[go: up one dir, main page]

WO2023016250A1 - 云服务控制系统、方法、装置、电子设备和存储介质 - Google Patents

云服务控制系统、方法、装置、电子设备和存储介质 Download PDF

Info

Publication number
WO2023016250A1
WO2023016250A1 PCT/CN2022/107985 CN2022107985W WO2023016250A1 WO 2023016250 A1 WO2023016250 A1 WO 2023016250A1 CN 2022107985 W CN2022107985 W CN 2022107985W WO 2023016250 A1 WO2023016250 A1 WO 2023016250A1
Authority
WO
WIPO (PCT)
Prior art keywords
network address
mapping relationship
port information
physical machine
access request
Prior art date
Application number
PCT/CN2022/107985
Other languages
English (en)
French (fr)
Inventor
苏赛
李德果
董君
Original Assignee
北京字节跳动网络技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京字节跳动网络技术有限公司 filed Critical 北京字节跳动网络技术有限公司
Publication of WO2023016250A1 publication Critical patent/WO2023016250A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

  • the present disclosure relates to the field of information technology, and in particular, to a cloud service control system, cloud service control method, device, electronic equipment, and storage medium.
  • service providers In the field of public cloud services, service providers usually divide the computer room where public cloud services are deployed into a sales area and a management and control area.
  • the virtual machines in the sales area are used to provide services to customers, and customers can deploy their own applications on the virtual machines in the sales area;
  • the servers (including physical machines and virtual machines) in the control area are used to manage the virtual machines in the sales area or maintenance.
  • the service provider In order to ensure the security of the server in the control area, only the service provider has the right to control the server in the control area, while the customer has no right to control the server in the control area.
  • embodiments of the present disclosure provide a cloud service control system, cloud service control method, device, electronic equipment, and storage media, which realize the communication between a physical machine and a target cloud host. communication, and then realize the purpose of the physical machine to control the cloud service running on the target cloud host.
  • an embodiment of the present disclosure provides a cloud service control system, including:
  • the physical machine is configured to send a first access request to the gateway controller, the first access request is used to request reverse access to the target cloud host;
  • the first access request includes the first network address of the physical machine and First port information, and the fourth network address and fourth port information of the target cloud host;
  • a gateway controller configured to respond to the first access request, assign a third network address to the physical machine, and record a mapping relationship between the first network address of the physical machine and the third network address as the first mapping relationship, assign the second network address and second port information to the target cloud host, and record the difference between the fourth network address and fourth port information of the target cloud host and the second network address and second port information
  • the mapping relationship between is used as the second mapping relationship, and the first mapping relationship and the second mapping relationship are sent to the gateway;
  • a gateway configured to respond to the first access request, forward the first access request to the target cloud host according to the first mapping relationship and the second mapping relationship, and send the response information of the target cloud host to Feedback to the physical machine.
  • the embodiment of the present disclosure also provides a cloud service control method, which is applied to the gateway controller described in the first aspect above, and the method includes:
  • the first access request is used by the physical machine to request reverse access to the target cloud host, and the first access request includes the first network address and the first port of the physical machine information, and the fourth network address and fourth port information of the target cloud host;
  • an embodiment of the present disclosure further provides a cloud service control device, which is integrated into the gateway controller in the cloud service control system described in the first aspect above, and the device includes:
  • the receiving module is configured to receive a first access request sent by the physical machine, the first access request is used to request reverse access to the target cloud host, and the first access request includes the first network address of the physical machine and First port information, and the fourth network address and fourth port information of the target cloud host;
  • an allocation module configured to, in response to the first access request, allocate a third network address to the physical machine and record a mapping relationship between the first network address of the physical machine and the third network address as the first mapping relationship, assign the second network address and second port information to the target cloud host, and record the difference between the fourth network address and fourth port information of the target cloud host and the second network address and second port information
  • the mapping relationship between is used as the second mapping relationship
  • a sending module configured to send the first mapping relationship and the second mapping relationship to a gateway.
  • an embodiment of the present disclosure further provides an electronic device, and the electronic device includes:
  • processors one or more processors
  • the one or more processors implement the above cloud service control method.
  • the embodiments of the present disclosure further provide a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the cloud service control method as described above is implemented.
  • the cloud service control system includes: a physical machine, a gateway controller, and a gateway.
  • the gateway controller is used to assign a new network address to the physical machine, that is, the third network address as the proxy address of the physical machine on the cloud, and record the mapping relationship between the first network address and the third network address of the physical machine as the first Mapping relationship; and allocate a new network address for the target cloud host, that is, the second network address and the second port information as the proxy address of the target cloud host, and record the fourth network address and the fourth port information and the second network address and the second The mapping relationship between the two port information is used as the second mapping relationship; and the first mapping relationship and the second mapping relationship are sent to the gateway.
  • the gateway is used for forwarding the access request to the target cloud host according to the first mapping relationship and the second mapping relationship when the physical machine sends an access request to the target cloud host, and feeding back the response information of the target cloud host to the physical machine.
  • the communication between the physical machine and the target cloud host is realized, and then the purpose of the physical machine controlling the cloud service running on the target cloud host is realized.
  • FIG. 1 is a schematic structural diagram of a cloud service control system in an embodiment of the present disclosure
  • FIG. 2 is a schematic diagram of a relationship among a first network address, a second network address, a third network address, and a fourth network address in an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of a process in which a physical machine communicates with a target cloud host in an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of another process in which a physical machine communicates with a target cloud host in an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of communication between a physical machine and a target cloud host in an embodiment of the present disclosure
  • FIG. 6 is a flowchart of interaction between a physical machine, a gateway controller, a gateway, and a target cloud host in an embodiment of the present disclosure
  • FIG. 7 is a flowchart of a cloud service control method in an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a cloud service control device in an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an electronic device in an embodiment of the present disclosure.
  • the term “comprise” and its variations are open-ended, ie “including but not limited to”.
  • the term “based on” is “based at least in part on”.
  • the term “one embodiment” means “at least one embodiment”; the term “another embodiment” means “at least one further embodiment”; the term “some embodiments” means “at least some embodiments.” Relevant definitions of other terms will be given in the description below.
  • FIG. 1 is a schematic structural diagram of a cloud service control system in an embodiment of the present disclosure.
  • the cloud service control system includes: a physical machine 110 , a target cloud host 120 , a gateway controller 130 and a gateway 140 .
  • the physical machine 110 is assigned a first network address
  • the target cloud host 120 is assigned a fourth network address
  • the first network address and the fourth network address are in different network planes.
  • the network plane where the first network address is located is the plane where the physical network underlay is located
  • the network plane where the fourth network address is located is the plane where the virtual network overlay is located.
  • the underlay network refers to the traditional single-layer network, which is a physical network based on physical network equipment.
  • the underlay network can be improved through technical improvement of the physical network equipment itself, expansion of the number of equipment, and bandwidth scale.
  • the overlay network refers to a layer of logical network superimposed on the basis of the underlay network. It is a virtual network superimposed on the network architecture.
  • logical nodes and logical links constitute an overlay network.
  • the first network address and the fourth network address are in different network planes, the communication between the physical machine 110 and the target cloud host 120 cannot be realized based on the first network address and the fourth network address; on the other hand, the first The network address is the same as the fourth network address, so the normal communication between the physical machine 110 and the target cloud host 120 cannot be realized based on the first network address and the fourth network address.
  • the reason why the first network address and the fourth network address are on different network planes is determined by the service applications and network-related protocols carried by the physical machine 110 and the target cloud host 120 respectively.
  • the physical machine 110 is configured as a server in the management and control area of the public cloud computer room
  • the target cloud host 120 is configured as a virtual machine in the sales area of the public cloud computer room.
  • the business application is usually the internal basic service architecture of the public cloud service provider, which is used to provide software and/or hardware foundation for the public cloud service, so the plane where the first network address allocated to the physical machine 110 is usually the plane where the underlay network is located;
  • the business applications deployed on the virtual machines in the sales area are customer-oriented and provide services for customers.
  • the number of virtual machines is far more than the number of servers in the control area. Therefore, in order to reduce the pressure on the underlay network, it is convenient to The number of machines is expanded, and the plane where the fourth network address allocated to the virtual machines in the sales area is usually the plane where the overlay network is located.
  • a gateway controller 130 and a gateway 140 are added in the cloud service control system provided by the embodiment of the present disclosure.
  • the physical machine 110 is configured to send a first access request to the gateway controller 130, and the first access request is used to request reverse access to the target cloud host 120; the first access request includes the first network address of the physical machine 110 and the first port information, as well as the fourth network address and fourth port information of the target cloud host 120.
  • the gateway controller 130 is used for responding to the first access request, assigning the third network address to the physical machine 110 and recording the mapping relationship between the first network address and the third network address of the physical machine 110 as the first mapping relationship, and as the target
  • the cloud host 120 allocates the second network address and the second port information and records the mapping relationship between the fourth network address and the fourth port information of the target cloud host 120 and the second network address and the second port information as the second mapping relationship, And send the first mapping relationship and the second mapping relationship to the gateway 140 .
  • the gateway 140 is configured to respond to the first access request, forward the first access request to the target cloud host 120 according to the first mapping relationship and the second mapping relationship, and feed back the response information of the target cloud host 120 to the physical machine 110 .
  • the gateway 140 is also used for: when receiving the second access request from the target cloud host 120 for the physical machine 110, discard the second access request, so as to prohibit the target cloud host 120 from actively accessing the physical machine 110, so as to ensure deployment Security of business applications on the physical machine 110 . That is, the physical machine 110 can actively access the target cloud host 120 , but the target cloud host 120 cannot actively access the physical machine 110 .
  • the access application If the access application is initiated by the target cloud host 120 and directed at the physical machine 110, the access application will be deleted; if the access application is initiated by the physical machine 110 and directed at the target cloud host 120, the access application will In response, forward the access request to the target cloud host 120 according to the first mapping relationship and the second mapping relationship, and feed back the response information of the target cloud host 120 to the physical machine 110 .
  • the gateway 140 is configured to respond to the first access request, forward the first access request to the target cloud host 120 according to the first mapping relationship and the second mapping relationship, and feed back the response information of the target cloud host 120 to the physical machine 110, including: the gateway 140 determines a matching third network address from the first mapping relationship according to the first network address and first port information of the physical machine 110 included in the first access request, and the second network address included in the first access request.
  • the network address and the second port information determine the matching fourth network address and fourth port information from the second mapping relationship, wherein the first access request is sent to the second network address and the fourth port information through the first network address and the first port information Two port information, so that the first access request reaches the gateway 140.
  • the gateway 140 sends the first access request to the matching fourth network address and fourth port information through the matching third network address and first port information, so as to forward the first access request to the target cloud host 120 .
  • the gateway 140 receives the response information fed back by the target cloud host 120, and the response information is sent to the third network address and the first port information through the fourth network address and the fourth port information, so that the response information reaches the gateway 140, and the gateway 140 includes according to the response information.
  • the gateway 140 sends the response information to the matching first network address and the first port information through the matching second network address and the second port information, so as to forward the response information to the physical Machine 110.
  • the gateway controller 130 is responsible for generating a third network address corresponding to the first network address, a second network address and second port information corresponding to the fourth network address and fourth port information.
  • the third network address and the first port information constitute the proxy address of the physical machine 110 on the cloud; the second network address and the second port information correspond to the fourth network address and the fourth port information, and the second network address and the second port information Constitute the proxy address of the target cloud host 120.
  • the gateway 140 is responsible for constructing the physical machine 110 and the target cloud host based on the proxy address of the physical machine 110 (ie, the third network address and the first port information) and the proxy address of the target cloud host 120 (ie, the second network address and the second port information). Communication link between 120.
  • the first network address and the second network address are on the same network plane, so direct communication between the first network address and the second network address is possible, and the third network address and the fourth network address are on the same network plane, so the third There can be direct communication between the network address and the fourth network address.
  • the embodiment of the present disclosure uses the method of network address IP + port number port to form the second network address, which is convenient (number of available IPs*number of available port numbers) second network addresses may be provided.
  • FIG. 1 A schematic diagram of the mapping relationship between port information (IP3+port1) and the fourth network address and the fourth port information (IP4+port4), wherein the first network address and the first port information (IP1+port1) and the third network address There is a first mapping relationship with the first port information (IP3+port1), and there is a mapping relationship between the second network address and the second port information (IP2+port2) and the fourth network address and the fourth port information (IP4+port4). Second mapping relationship.
  • the first network address IP1 and the second network address IP2 are in the same network plane
  • the third network address IP3 and the fourth network address IP4 are in the same network plane
  • the first network address IP1 and the fourth network address IP4 are in different network planes .
  • the message sent by the address and the second port information (IP2+port2) first arrives at the gateway 140, and the gateway 140 according to the second network address and the second port information (IP2+port2) and the fourth network address and the fourth port information (IP4+
  • the second mapping relationship between port4) determines the matching fourth network address and the fourth port information (IP4+port4), and the first network address and the first port information (IP1+port1) and the third network address and the first
  • the first mapping relationship between the port information (IP1+port1) determines the matching third network address and the first port information (IP1+port1), and then through the matching third network address and the first port information (IP1+port1) Send the message to the matching fourth network address and fourth port information (IP4+port4), so that the message can reach the target cloud host 120 from the physical machine 110 .
  • the target cloud host 120 feeds back response information to the physical machine 110
  • the target cloud host 120 based on the fourth network address and The fourth port information (IP4+port4) sends response information to the third network address and the first port information (IP3+port1), the response information first arrives at the gateway 140, and when the gateway 140 receives the response information, it forwards the response information, namely According to the second mapping relationship, use the matching second network address and second port information (IP2+port2) to replace the fourth network address and fourth port information (IP4+port4), and use the matching first network according to the first mapping relationship
  • IP1 replaces the third network address IP3, and the response information is sent to the first network address and the first port information (IP1+port1) through the second network address and the second port information (IP2+port2), thereby realizing the target cloud
  • the host 120 feeds back the purpose of the response information to the physical machine 110
  • the gateway controller 130 assigns the third network address IP3 to the physical machine 110 according to the access application, assigns the second network address IP2 and the second port information port2 to the target cloud host 120, and creates the first network address and the first port information ( The first mapping relationship between IP1+port1) and the third network address and the first port information (IP3+port1), the fourth network address and the fourth port information (IP4+port4) and the second network address and the second port information (IP2+port2), and send the first mapping relationship and the second mapping relationship to the gateway 140, and the gateway 140 sends the physical machine 110 according to the first mapping relationship and the second mapping relationship
  • the application for accessing the target cloud host 120 is forwarded.
  • the gateway controller 130 is specifically configured to select a network segment different from the private cloud network segment as the target network segment, and select a network address from the target network segment as the first Three network addresses.
  • the private cloud network segment usually includes 10.0.0.0/8, 172.16.0.0/16 and 192.168.0.0/16.
  • the network address is used as the third network address, that is, the proxy address of the physical machine on the cloud.
  • the gateway controller receives the identification of the target cloud host applying for access Information, the identification information includes the fourth network address and the fourth port number of the target cloud host, and further can include the VPC (Virtual Private Cloud, virtual private cloud) identification, and the VPC is constructed for resources such as cloud servers, cloud containers, and cloud databases.
  • VPC Virtual Private Cloud, virtual private cloud
  • a VPC identifier can be introduced.
  • the gateway controller receives the identification information of the target cloud host applying for access, it allocates the second network address and the second port information to the fourth network address in the identification information, and assigns the allocated second network address and second port information , and the fourth network address and the fourth port information of the second network address and the second port information are sent to the gateway and the physical machine, so that the physical machine can use the second network address and the second port information to send a message to the target cloud host It is convenient for the gateway to store a second mapping relationship between the second network address and the second port information and the fourth network address and the fourth port information, and complete message forwarding according to the second mapping relationship.
  • the physical machine sends its first network address and first port information to the gateway controller, and the gateway controller allocates a corresponding third network address, and combines the first network address and first port information with the third network address and The first mapping relationship between the first port information is sent to the gateway and the physical machine.
  • the physical machine determines the second network address and the second port information of the target cloud host to be accessed according to the second mapping relationship, and sends the second network address and the second port information to the second network address and the second port information through the first network address and the second port information Sending a message, when the gateway receives the message, according to the first mapping relationship and the second mapping relationship, using the third network address and the first port information to replace the first network address and the first port information, using the first The fourth network address and the fourth port information replace the second network address and the second port information, and send the message to the fourth network address and the fourth port information through the third network address and the first port information, so that the message Arrive at the target cloud host and complete the forwarding of the message.
  • the cloud service control method includes the following steps:
  • Step 710 Receive the first access request sent by the physical machine, the first access request is used to request reverse access to the target cloud host, the first access request includes the first network address of the physical machine and the first port information, and the fourth network address and fourth port information of the target cloud host.
  • Step 720 In response to the first access request, assign a third network address to the physical machine and record the mapping relationship between the first network address of the physical machine and the third network address as the first mapping relationship , and assign the second network address and second port information to the target cloud host and record the information between the fourth network address and fourth port information of the target cloud host and the second network address and second port information
  • the mapping relationship is used as the second mapping relationship.
  • the assigning the third network address to the physical machine includes:
  • the private cloud network segment usually includes 10.0.0.0/8, 172.16.0.0/16 and 192.168.0.0/16. In order not to occupy the private cloud network segment, you can use the target network segment 100.64.0.0/10
  • the network address is used as the third network address, that is, the proxy address of the physical machine on the cloud.
  • Step 730 Send the first mapping relationship and the second mapping relationship to the gateway.
  • the cloud service control method provided by the embodiments of the present disclosure can achieve the purpose of assigning proxy addresses to the physical machine and the target cloud host respectively, and build a communication link for communication between the physical machine and the target cloud host.
  • Fig. 8 is a schematic structural diagram of a cloud service control device in an embodiment of the present disclosure, the device is integrated into the gateway controller in the cloud service control system described in the above embodiment.
  • the apparatus 800 specifically includes: a receiving module 810 , an allocating module 820 and a sending module 830 .
  • the receiving module 810 is configured to receive the first access request sent by the physical machine, the first access request is used to request reverse access to the target cloud host, and the first access request includes the first access request of the physical machine Network address and first port information, and a fourth network address and fourth port information of the target cloud host; an assignment module 820, configured to assign a third network address to the physical machine in response to the first access request And recording the mapping relationship between the first network address of the physical machine and the third network address as the first mapping relationship, and assigning a second network address and second port information to the target cloud host and recording the The mapping relationship between the fourth network address and fourth port information of the target cloud host and the second network address and second port information is used as a second mapping relationship; the sending module 830 is configured to send the first mapping to the gateway relationship and the second mapping relationship.
  • the assigning module 820 is specifically configured to select a network segment different from the private cloud network segment as the target network segment; select a network address from the target network segment as the third network address.
  • the cloud service control device provided by the embodiments of the present disclosure can achieve the purpose of assigning proxy addresses to the physical machine and the target cloud host respectively, and build a communication link for communication between the physical machine and the target cloud host.
  • the communication device provided by the embodiment of the present disclosure can execute the steps in the communication method provided by the method embodiment of the present disclosure, and the execution steps and beneficial effects are not repeated here.
  • FIG. 9 is a schematic structural diagram of an electronic device in an embodiment of the present disclosure. Referring to FIG. 9 in detail below, it shows a schematic structural diagram of an electronic device 900 suitable for implementing an embodiment of the present disclosure.
  • the electronic device 900 in the embodiment of the present disclosure may include, but not limited to, mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Tablet Computers), PMPs (Portable Multimedia Players), vehicle-mounted terminals ( Mobile terminals such as car navigation terminals), wearable electronic devices, etc., and fixed terminals such as digital TVs, desktop computers, smart home devices, etc.
  • the electronic device shown in FIG. 9 is only an example, and should not limit the functions and application scope of the embodiments of the present disclosure.
  • an electronic device 900 may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 901, which may be randomly accessed according to a program stored in a read-only memory (ROM) 902 or loaded from a storage device 908.
  • a processing device such as a central processing unit, a graphics processing unit, etc.
  • RAM read-only memory
  • various appropriate actions and processes are executed by programs in the memory (RAM) 903 to implement the methods of the embodiments as described in the present disclosure.
  • RAM 903 various programs and data necessary for the operation of the electronic device 900 are also stored.
  • the processing device 901, ROM 902, and RAM 903 are connected to each other through a bus 904.
  • An input/output (I/O) interface 905 is also connected to the bus 904 .
  • the following devices can be connected to the I/O interface 905: input devices 906 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; including, for example, a liquid crystal display (LCD), speaker, vibration an output device 907 such as a computer; a storage device 908 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 909.
  • the communication means 909 may allow the electronic device 900 to perform wireless or wired communication with other devices to exchange data. While FIG. 9 shows electronic device 900 having various means, it is to be understood that implementing or having all of the means shown is not a requirement. More or fewer means may alternatively be implemented or provided.
  • the processes described above with reference to the flowcharts can be implemented as computer software programs.
  • the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a non-transitory computer readable medium, and the computer program includes program code for executing the method shown in the flow chart, thereby realizing the above the method described.
  • the computer program may be downloaded and installed from a network via communication means 909, or from storage means 908, or from ROM 902.
  • the processing device 901 the above-mentioned functions defined in the methods of the embodiments of the present disclosure are executed.
  • the above-mentioned computer-readable medium in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two.
  • a computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
  • a computer-readable signal medium may include a data signal in baseband or propagated as part of a carrier wave carrying computer-readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • a computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can transmit, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device .
  • Program code embodied on a computer readable medium may be transmitted by any appropriate medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.
  • the client and the server can communicate using any currently known or future network protocols such as HTTP (HyperText Transfer Protocol, Hypertext Transfer Protocol), and can communicate with digital data in any form or medium
  • HTTP HyperText Transfer Protocol
  • the communication eg, communication network
  • Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), internetworks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed network of.
  • the above-mentioned computer-readable medium may be included in the above-mentioned electronic device, or may exist independently without being incorporated into the electronic device.
  • the above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the electronic device, the electronic device:
  • the first access request is used to request reverse access to the target cloud host, the first access request includes the first network address and first port information of the physical machine, and the fourth network address and fourth port information of the target cloud host; in response to the first access request, assigning a third network address to the physical machine and recording the first network address of the physical machine and the The mapping relationship between the third network address is used as the first mapping relationship, and the second network address and the second port information are assigned to the target cloud host, and the fourth network address and the fourth port information of the target cloud host are recorded.
  • the mapping relationship between the second network address and the second port information is used as a second mapping relationship; and the first mapping relationship and the second mapping relationship are sent to the gateway.
  • the electronic device may also perform other steps described in the above embodiments.
  • Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, or combinations thereof, including but not limited to device-oriented programming languages—such as Java, Smalltalk, C++, and Includes conventional procedural programming languages - such as the "C" language or similar programming languages.
  • the program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server.
  • the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as through an Internet service provider). Internet connection).
  • LAN local area network
  • WAN wide area network
  • Internet service provider such as AT&T, MCI, Sprint, EarthLink, MSN, GTE, etc.
  • each block in a flowchart or block diagram may represent a module, program segment, or portion of code that contains one or more logical functions for implementing specified executable instructions.
  • the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved.
  • each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations can be implemented by a dedicated hardware-based system that performs the specified functions or operations , or may be implemented by a combination of dedicated hardware and computer instructions.
  • the units involved in the embodiments described in the present disclosure may be implemented by software or by hardware. Wherein, the name of a unit does not constitute a limitation of the unit itself under certain circumstances.
  • FPGAs Field Programmable Gate Arrays
  • ASICs Application Specific Integrated Circuits
  • ASSPs Application Specific Standard Products
  • SOCs System on Chips
  • CPLD Complex Programmable Logical device
  • a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device.
  • a machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium.
  • a machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing.
  • machine-readable storage media would include one or more wire-based electrical connections, portable computer discs, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, compact disk read only memory (CD-ROM), optical storage, magnetic storage, or any suitable combination of the foregoing.
  • RAM random access memory
  • ROM read only memory
  • EPROM or flash memory erasable programmable read only memory
  • CD-ROM compact disk read only memory
  • magnetic storage or any suitable combination of the foregoing.
  • the present disclosure provides a cloud service control system, including: a physical machine, configured to send a first access request to a gateway controller, and the first access request is used to request a target reverse access of the cloud host; the first access request includes the first network address and first port information of the physical machine, and the fourth network address and fourth port information of the target cloud host; a gateway controller, for responding to the first access request, assigning a third network address to the physical machine and recording a mapping relationship between the first network address of the physical machine and the third network address as a first mapping relationship, and Assigning a second network address and second port information to the target cloud host and recording the mapping relationship between the fourth network address and fourth port information of the target cloud host and the second network address and second port information As the second mapping relationship, and sending the first mapping relationship and the second mapping relationship to the gateway; the gateway is used to respond to the first access request, and according to the first mapping relationship and the second mapping relationship Forward the first access request to the target cloud host, and feed back the response information
  • the gateway is further configured to: when receiving the second access request from the target cloud host for the physical machine, then Discarding the second access request to prohibit the target cloud host from actively accessing the physical machine.
  • the gateway is configured to respond to the first access request, and according to the first mapping relationship and the The second mapping relationship, forwarding the first access request to the target cloud host, and feeding back the response information of the target cloud host to the physical machine, including: the gateway according to the first access request included The first network address and the first port information of the physical machine determine the matching third network address from the first mapping relationship, and the second network address and the second port information included in the first access request are obtained from the The matching fourth network address and fourth port information determined in the second mapping relationship, wherein the first access request is sent to the second network address and the first access request through the first network address and the first port information the second port information, so that the first access request reaches the gateway; the gateway sends the first access request to the matching fourth network address and fourth port information, so as to forward the first access request to the target cloud host; the gateway receives the response information fed back by the target cloud host, and the response information passes through the first The fourth
  • the gateway controller is specifically configured to select a network segment different from the private cloud network segment as the target network segment, from Selecting a network address in the target network segment as the third network address.
  • the present disclosure provides a cloud service control method, including: receiving a first access request sent by a physical machine, and the first access request is used to request a reverse Access, the first access request includes the first network address and first port information of the physical machine, and the fourth network address and fourth port information of the target cloud host; in response to the first access request, assigning a third network address to the physical machine and recording the mapping relationship between the first network address of the physical machine and the third network address as the first mapping relationship, and assigning a second network address to the target cloud host The address and the second port information and the mapping relationship between the fourth network address and the fourth port information of the target cloud host and the second network address and the second port information are recorded as the second mapping relationship; The first mapping relationship and the second mapping relationship.
  • the assigning the third network address to the physical machine includes: selecting a network address different from the private cloud network segment segment as the target network segment; select a network address from the target network segment as the third network address.
  • the present disclosure provides a cloud service control device, including: a receiving module, configured to receive a first access request sent by a physical machine, and the first access request is used to request the target cloud In the reverse access of the host, the first access request includes the first network address and first port information of the physical machine, and the fourth network address and fourth port information of the target cloud host; the allocation module is used to In response to the first access request, assigning a third network address to the physical machine and recording a mapping relationship between the first network address of the physical machine and the third network address as a first mapping relationship, and The target cloud host allocates the second network address and second port information and records the mapping relationship between the target cloud host's fourth network address and fourth port information and the second network address and second port information as A second mapping relationship; a sending module, configured to send the first mapping relationship and the second mapping relationship to a gateway.
  • a receiving module configured to receive a first access request sent by a physical machine, and the first access request is used to request the target cloud
  • the first access request includes the first network address and
  • the allocation module when the allocation module allocates the third network address, it is specifically used to: select and private cloud A network segment with a different network segment is used as the target network segment; and a network address is selected from the target network segment as the third network address.
  • the present disclosure provides an electronic device, including:
  • processors one or more processors
  • memory for storing one or more programs
  • the one or more processors When the one or more programs are executed by the one or more processors, the one or more processors implement any cloud service control method provided in the present disclosure.
  • the present disclosure provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, any cloud service as described in the present disclosure is implemented. Control Method.
  • An embodiment of the present disclosure also provides a computer program product, where the computer program product includes a computer program or an instruction, and when the computer program or instruction is executed by a processor, the cloud service control method as described above is implemented.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开实施例公开了一种云服务控制系统、云服务控制方法、装置、电子设备和存储介质，该系统包括：物理机，用于向网关控制器发送第一访问请求；网关控制器，用于为物理机分配第三网络地址以及记录第一网络地址与第三网络地址之间的映射关系作为第一映射关系，并为目标云主机分配第二网络地址和第二端口信息以及记录第四网络地址和第四端口信息与第二网络地址和第二端口信息之间的映射关系作为第二映射关系，以及向网关发送第一映射关系和所述第二映射关系；网关，用于根据第一映射关系和第二映射关系，向目标云主机转发第一访问请求，并将目标云主机的响应信息反馈给物理机。实现了物理机与目标云主机之间的通信。

Description

云服务控制系统、方法、装置、电子设备和存储介质
相关申请的交叉引用
本申请基于申请号为202110909028.7、申请日为2021年08月09日，名称为“云服务控制系统、方法、装置、电子设备和存储介质”的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本公开涉及信息技术领域，尤其涉及一种云服务控制系统、云服务控制方法、装置、电子设备和存储介质。
背景技术
在公有云服务领域，服务提供商通常将部署有公有云服务的机房划分为售卖区和管控区。其中，售卖区的虚拟机用于为客户提供服务，客户可在售卖区的虚拟机部署自己的应用程序；管控区的服务器(包括物理机和虚拟机)用于对售卖区的虚拟机进行管理或者维护。通常为了保证管控区的服务器的安全，只有服务提供商有权限对管控区的服务器进行操控，而客户没有权限对管控区的服务器进行操控。
因此，为了实现管控区的服务器对售卖区的虚拟机进行管理或者维护，如何建立管控区的服务器与售卖区的虚拟机之间的通信链路则显的意义重大。
发明内容
为了解决上述技术问题或者至少部分地解决上述技术问题，本公开实施例提供了一种云服务控制系统、云服务控制方法、装置、电子设备和存储介质，实现了物理机与目标云主机之间的通信，进而实现了物理机对运行于目标云主机上的云服务进行控制的目的。
第一方面，本公开实施例提供了一种云服务控制系统，包括：
物理机，用于向网关控制器发送第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问；所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；
网关控制器，用于响应所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系，以及向网关发送所述第一映射关系和所述第二映射关系；
网关，用于响应所述第一访问请求，并根据所述第一映射关系和所述第二映射关系，向目标云主机转发所述第一访问请求，并将所述目标云主机的响应信息反馈给所述物理机。
第二方面，本公开实施例还提供了一种云服务控制方法，应用于上述第一方面所述的网关控制器，该方法包括：
接收物理机发送的第一访问请求，所述第一访问请求用于物理机请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；
响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；
向网关发送所述第一映射关系和所述第二映射关系。
第三方面，本公开实施例还提供了一种云服务控制装置，集成于上述第一方面所述的云服务控制系统中的网关控制器，该装置包括：
接收模块，用于接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；
分配模块，用于响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关 系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；
发送模块，用于向网关发送所述第一映射关系和所述第二映射关系。
第四方面，本公开实施例还提供了一种电子设备，所述电子设备包括：
一个或多个处理器；
存储装置，用于存储一个或多个程序；
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如上所述的云服务控制方法。
第五方面，本公开实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现如上所述的云服务控制方法。
本公开实施例提供的技术方案与现有技术相比至少具有如下优点：
本公开实施例提供的云服务控制系统，包括：物理机、网关控制器和网关。网关控制器用于为物理机分配新的网络地址，即第三网络地址作为物理机在云上的代理地址，并记录物理机的第一网络地址与第三网络地址之间的映射关系作为第一映射关系；以及为目标云主机分配新的网络地址，即第二网络地址和第二端口信息作为目标云主机的代理地址，并记录第四网络地址和第四端口信息与第二网络地址和第二端口信息之间的映射关系作为第二映射关系；以及向网关发送第一映射关系和第二映射关系。网关用于在物理机向目标云主机发送访问请求时，根据第一映射关系和第二映射关系，向目标云主机转发访问请求，并将目标云主机的响应信息反馈给物理机。实现了物理机与目标云主机之间的通信，进而实现了物理机对运行于目标云主机上的云服务进行控制的目的。
附图说明
结合附图并参考以下具体实施方式，本公开各实施例的上述和其他特征、优点及方面将变得更加明显。贯穿附图中，相同或相似的附图标记表示相同或相似的元素。应当理解附图是示意性的，原件和元素不一定按照比例绘制。
图1为本公开实施例中的一种云服务控制系统的结构示意图；
图2为本公开实施例中的一种第一网络地址、第二网络地址、第三网络地址以及第四网络地址之间的关系示意图；
图3为本公开实施例中的一种物理机与目标云主机进行通信的过程示意图；
图4为本公开实施例中的另一种物理机与目标云主机进行通信的过程示意图；
图5为本公开实施例中的一种物理机与目标云主机之间进行通信的示意图；
图6为本公开实施例中的一种物理机、网关控制器、网关以及目标云主机之间的交互流程图；
图7为本公开实施例中的一种云服务控制方法的流程图；
图8为本公开实施例中的一种云服务控制装置的结构示意图；
图9为本公开实施例中的一种电子设备的结构示意图。
具体实施方式
下面将参照附图更详细地描述本公开的实施例。虽然附图中显示了本公开的某些实施例，然而应当理解的是，本公开可以通过各种形式来实现，而且不应该被解释为限于这里阐述的实施例，相反提供这些实施例是为了更加透彻和完整地理解本公开。应当理解的是，本公开的附图及实施例仅用于示例性作用，并非用于限制本公开的保护范围。
应当理解，本公开的方法实施方式中记载的各个步骤可以按照不同的顺序执行以及并行执行。此外，方法实施方式可以包括附加的步骤和/或省略执行示出的步骤。本公开的范围在此方面不受限制。
本文使用的术语“包括”及其变形是开放性包括，即“包括但不限于”。术语“基于”是“至少部分地基于”。术语“一个实施例”表示“至少一个实施例”；术语“另一实施例”表示“至少一个另外的实施例”；术语“一些实施例”表示“至少一些实施例”。其他术语的相关定义将在下文描述中给出。
需要注意，本公开中提及的“第一”、“第二”等概念仅用于对不同的装置、模块或单元进行区分，并非用于限定这些装置、模块或单元所执行的功能的顺序或者相互依存关系。
需要注意，本公开中提及的“一个”、“多个”的修饰是示意性而非限制性的，本领域技术人员应当理解，除非在上下文另有明确指出，否则应该理解为“一个或多个”。
本公开实施方式中的多个装置之间所交互的消息或者信息的名称仅用于说明性的目的，而并不是用于对这些消息或信息的范围进行限制。
图1为本公开实施例中的一种云服务控制系统的结构示意图。该云服务控制系统包括：物理机110、目标云主机120、网关控制器130和网关140。
其中，物理机110被分配有第一网络地址，目标云主机120被分配有第四网络地址，第一网络地址与第四网络地址处于不同的网络平面。通常，第一网络地址所处的网络平面为物理网络underlay所在平面，第四网络地址所处的网络平面为虚拟网络overlay所在平面。其中，underlay网络指传统单层网络，是基于物理网络设备实现的物理网络，可以通过物理网络设备本身的技术改良、扩大设备数量、带宽规模等完善underlay网络。overlay网络指在underlay网络的基础上叠加的一层逻辑网络，是一种在网络架构上叠加的虚拟网络，对基础网络不进行大规模修改的条件下，实现应用在网络上的承载，是建立在已有网络之上的虚拟网络，逻辑节点和逻辑链路构成了overlay网络。一方面由于第一网络地址与第四网络地址处于不同的网络平面，因此基于第一网络地址与第四网络地址无法实现物理机110与目标云主机120之间的通信；另一方面，第一网络地址与第四网络地址存在相同的情况，因此基于第一网络地址与第四网络地址无法实现物理机110与目标云主机120之间的正常通信。
所述第一网络地址与所述第四网络地址之所以处于不同的网络平面，是由物理机110和目标云主机120各自所承载的业务应用以及网络相关协议确定的。例如，在公有云服务场景下，物理机110被配置为公有云机房中管控区的服务器，目标云主机120被配置为公有云机房中售卖区的虚拟机，由于在管控区的服务器上部署的业务应用通常是公有云服务提供商内部的基础服务架构，用于为公有云服务提供软件和/或硬件基础，因此为物理机110分配的第一网络地址所在的平面通常是underlay网络所在平面；而在售卖区的虚拟机上部署的业务应用是面向客户的，为客户提供服务的，同时虚拟机的数量也远多于管控区服务器的数量，因此为了降低对underlay网络的压力，方 便对虚拟机的数量进行扩充，为售卖区的虚拟机分配的第四网络地址所在平面通常是overlay网络所在平面。
基于上述应用背景，如何实现物理机110与目标云主机120之间的通信是本公开实施例所要解决的技术问题。针对该技术问题，在本公开实施例提供的云服务控制系统中，增设有网关控制器130和网关140。
具体的，物理机110，用于向网关控制器130发送第一访问请求，第一访问请求用于请求对目标云主机120的反向访问；第一访问请求包括物理机110的第一网络地址和第一端口信息，以及目标云主机120的第四网络地址和第四端口信息。网关控制器130用于响应第一访问请求，为物理机110分配第三网络地址以及记录物理机110的第一网络地址与第三网络地址之间的映射关系作为第一映射关系，并为目标云主机120分配第二网络地址和第二端口信息以及记录目标云主机120的第四网络地址和第四端口信息与第二网络地址和第二端口信息之间的映射关系作为第二映射关系，以及向网关140发送第一映射关系和第二映射关系。网关140，用于响应第一访问请求，并根据第一映射关系和第二映射关系，向目标云主机120转发第一访问请求，并将目标云主机120的响应信息反馈给物理机110。
进一步的，网关140还用于：当接收到目标云主机120针对物理机110的第二访问请求时，丢弃第二访问请求，以禁止目标云主机120对物理机110的主动访问，以保证部署在物理机110上的业务应用的安全性。即物理机110可以主动访问目标云主机120，但目标云主机120不能主动访问物理机110。若访问申请为目标云主机120发起的、针对物理机110的访问申请，则将访问申请删除，若访问申请为物理机110发起的、针对目标云主机120的访问申请，则对该访问申请进行响应，根据第一映射关系和第二映射关系，向目标云主机120转发该访问请求，并将目标云主机120的响应信息反馈给物理机110。
具体的，网关140，用于响应第一访问请求，并根据第一映射关系和第二映射关系，向目标云主机120转发第一访问请求，并将目标云主机120的响应信息反馈给物理机110，包括：网关140根据第一访问请求包括的物理机110的第一网络地址和第一端口信息从第一映射关系中确定匹配的第三网络地址，以及根据第一访问请求包括的第二网络地址和第二端口信息从第二 映射关系中确定匹配的第四网络地址和第四端口信息，其中，第一访问请求通过第一网络地址和第一端口信息发送至第二网络地址和第二端口信息，以使第一访问请求达到网关140。网关140将第一访问请求通过匹配的第三网络地址和第一端口信息发送至匹配的第四网络地址和第四端口信息，以将第一访问请求转发至目标云主机120。网关140接收目标云主机120反馈的响应信息，响应信息通过第四网络地址和第四端口信息发送至第三网络地址和第一端口信息，以使响应信息达到网关140，网关140根据响应信息包括的第四网络地址和第四端口信息，从第二映射关系中确定匹配的第二网络地址和第二端口信息，以及根据响应信息包括的第三网络地址和第一端口信息，从第一映射关系中确定匹配的第一网络地址，网关140将响应信息通过匹配的第二网络地址和第二端口信息发送至匹配的第一网络地址和所述第一端口信息，以将响应信息转发至物理机110。
换言之，网关控制器130负责生成与所述第一网络地址对应的第三网络地址，与所述第四网络地址和第四端口信息对应的第二网络地址和第二端口信息。第三网络地址和第一端口信息组成物理机110在云上的代理地址；第二网络地址和第二端口信息与第四网络地址和第四端口信息对应，第二网络地址和第二端口信息组成目标云主机120的代理地址。网关140负责基于物理机110的代理地址(即第三网络地址和第一端口信息)以及目标云主机120的代理地址(即第二网络地址和第二端口信息)构建物理机110与目标云主机120之间的通信链路。具体的，第一网络地址与第二网络地址处于同一网络平面，因此第一网络地址与第二网络地址之间可以直接通信，第三网络地址与第四网络地址处于同一网络平面，因此第三网络地址与第四网络地址之间可以直接通信。为了减少对有限网络地址资源的占用，同时为尽量多的第四网络地址分配对应的第二网络地址，本公开实施例采用网络地址IP+端口号port的方式组建第二网络地址的方式，如此便可提供(可用IP数*可用端口号数)个第二网络地址。
示例性的，参考如图2所示的一种第一网络地址和第一端口信息(IP1+port1)、第二网络地址和第二端口信息(IP2+port2)、第三网络地址和第一端口信息(IP3+port1)以及第四网络地址和第四端口信息(IP4+port4)之间映射关系的示意图，其中，第一网络地址和第一端口信息(IP1+port1) 与第三网络地址和第一端口信息(IP3+port1)之间存在第一映射关系，第二网络地址和第二端口信息(IP2+port2)与第四网络地址和第四端口信息(IP4+port4)之间存在第二映射关系。其中，第一网络地址IP1与第二网络地址IP2处于同一网络平面，第三网络地址IP3与第四网络地址IP4处于同一网络平面，第一网络地址IP1与第四网络地址IP4处于不同的网络平面。
需要说明的是，参考如图3所示的一种物理机110与目标云主机120进行通信的过程示意图，物理机110基于第一网络地址和第一端口信息(IP1+port1)向第二网络地址和第二端口信息(IP2+port2)发送的消息，先到达网关140，网关140根据第二网络地址和第二端口信息(IP2+port2)与第四网络地址和第四端口信息(IP4+port4)之间的第二映射关系确定匹配的第四网络地址和第四端口信息(IP4+port4)，以及第一网络地址和第一端口信息(IP1+port1)与第三网络地址和第一端口信息(IP1+port1)之间的第一映射关系确定匹配的第三网络地址和第一端口信息(IP1+port1)，而后通过匹配的第三网络地址和第一端口信息(IP1+port1)将所述消息发送至匹配的第四网络地址和第四端口信息(IP4+port4)，如此所消息便可从物理机110到达目标云主机120。
反过来，当目标云主机120向物理机110反馈响应信息时，参考如图4所示的一种物理机110与目标云主机120进行通信的过程示意图，目标云主机120基于第四网络地址和第四端口信息(IP4+port4)向第三网络地址和第一端口信息(IP3+port1)发送响应信息，响应信息先到达网关140，网关140接收到响应信息时，对响应信息进行转发，即根据第二映射关系，利用匹配的第二网络地址和第二端口信息(IP2+port2)替换第四网络地址和第四端口信息(IP4+port4)，根据第一映射关系利用匹配的第一网络地址IP1替换第三网络地址IP3，将所述响应信息通过第二网络地址和第二端口信息(IP2+port2)向第一网络地址和第一端口信息(IP1+port1)发送，从而实现目标云主机120向物理机110反馈响应信息的目的。
进一步的，还可以参考如图5所示的另一种物理机110与目标云主机120之间进行通信的示意图，首先，物理机110向网关控制器130发送访问目标云主机120的访问申请，网关控制器130根据该访问申请分别为物理机110分配第三网络地址IP3，为目标云主机120分配第二网络地址IP2和第二端口 信息port2，并创建第一网络地址和第一端口信息(IP1+port1)与第三网络地址和第一端口信息(IP3+port1)之间的第一映射关系，第四网络地址和第四端口信息(IP4+port4)与第二网络地址和第二端口信息(IP2+port2)之间的第二映射关系，并将该第一映射关系和第二映射关系发送至网关140，网关140根据该第一映射关系和第二映射关系对物理机110发送的访问目标云主机120的申请进行转发。
在一种实施方式中，为了不占用私有云网段，网关控制器130具体用于选择与私有云网段不同的网段作为目标网段，从目标网段中选择一个网络地址作为所述第三网络地址。根据网络协议的规定，私有云网段通常包括10.0.0.0/8和172.16.0.0/16和192.168.0.0/16，为了不占用私有云网段，可以利用目标网段100.64.0.0/10中的网络地址作为所述第三网络地址，即物理机在云上的代理地址。
在上述实施例的基础上，参考如图6所示的一种物理机、网关控制器、网关以及目标云主机之间的交互流程图，首先，网关控制器接收申请访问的目标云主机的标识信息，该标识信息包括目标云主机的第四网络地址以及第四端口号，进一步的还可以包括VPC(Virtual Private Cloud，虚拟私有云)标识，VPC为云服务器、云容器、云数据库等资源构建隔离的、用户可自主配置和管理的虚拟网络环境，可提升用户云上资源的安全性，简化用户的网络部署。因此，不同VPC下可存在相同的网络地址以及端口号，当目标云主机的集群量级较大时，为了唯一标识每个目标云主机，可引入VPC标识。网关控制器在接收到申请访问的目标云主机的标识信息时，为标识信息中的第四网络地址分配第二网络地址和第二端口信息，并将分配的第二网络地址和第二端口信息，以及该第二网络地址和第二端口信息针对的第四网络地址和第四端口信息发送至网关和物理机，以方便物理机利用第二网络地址和第二端口信息向目标云主机发送消息，方便网关存储第二网络地址和第二端口信息与第四网络地址和第四端口信息之间的第二映射关系，并根据该第二映射关系完成消息转发。接着，物理机将自己的第一网络地址和第一端口信息发送给网关控制器，网关控制器分配对应的第三网络地址，并将第一网络地址和第一端口信息与第三网络地址和第一端口信息之间的第一映射关系发送给网关和物理机。物理机根据所述第二映射关系，确定其要访问的目标云主机 的第二网络地址和第二端口信息，并通过第一网络地址和第二端口信息向第二网络地址和第二端口信息发送消息，网关接收到该消息时，根据所述第一映射关系以及所述第二映射关系，利用第三网络地址和第一端口信息替换所述第一网络地址和第一端口信息，利用第四网络地址和第四端口信息替换所述第二网络地址和第二端口信息，将消息通过第三网络地址和第一端口信息向第四网络地址和第四端口信息发送，以使所述消息到达目标云主机，完成消息的转发。
在一种实施方式中，参考如图7所示的一种云服务控制方法的流程图，该方法应用于上述云服务控制系统中的网关控制器。本实施例方式中出现的与上述实施方式中相同的表述或者定义，其实质含义可参考上述实施方式中的解释说明，本实施方式中不再赘述。
如图7所示，所述云服务控制方法包括如下步骤：
步骤710、接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息。
步骤720、响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系。
示例性的，所述为所述物理机分配第三网络地址，包括：
选择与私有云网段不同的网段作为目标网段；从所述目标网段中选择一个网络地址作为所述第三网络地址，以避免对私有云网段的占用。根据网络协议的规定，私有云网段通常包括10.0.0.0/8和172.16.0.0/16和192.168.0.0/16，为了不占用私有云网段，可以利用目标网段100.64.0.0/10中的网络地址作为所述第三网络地址，即物理机在云上的代理地址。
步骤730、向网关发送所述第一映射关系和所述第二映射关系。
本公开实施例提供的云服务控制方法，可以实现为物理机以及目标云主机分别分配代理地址的目的，为实现物理机与目标云主机之间的通信构建通信链路。
图8为本公开实施例中的一种云服务控制装置的结构示意图，该装置集成于上述实施例所述的云服务控制系统中的网关控制器。如图8所示，该装置800具体包括：接收模块810、分配模块820和发送模块830。
其中，接收模块810，用于接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；分配模块820，用于响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；发送模块830，用于向网关发送所述第一映射关系和所述第二映射关系。
可选的，分配模块820在分配所述第三网络地址时，具体用于选择与私有云网段不同的网段作为目标网段；从所述目标网段中选择一个网络地址作为所述第三网络地址。
本公开实施例提供的云服务控制装置，可以实现为物理机以及目标云主机分别分配代理地址的目的，为实现物理机与目标云主机之间的通信构建通信链路。
本公开实施例提供的通信装置，可执行本公开方法实施例所提供的通信方法中的步骤，具备执行步骤和有益效果此处不再赘述。
图9为本公开实施例中的一种电子设备的结构示意图。下面具体参考图9，其示出了适于用来实现本公开实施例中的电子设备900的结构示意图。本公开实施例中的电子设备900可以包括但不限于诸如移动电话、笔记本电脑、数字广播接收器、PDA(个人数字助理)、PAD(平板电脑)、PMP(便携式多媒体播放器)、车载终端(例如车载导航终端)、可穿戴电子设备等等的移动终端以及诸如数字TV、台式计算机、智能家居设备等等的固定终端。图9示出的电子设备仅仅是一个示例，不应对本公开实施例的功能和使用范围带来任何限制。
如图9所示，电子设备900可以包括处理装置(例如中央处理器、图形处理器等)901，其可以根据存储在只读存储器(ROM)902中的程序或者从 存储装置908加载到随机访问存储器(RAM)903中的程序而执行各种适当的动作和处理以实现如本公开所述的实施例的方法。在RAM 903中，还存储有电子设备900操作所需的各种程序和数据。处理装置901、ROM 902以及RAM 903通过总线904彼此相连。输入/输出(I/O)接口905也连接至总线904。
通常，以下装置可以连接至I/O接口905：包括例如触摸屏、触摸板、键盘、鼠标、摄像头、麦克风、加速度计、陀螺仪等的输入装置906；包括例如液晶显示器(LCD)、扬声器、振动器等的输出装置907；包括例如磁带、硬盘等的存储装置908；以及通信装置909。通信装置909可以允许电子设备900与其他设备进行无线或有线通信以交换数据。虽然图9示出了具有各种装置的电子设备900，但是应理解的是，并不要求实施或具备所有示出的装置。可以替代地实施或具备更多或更少的装置。
特别地，根据本公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括承载在非暂态计算机可读介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的程序代码，从而实现如上所述的方法。在这样的实施例中，该计算机程序可以通过通信装置909从网络上被下载和安装，或者从存储装置908被安装，或者从ROM 902被安装。在该计算机程序被处理装置901执行时，执行本公开实施例的方法中限定的上述功能。
需要说明的是，本公开上述的计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质或者是上述两者的任意组合。计算机可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。计算机可读存储介质的更具体的例子可以包括但不限于：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑磁盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。在本公开中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。而在本公开中，计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载 了计算机可读的程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。计算机可读信号介质还可以是计算机可读存储介质以外的任何计算机可读介质，该计算机可读信号介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。计算机可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于：电线、光缆、RF(射频)等等，或者上述的任意合适的组合。
在一些实施方式中，客户端、服务器可以利用诸如HTTP(HyperText Transfer Protocol，超文本传输协议)之类的任何当前已知或未来研发的网络协议进行通信，并且可以与任意形式或介质的数字数据通信(例如，通信网络)互连。通信网络的示例包括局域网(“LAN”)，广域网(“WAN”)，网际网(例如，互联网)以及端对端网络(例如，ad hoc端对端网络)，以及任何当前已知或未来研发的网络。
上述计算机可读介质可以是上述电子设备中所包含的；也可以是单独存在，而未装配入该电子设备中。
上述计算机可读介质承载有一个或者多个程序，当上述一个或者多个程序被该电子设备执行时，使得该电子设备：
接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；向网关发送所述第一映射关系和所述第二映射关系。
可选的，当上述一个或者多个程序被该电子设备执行时，该电子设备还可以执行上述实施例所述的其他步骤。
可以以一种或多种程序设计语言或其组合来编写用于执行本公开的操作的计算机程序代码，上述程序设计语言包括但不限于面向设备的程序设计语 言—诸如Java、Smalltalk、C++，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络——包括局域网(LAN)或广域网(WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。
附图中的流程图和框图，图示了按照本公开各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，该模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本公开实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现。其中，单元的名称在某种情况下并不构成对该单元本身的限定。
本文中以上描述的功能可以至少部分地由一个或多个硬件逻辑部件来执行。例如，非限制性地，可以使用的示范类型的硬件逻辑部件包括：现场可编程门阵列(FPGA)、专用集成电路(ASIC)、专用标准产品(ASSP)、片上系统(SOC)、复杂可编程逻辑设备(CPLD)等等。
在本公开的上下文中，机器可读介质可以是有形的介质，其可以包含或存储以供指令执行系统、装置或设备使用或与指令执行系统、装置或设备结合地使用的程序。机器可读介质可以是机器可读信号介质或机器可读储存介质。机器可读介质可以包括但不限于电子的、磁性的、光学的、电磁的、红外的、或半导体系统、装置或设备，或者上述内容的任何合适组合。机器可读存储介质的更具体示例会包括基于一个或多个线的电气连接、便携式计算 机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或快闪存储器)、光纤、便捷式紧凑盘只读存储器(CD-ROM)、光学储存设备、磁储存设备、或上述内容的任何合适组合。
根据本公开的一个或多个实施例，本公开提供了一种云服务控制系统，包括：物理机，用于向网关控制器发送第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问；所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；网关控制器，用于响应所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系，以及向网关发送所述第一映射关系和所述第二映射关系；网关，用于响应所述第一访问请求，并根据所述第一映射关系和所述第二映射关系，向目标云主机转发所述第一访问请求，并将所述目标云主机的响应信息反馈给所述物理机。
根据本公开的一个或多个实施例，在本公开提供的云服务控制系统中，可选的，所述网关还用于：当接收到目标云主机针对物理机的第二访问请求时，则丢弃所述第二访问请求，以禁止所述目标云主机对所述物理机的主动访问。
根据本公开的一个或多个实施例，在本公开提供的云服务控制系统中，可选的，所述网关，用于响应所述第一访问请求，并根据所述第一映射关系和所述第二映射关系，向目标云主机转发所述第一访问请求，并将所述目标云主机的响应信息反馈给所述物理机，包括：所述网关根据所述第一访问请求包括的所述物理机的第一网络地址和第一端口信息从所述第一映射关系中确定匹配的第三网络地址，以及根据所述第一访问请求包括的第二网络地址和第二端口信息从所述第二映射关系中确定匹配的第四网络地址和第四端口信息，其中，所述第一访问请求通过所述第一网络地址和所述第一端口信息发送至所述第二网络地址和所述第二端口信息，以使所述第一访问请求达到所述网关；所述网关将所述第一访问请求通过所述匹配的第三网络地址和所述第一端口信息发送至所述匹配的第四网络地址和第四端口信息，以将所述 第一访问请求转发至所述目标云主机；所述网关接收所述目标云主机反馈的响应信息，所述响应信息通过所述第四网络地址和所述第四端口信息发送至所述第三网络地址和所述第一端口信息，以使所述响应信息达到所述网关，所述网关根据所述响应信息包括的第四网络地址和第四端口信息，从所述第二映射关系中确定匹配的第二网络地址和第二端口信息，以及根据所述响应信息包括的第三网络地址和第一端口信息，从所述第一映射关系中确定匹配的第一网络地址；所述网关将所述响应信息通过所述匹配的第二网络地址和第二端口信息发送至所述匹配的第一网络地址和所述第一端口信息，以将所述响应信息转发至所述物理机。
根据本公开的一个或多个实施例，在本公开提供的云服务控制系统中，可选的，所述网关控制器具体用于选择与私有云网段不同的网段作为目标网段，从所述目标网段中选择一个网络地址作为所述第三网络地址。
根据本公开的一个或多个实施例，在本公开提供一种云服务控制方法，包括：接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；向网关发送所述第一映射关系和所述第二映射关系。
根据本公开的一个或多个实施例，在本公开提供的云服务控制方法中，可选的，所述为所述物理机分配第三网络地址，包括：选择与私有云网段不同的网段作为目标网段；从所述目标网段中选择一个网络地址作为所述第三网络地址。
根据本公开的一个或多个实施例，本公开提供一种云服务控制装置，包括：接收模块，用于接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口 信息；分配模块，用于响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述物理机的第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述目标云主机的第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；发送模块，用于向网关发送所述第一映射关系和所述第二映射关系。
根据本公开的一个或多个实施例，在本公开提供的一种云服务控制装置中，可选的，所述分配模块在分配所述第三网络地址时，具体用于：选择与私有云网段不同的网段作为目标网段；从所述目标网段中选择一个网络地址作为所述第三网络地址。
根据本公开的一个或多个实施例，本公开提供了一种电子设备，包括：
一个或多个处理器；
存储器，用于存储一个或多个程序；
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如本公开提供的任一所述的云服务控制方法。
根据本公开的一个或多个实施例，本公开提供了一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现如本公开提供的任一所述的云服务控制方法。
本公开实施例还提供了一种计算机程序产品，该计算机程序产品包括计算机程序或指令，该计算机程序或指令被处理器执行时实现如上所述的云服务控制方法。
以上描述仅为本公开的较佳实施例以及对所运用技术原理的说明。本领域技术人员应当理解，本公开中所涉及的公开范围，并不限于上述技术特征的特定组合而成的技术方案，同时也应涵盖在不脱离上述公开构思的情况下，由上述技术特征或其等同特征进行任意组合而形成的其它技术方案。例如上述特征与本公开中公开的(但不限于)具有类似功能的技术特征进行互相替换而形成的技术方案。
此外，虽然采用特定次序描绘了各操作，但是这不应当理解为要求这些操作以所示出的特定次序或以顺序次序执行来执行。在一定环境下，多任务和并行处理可能是有利的。同样地，虽然在上面论述中包含了若干具体实现 细节，但是这些不应当被解释为对本公开的范围的限制。在单独的实施例的上下文中描述的某些特征还可以组合地实现在单个实施例中。相反地，在单个实施例的上下文中描述的各种特征也可以单独地或以任何合适的子组合的方式实现在多个实施例中。
尽管已经采用特定于结构特征和/或方法逻辑动作的语言描述了本主题，但是应当理解所附权利要求书中所限定的主题未必局限于上面描述的特定特征或动作。相反，上面所描述的特定特征和动作仅仅是实现权利要求书的示例形式。

Claims (10)

  1. 一种云服务控制系统，其特征在于，包括：
    物理机，用于向网关控制器发送第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；
    网关控制器，用于响应所述第一访问请求，为所述物理机分配第三网络地址以及记录所述第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系，以及向网关发送所述第一映射关系和所述第二映射关系；
    网关，用于响应所述第一访问请求，并根据所述第一映射关系和所述第二映射关系，向目标云主机转发所述第一访问请求，并将所述目标云主机的响应信息反馈给所述物理机。
  2. 根据权利要求1所述的系统，其特征在于，所述网关还用于：
    当接收到目标云主机针对物理机的第二访问请求时，则丢弃所述第二访问请求，以禁止所述目标云主机对所述物理机的主动访问。
  3. 根据权利要求1所述的系统，其特征在于，所述网关，用于响应所述第一访问请求，并根据所述第一映射关系和所述第二映射关系，向目标云主机转发所述第一访问请求，并将所述目标云主机的响应信息反馈给所述物理机，包括：
    所述网关，用于根据所述第一网络地址从所述第一映射关系中确定匹配的第三网络地址，以及根据所述第二网络地址和第二端口信息从所述第二映射关系中确定匹配的第四网络地址和第四端口信息；
    所述网关，还用于将所述第一访问请求通过所述匹配的第三网络地址和所述第一端口信息发送至所述匹配的第四网络地址和第四端口信息，以将所述第一访问请求转发至所述目标云主机；
    所述网关，还用于接收所述目标云主机反馈的响应信息，根据所述响应信息包括的第四网络地址和第四端口信息，从所述第二映射关系中确定匹配的第二网络地址和第二端口信息，以及根据所述响应信息包括的第三网络地址从所述第一映射关系中确定匹配的第一网络地址；
    所述网关，还用于将所述响应信息通过所述匹配的第二网络地址和第二端口信息发送至所述匹配的第一网络地址和所述第一端口信息，以将所述响应信息转发至所述物理机。
  4. 根据权利要求1所述的系统，其特征在于，所述网关控制器具体用于选择与私有云网段不同的网段作为目标网段，从所述目标网段中选择一个网络地址作为所述第三网络地址。
  5. 一种云服务控制方法，其特征在于，包括：
    接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；
    响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；
    向网关发送所述第一映射关系和所述第二映射关系。
  6. 根据权利要求5所述的方法，其特征在于，所述为所述物理机分配第三网络地址，包括：
    选择与私有云网段不同的网段作为目标网段；
    从所述目标网段中选择一个网络地址作为所述第三网络地址。
  7. 一种云服务控制装置，其特征在于，包括：
    接收模块，用于接收物理机发送的第一访问请求，所述第一访问请求用于请求对目标云主机的反向访问，所述第一访问请求包括所述物理机的第一 网络地址和第一端口信息，以及所述目标云主机的第四网络地址和第四端口信息；
    分配模块，用于响应于所述第一访问请求，为所述物理机分配第三网络地址以及记录所述第一网络地址与所述第三网络地址之间的映射关系作为第一映射关系，并为所述目标云主机分配第二网络地址和第二端口信息以及记录所述第四网络地址和第四端口信息与所述第二网络地址和第二端口信息之间的映射关系作为第二映射关系；
    发送模块，用于向网关发送所述第一映射关系和所述第二映射关系。
  8. 根据权利要求7所述的装置，其特征在于，所述分配模块在分配所述第三网络地址时，具体用于：
    选择与私有云网段不同的网段作为目标网段；
    从所述目标网段中选择一个网络地址作为所述第三网络地址。
  9. 一种电子设备，其特征在于，所述电子设备包括：
    一个或多个处理器；
    存储装置，用于存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如权利要求5-6中任一项所述的方法。
  10. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现如权利要求5-6中任一项所述的方法。
PCT/CN2022/107985 2021-08-09 2022-07-26 云服务控制系统、方法、装置、电子设备和存储介质 WO2023016250A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110909028.7A CN115914389B (zh) 2021-08-09 2021-08-09 云服务控制系统、方法、装置、电子设备和存储介质
CN202110909028.7 2021-08-09

Publications (1)

Publication Number Publication Date
WO2023016250A1 true WO2023016250A1 (zh) 2023-02-16

Family

ID=85199861

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/107985 WO2023016250A1 (zh) 2021-08-09 2022-07-26 云服务控制系统、方法、装置、电子设备和存储介质

Country Status (2)

Country Link
CN (1) CN115914389B (zh)
WO (1) WO2023016250A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116567109A (zh) * 2023-05-31 2023-08-08 曙光云计算集团有限公司 一种报文传输方法、装置、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140052877A1 (en) * 2012-08-16 2014-02-20 Wenbo Mao Method and apparatus for tenant programmable logical network for multi-tenancy cloud datacenters
CN107733670A (zh) * 2016-08-11 2018-02-23 新华三技术有限公司 一种转发策略配置方法和装置
CN107959654A (zh) * 2016-10-14 2018-04-24 北京金山云网络技术有限公司 一种数据传输方法、装置及混合云系统
CN109218053A (zh) * 2017-07-03 2019-01-15 中兴通讯股份有限公司 虚拟数据中心的实现方法、系统和存储介质
CN110999265A (zh) * 2017-08-14 2020-04-10 Nicira股份有限公司 管理云计算服务端点和虚拟机之间的网络连接性
CN112543232A (zh) * 2020-12-03 2021-03-23 卡乐电子(苏州)有限责任公司 一种工业设备的远程控制方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7337224B1 (en) * 2002-10-24 2008-02-26 Cisco Technology, Inc. Method and apparatus providing policy-based determination of network addresses
CN106131233B (zh) * 2016-06-20 2019-03-15 腾讯科技（深圳）有限公司 实现数据库多路径访问的方法、装置及系统
WO2018027586A1 (zh) * 2016-08-09 2018-02-15 华为技术有限公司 云计算系统中虚拟机访问物理服务器的方法、装置和系统
CN109451084B (zh) * 2018-09-14 2020-12-22 华为技术有限公司 一种服务访问方法及装置
US11140121B2 (en) * 2019-09-16 2021-10-05 Microsoft Technology Licensing, Llc Efficiently mapping a distributed resource to a virtual network
CN112688917A (zh) * 2020-12-10 2021-04-20 龙芯中科技术股份有限公司 网络访问方法、装置、电子设备和存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140052877A1 (en) * 2012-08-16 2014-02-20 Wenbo Mao Method and apparatus for tenant programmable logical network for multi-tenancy cloud datacenters
CN107733670A (zh) * 2016-08-11 2018-02-23 新华三技术有限公司 一种转发策略配置方法和装置
CN107959654A (zh) * 2016-10-14 2018-04-24 北京金山云网络技术有限公司 一种数据传输方法、装置及混合云系统
CN109218053A (zh) * 2017-07-03 2019-01-15 中兴通讯股份有限公司 虚拟数据中心的实现方法、系统和存储介质
CN110999265A (zh) * 2017-08-14 2020-04-10 Nicira股份有限公司 管理云计算服务端点和虚拟机之间的网络连接性
CN112543232A (zh) * 2020-12-03 2021-03-23 卡乐电子(苏州)有限责任公司 一种工业设备的远程控制方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116567109A (zh) * 2023-05-31 2023-08-08 曙光云计算集团有限公司 一种报文传输方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN115914389A (zh) 2023-04-04
CN115914389B (zh) 2024-10-29

Similar Documents

Publication Publication Date Title
CN109889621B (zh) 虚拟私有云服务的配置方法和装置
CN103942087B (zh) 虚拟机热迁移方法及相关装置和集群系统
CN114942826B (zh) 跨网络多集群系统及其访问方法及云计算设备
US20170171144A1 (en) Management of domain name systems in a large-scale processing environment
KR102131083B1 (ko) 클라우드 기반 호스팅 시스템 및 방법
CN108243079B (zh) 一种基于vpc进行网络访问的方法与设备
JP2019536332A (ja) オンプレミスとオフプレミスとの通信方法、システム、プログラム
CN111124589B (zh) 一种服务发现系统、方法、装置及设备
WO2021063028A1 (zh) 为业务提供网络服务的方法、装置和计算设备
US20200112510A1 (en) Redirecting data packets between overlay network and underlay network
CN111371685A (zh) 数据处理、IPv6挂载方法和装置
CN113162836A (zh) 虚拟局域网联通方法、装置、云服务器、介质和电子设备
CN111654559B (zh) 一种容器数据传输方法及装置
WO2023016250A1 (zh) 云服务控制系统、方法、装置、电子设备和存储介质
CN114760360A (zh) 请求响应方法、装置、电子设备及计算机可读存储介质
US20210266289A1 (en) Secured container management
CN112804366A (zh) 用于解析域名的方法和装置
CN114938394A (zh) 跨集群网络控制方法、装置、设备及存储介质
CN115776493A (zh) 资源请求方法、系统、装置、设备及存储介质
WO2020247112A1 (en) Mapping subnets in different virtual networks using private address space
CN116405567A (zh) 用户资源管理方法、系统、设备及存储介质
JP7496870B2 (ja) 統合システム内のアプリケーション・フローとの通信
CN107124411B (zh) 经典网络环境下的虚拟私有云实现方法、装置、以及系统
CN114553492B (zh) 基于云平台的操作请求处理方法及装置
CN112882820B (zh) 用于配置资源的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22855233

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 12/06/2024)

122 Ep: pct application non-entry in european phase

Ref document number: 22855233

Country of ref document: EP

Kind code of ref document: A1