud environment, and the communication channel carries the identifier of the gateway client; the identifier of the designated gateway client and the access address of the designated database in the private domain environment are obtained by the user; and an access link is established between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database.

2. The method according to claim 1, wherein the establishing the access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database comprises: Allocating a reverse proxy address for an application in the public cloud environment to an access address of the designated database; An access link between an application in a public cloud environment and a database in a private domain environment is established based on the reverse proxy address, the communication channel pointed to by the identifier of the designated gateway client, and the access address of the designated database.

3. The method according to claim 2, further comprising: Link information of the access link is recorded in a first storage medium of the public cloud environment, where the link information includes a mapping relationship between the reverse proxy address, an identifier of the designated gateway client, and an access address of the designated database.

4. The method according to claim 1, before establishing the access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, further comprising: A detection command is sent to the designated gateway client through the communication channel pointed to by the identifier of the designated gateway client, and the detection command carries the access address of the designated database, so that the designated gateway client responds to the detection command, detects the operation status of the designated database and returns a detection response to the gateway server; the access link between the public cloud environment and the private domain environment is constructed based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, including: if the detection response indicates that the designated database is running normally, The communication channel to the designated database and the access address of the designated database are used to build an access link between the public cloud environment and the private domain environment.

5. The method according to claim 1, wherein the gateway client deployed in the private domain environment is obtained by executing an installation package corresponding to the gateway client in the private domain environment in response to a deployment command provided by the public cloud environment; wherein the installation package corresponding to the gateway client is downloaded from a second storage medium based on a download link provided by the public cloud environment.

6. The method according to claim 5, before maintaining at least one communication channel between the gateway server and the gateway client, further comprising: receiving a token issued by the public cloud environment and sent by the gateway client through the communication channel after the communication channel is established; authenticating the gateway client based on the token and returning a verification result to the gateway client; maintaining at least one communication channel between the gateway server and the gateway client, comprising: maintaining a communication channel corresponding to the token in response to the verification result indicating that the token has passed verification; Otherwise, the communication channel corresponding to the token is disconnected.

7. The method according to claim 6, wherein a gateway control component connected to the gateway server is deployed in the public cloud environment; the public network access address, the download link, the deployment command, and the token are provided by the gateway control component; and / or the communication channel includes a TCP channel.

8. An access method based on an access link, wherein the access link is constructed based on the access link construction method according to any one of claims 1 to 7; The method is applied to a gateway server and includes: receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment; transmitting the access request through an access link corresponding to the target database, and receiving an access response returned by the target database based on the access request; and forwarding the access response to the application in the public cloud environment.

9. The method according to claim 8, wherein receiving an access request sent by an application in a public cloud environment to a target database in a private domain environment comprises: An access request is received from an application in a public cloud environment to a target database in a private domain environment, and is sent to a reverse proxy address corresponding to the target database; wherein the reverse proxy address is obtained from a first storage medium storing link information of an access link corresponding to the target database. 17 10. The method according to claim 8, wherein transmitting the access request through an access link corresponding to the target database comprises: Acquire an identifier of a target gateway client corresponding to the target database from a first storage medium storing link information of an access link corresponding to the target database; The access request is sent to the target gateway client through the communication channel pointed to by the identifier of the target gateway client, so that the target gateway client forwards the access request to the target database for processing.

11. An access system comprising a gateway server and a gateway client; The gateway server is deployed in a public cloud environment and is assigned a public network access address; The gateway client is deployed in a private domain environment; The gateway client is configured to establish at least one communication channel with the gateway server based on the public network access address provided by the public cloud environment, wherein the communication channel carries an identifier of the gateway client; The gateway server is configured to maintain at least one communication channel between itself and the gateway client; obtain an identifier of a designated gateway client and an access address of a designated database in the private domain environment input by a user; and construct an access link between the public cloud environment and the private domain environment based on the communication channel pointed to by the identifier of the designated gateway client and the access address of the designated database, so that applications in the public cloud environment can access the database in the private domain environment through the access link.

12. An electronic device, comprising: processor; A memory for storing processor-executable instructions; wherein the processor implements the method according to any one of claims 1 to 10 by running the executable instructions.

13. A computer-readable storage medium having computer instructions stored thereon, wherein when the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 10.

Images