WO2021219104A1

WO2021219104A1 - Hybrid cloud system, gatekeeper, network access method and storage medium

Info

Publication number: WO2021219104A1
Application number: PCT/CN2021/091185
Authority: WO
Inventors: 谢东
Original assignee: 华为技术有限公司
Priority date: 2020-04-30
Filing date: 2021-04-29
Publication date: 2021-11-04
Also published as: CN113596184A; CN113596184B

Abstract

The present application relates to the technical field of cloud services, and disclosed is a hybrid cloud system. The hybrid cloud system comprises a first cloud system, a second cloud system, and a gatekeeper, the gatekeeper connecting the first cloud system and the second cloud system; a client in the first cloud system, which is used to send an access request message to an internal network port, wherein a source Internet Protocol (IP) address of the access request message is an IP address of the client, and a destination IP address is an IP address of the internal network port; the gatekeeper is used to change the source IP address of the access request message to an IP address of an external network port, change the destination IP address of the access request message to an IP address of a forwarding node, and send the access request message after the address is changed to the forwarding node; and the forwarding node in the second cloud system is used to send the access request message after the address is changed to a service node in the second cloud system. The present application reduces the cost of the gatekeeper on the basis of the implementation of dynamic DNS resolution.

Description

Hybrid cloud system, gatekeeper, network access method and storage medium

Technical field

This application relates to the technical field of cloud services, and in particular to a hybrid cloud system, a gatekeeper, a network access method, and a storage medium.

Background technique

At present, in order to ensure the network security of the intranet (such as a private cloud), a gatekeeper is usually set between the intranet and the external network (such as a public cloud). When the client in the internal network accesses the external network through the gatekeeper, the client's access request message can be sent to the external network through the transmission of the gatekeeper to realize the access to the external network.

Among them, in order to ensure that the client can access a certain Internet Protocol (IP) address through the gatekeeper, the IP address needs to be configured in the gatekeeper as an allowed address in advance, so that the packets carrying the IP address can pass through The gatekeeper can access the IP address through the message. However, in the scenario of accessing the device through a domain name, the IP address corresponding to the device's domain name may change. If the changed IP address is not configured in the gatekeeper as an allowed address, the gatekeeper will not allow the changed IP address to be carried. If the packet with the IP address passes through, the device cannot be accessed through the packet with the changed IP address.

Although the problem can be solved by configuring the dynamic DNS function for the gatekeeper, the cost of the gatekeeper with the dynamic DNS function is higher and its scope of application is limited.

Summary of the invention

This application provides a hybrid cloud system, a gatekeeper, a network access method, and a storage medium, which can solve the problem of high cost of current gatekeepers with dynamic DNS functions.

In a first aspect, a hybrid cloud system is provided. The hybrid cloud system includes a first cloud system, a second cloud system, and a gatekeeper. The first cloud system includes a client, and the second cloud system includes a forwarding node and a service node. The internal network port of the gate is connected to the first cloud system, and the external network port of the gatekeeper is connected to the second cloud system; the client is used to send an access request message to the internal network port, and the source Internet Protocol IP address of the access request message is the client The destination IP address is the IP address of the internal network port; the gatekeeper is used to change the source IP address of the access request message to the IP address of the external network port, and the destination IP address of the access request message to forward The IP address of the node sends the address-changed access request message to the forwarding node; the forwarding node is used to send the address-changed access request message to the service node.

By configuring the forwarding node in the second cloud system, the gatekeeper can send the access request message to the forwarding node, and then send the access request message to the service node through the forwarding node, so that the client can access the service node. Compared with related technologies, there is no need to configure the dynamic DNS resolution function in the gatekeeper, and the general gatekeeper can be used in system deployment, and the memory resources occupied by the gatekeeper for storing DNS resolution addresses are reduced, so that the cost of the gatekeeper can be reduced. , To expand the scope of application of the gatekeeper.

Moreover, since configuring the dynamic DNS resolution function in the gatekeeper will destroy the principle of the gatekeeper for static data exchange, and the gatekeeper in the embodiment of this application does not need to be configured with the function of dynamic DNS resolution, so it will not damage the gatekeeper’s ability to exchange static data. The principle of data exchange can guarantee the scope of application of the hybrid cloud system.

At the same time, since the forwarding node is deployed in the second cloud system, the scale and number of forwarding nodes can be deployed on demand according to application requirements to meet different application scenarios.

In an implementation manner, the second cloud system further includes a first domain name server, the access request message also carries the domain name of the service node, and the first domain name server records the correspondence between the domain name of the service node and the IP address of the forwarding node. The gatekeeper is also used to send a first domain name resolution request carrying the domain name of the business node to the first domain name server; the first domain name server is used to perform domain name resolution based on the domain name of the business node to obtain the IP address of the forwarding node and send it to the network The gate sends the first domain name resolution response carrying the IP address of the forwarding node.

When the second cloud system includes the first domain name server, the gatekeeper may obtain the IP address of the forwarding node through the first domain name server. At this time, since the gatekeeper does not need to record the correspondence between the target information and the IP address of the forwarding node, the memory resources occupied by the gatekeeper for storing the correspondence can be reduced, and the cost of the gatekeeper can be further reduced.

Optionally, the first cloud system further includes a second domain name server, and the second domain name server records the correspondence between the domain name of the business node and the IP address of the internal network port; the client is also used to send to the second domain name server the The second domain name resolution request for the domain name of the business node; the second domain name server is used to perform domain name resolution based on the domain name of the business node to obtain the IP address of the internal network port, and send the second domain name carrying the IP address of the internal network port to the client Domain name resolution response.

When the first cloud system includes the second domain name server, the client can obtain the IP address required for realizing access to the domain name through domain name resolution.

In an achievable manner, the forwarding node is specifically used to report the access request after the address change based on one or more of the domain name of the service node and the port number of the service node carried in the access request message after the address has been changed. The document is sent to the business node.

Optionally, the gatekeeper is also used to record the context information of the access request message. The context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.

Correspondingly, the forwarding node is also used to receive the access response message sent by the service node based on the access request message, and send the access response message to the external network port, and the source IP address of the access response message is the IP address of the service node, The destination IP address is the IP address of the external network port.

At this time, the gatekeeper is also used to obtain the context information of the access response message. When the context information of the access response message matches the context information of the access request message, the source IP address of the access response message is changed to the intranet Change the destination IP address of the access response message to the client's IP address recorded in the context information of the access request message, and send the access response message with the changed address to the client.

In a second aspect, a network access method is provided, which is applied to a hybrid cloud system. The hybrid cloud system includes a first cloud system, a second cloud system, and a gatekeeper. The first cloud system includes a client, and the second cloud system includes The forwarding node and the service node, the internal network port of the gatekeeper is connected to the first cloud system, and the external network port of the gatekeeper is connected to the second cloud system. The method includes: the client sends an access request message to the internal network port. The source Internet Protocol IP address is the client's IP address, and the destination IP address is the IP address of the internal network port; the gatekeeper changes the source IP address of the access request message to the IP address of the external network port, and changes the destination IP address of the access request message The address is changed to the IP address of the forwarding node, and the address-changed access request message is sent to the forwarding node; the forwarding node sends the address-changed access request message to the service node.

Optionally, the second cloud system further includes a first domain name server, the access request message also carries the domain name of the business node, and the first domain name server records the correspondence between the domain name of the business node and the IP address of the forwarding node. The method further includes : The gatekeeper sends the first domain name resolution request carrying the domain name of the service node to the first domain name server; the first domain name server performs domain name resolution based on the domain name of the service node, obtains the IP address of the forwarding node, and sends the forwarding node to the gatekeeper The first domain name resolution response of the IP address.

Optionally, the first cloud system further includes a second domain name server. The second domain name server records the correspondence between the domain name of the business node and the IP address of the internal network port. The method further includes: the client sends to the second domain name server the The second domain name resolution request of the domain name of the business node; the second domain name server performs domain name resolution based on the domain name of the business node, obtains the IP address of the internal network port, and sends the second domain name resolution response carrying the IP address of the internal network port to the client .

Optionally, the forwarding node sends the address-changed access request message to the service node, including: the forwarding node is based on one or more of the domain name of the service node and the port number of the service node carried in the address-changed access request message. One, send the access request message after changing the address to the service node.

Optionally, the method further includes: the gatekeeper records the context information of the access request message, and the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.

Optionally, the method further includes: the forwarding node receives the access response message sent by the service node based on the access request message, and sends the access response message to the external network port, and the source IP address of the access response message is the IP of the service node The destination IP address is the IP address of the external network port; the gatekeeper obtains the context information of the access response message, and when the context information of the access response message matches the context information of the access request message, the source of the response message will be accessed Change the IP address to the IP address of the internal network port, change the destination IP address of the access response message to the client's IP address recorded in the context information of the access request message, and send the access response message with the changed address to the client .

In a third aspect, a gatekeeper is provided. The internal network port of the gatekeeper is connected to the first cloud system, and the external network port of the gatekeeper is connected to the second cloud system. The gatekeeper includes: a first transceiver module for receiving the first cloud For the access request message sent by the client in the system, the source IP address is the IP address of the client, and the destination IP address is the IP address of the internal network port; the second transceiver module is used to transfer the access request message The source IP address is changed to the IP address of the external network port, the destination IP address of the access request message is changed to the IP address of the forwarding node, and the access request message with the changed address is sent to the forwarding node in the second cloud system, so that The forwarding node sends the access request message with the address changed to the service node.

Optionally, the access request message also carries the domain name of the business node, and the second transceiver module is also used to send a first domain name resolution request carrying the domain name of the business node to the first domain name server in the second cloud system, and The first domain name resolution response carrying the IP address of the forwarding node sent by the first domain name server is received, and the first domain name server records the correspondence between the domain name of the service node and the IP address of the forwarding node.

Optionally, the first transceiver module is also used to record context information of the access request message. The context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.

Optionally, the second transceiver module is further configured to receive an access response message sent by the forwarding node. The access response message is sent by the service node to the forwarding node based on the access request message, and the source IP address of the access response message is the service node The destination IP address is the IP address of the gatekeeper’s external network port; the first transceiver module is also used to obtain the context information of the access response message, when the context information of the access response message and the context of the access request message When the information matches, change the source IP address of the access response message to the IP address of the internal network port, and change the destination IP address of the access response message to the client's IP address recorded in the context information of the access request message, which will change The access response message after the address is sent to the client.

In a fourth aspect, a network access method is provided. The method is applied to a gatekeeper. The internal network port of the gatekeeper is connected to a first cloud system, and the external network port of the gatekeeper is connected to a second cloud system. The method includes: receiving the first cloud For the access request message sent by the client in the system, the source IP address of the access request message is the IP address of the client, and the destination IP address is the IP address of the internal network port; the source IP address of the access request message is changed to the external network port Change the destination IP address of the access request message to the IP address of the forwarding node, and send the access request message after the address change to the forwarding node in the second cloud system, so that the forwarding node will change the address of the access The request message is sent to the service node.

Optionally, the access request message also carries the domain name of the business node, and the method further includes: sending a first domain name resolution request carrying the domain name of the business node to the first domain name server in the second cloud system, and receiving the first domain name The first domain name resolution response sent by the server carrying the IP address of the forwarding node, and the first domain name server records the correspondence between the domain name of the service node and the IP address of the forwarding node.

Optionally, the method further includes: recording context information of the access request message, where the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.

Optionally, the method further includes: receiving an access response message sent by the forwarding node, the access response message is sent by the service node to the forwarding node based on the access request message, and the source IP address of the access response message is the IP address of the service node , The destination IP address is the IP address of the external network port of the gatekeeper; to obtain the context information of the access response message, when the context information of the access response message matches the context information of the access request message, the source of the response message will be accessed Change the IP address to the IP address of the internal network port, change the destination IP address of the access response message to the client's IP address recorded in the context information of the access request message, and send the access response message with the changed address to the client .

In a fifth aspect, a gatekeeper is provided. The gatekeeper includes: a first network port, a second network port, a processor, and a computer program stored in the memory. When the processor executes the computer program, the gatekeeper implements the first aspect Methods.

In a sixth aspect, a storage medium is provided, and when instructions in the storage medium are executed by a processor, the method provided in the first aspect is implemented.

Description of the drawings

Fig. 1 is a schematic structural diagram of a hybrid cloud system provided by an embodiment of the present application;

Figure 2 is a schematic structural diagram of another hybrid cloud system provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of another hybrid cloud system provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of yet another hybrid cloud system provided by an embodiment of the present application;

Fig. 5 is a flowchart of a network access method provided by an embodiment of the present application;

Fig. 6 is a schematic structural diagram of a gatekeeper provided by an embodiment of the present application;

FIG. 7 is a flowchart of another network access method provided by an embodiment of the present application;

Fig. 8 is a schematic structural diagram of another gatekeeper provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions, and advantages of the present application clearer, the implementation manners of the present application will be described in further detail below in conjunction with the accompanying drawings.

For ease of understanding, the terms involved in the embodiments of the present application will be explained below.

1. Gatekeeper

A gatekeeper is an information security device used to connect two host systems. One of the two host systems is located in the internal network and the other is located in the external network. The gatekeeper has an internal network port, an external network port and a storage medium. Among them, by controlling the internal network port and the storage medium, the external network port and the storage medium are not connected at the same time, the gatekeeper can isolate the two host systems so that there is no direct physical connection or logical connection between the two host systems And the information exchange based on the information transmission protocol blocks the network connection to the internal network, making the external network unable to directly invade, attack and destroy the internal network, thereby ensuring the security of the host system located on the internal network.

In addition, by connecting the storage medium to the internal network port and the external network port, the gatekeeper can transfer data from one host system to another host system in the form of data files. Take sending data from the internal network to the external network as an example to explain the process of data transmission by the gatekeeper. The data transfer process is as follows: after the host system in the intranet sends the data to be transferred to the intranet port, the storage medium is connected to the intranet port, and the data to be transferred is copied from the intranet port to the storage medium, and the copy is completed Then disconnect the storage medium from the internal network port, then connect the external network port to the storage medium, copy the data to be transferred from the storage medium to the external network port, and disconnect the storage medium from the external network port after the copy is completed Connect, and then the external network port sends the data to be transmitted to the host system located in the external network to realize data transmission.

2. Domain name resolution

Domain name resolution is to point the domain name to the website space IP, which is a service that users can easily access the website through the registered domain name. An IP address is a digital address that identifies a site on the network. An IP address is usually a piece of data with a fixed length, which is difficult to remember. In order to facilitate memory, the domain name is used instead of the IP address to identify the site address. Therefore, domain name resolution is the process of converting domain names to IP addresses.

The embodiment of the present application provides a hybrid cloud system. As shown in FIG. 1, the hybrid cloud system includes a first cloud system 10, a second cloud system 20 and a gatekeeper 30. The first cloud system 10 includes a client 101. The second cloud system 20 includes a forwarding node 201 and a service node 202. In addition, the internal network port of the gatekeeper 30 is connected to the first cloud system 10, and the external network port of the gatekeeper 30 is connected to the second cloud system 20.

Among them, the client 101 is used to send an access request message to the internal network port. The source IP address of the access request message is the IP address of the client 101, and the IP destination IP address is the IP address of the internal network port.

The gatekeeper 30 is configured to change the source IP address of the access request message to the IP address of the external network port, and obtain the information in the second cloud system 20 for forwarding the access request message according to the information in the access request message Forward the IP address of the node 201, change the destination IP address of the access request message to the IP address of the forwarding node 201, and send the access request message with the changed address to the forwarding node 201;

The forwarding node 201 is configured to send the access request message with the address changed to the service node 202.

It can be seen from the above that in the hybrid cloud system provided by the embodiment of the present application, the forwarding node 201 is configured in the second cloud system 20, so that the gatekeeper 30 can send the access request message to the forwarding node 201, and then pass the forwarding node 201 Sending the access request message to the service node 202 can realize the client 101's access to the service node 202. Compared with related technologies, there is no need to configure the dynamic DNS resolution function in the gatekeeper 30, and the general network can be used in system deployment. The gatekeeper 30 is reduced, and the memory resources occupied by the gatekeeper 30 for storing DNS resolution addresses are reduced, so that the cost of the gatekeeper 30 can be reduced, and the scope of application of the gatekeeper 30 can be expanded. Moreover, since the configuration of the dynamic DNS resolution function in the gatekeeper 30 will destroy the principle of the gatekeeper 30 for static data exchange, and the gatekeeper 30 in the embodiment of the present application does not need to be configured with the function of dynamic DNS resolution, so it will not damage the network. The principle of the gate 30 for static data exchange can ensure the scope of application of the hybrid cloud system.

In an achievable manner, the first cloud system 10 may be a private cloud system or a local data center, and the first cloud system 10 has high data security requirements. The second cloud system 20 may be a public cloud system, a private cloud system, or a data center, and the requirements of the second cloud system 20 for data security are not higher than the requirements of the first cloud system 10 for data security. By setting the gatekeeper 30 between the first cloud system 10 and the second cloud system 20, the isolation between the first cloud system 10 and the second cloud system 20 can be achieved, thereby ensuring the data of the first cloud system 10 safety.

For example, the first cloud system 10 may be a private cloud system used by a government unit or a public security department that has higher requirements for data security, and the second cloud system 20 may be a private cloud system that has higher requirements for data security. A cloud system consisting of virtual machines rented by the company in a public cloud system, or. The first cloud system 10 may be a private cloud system used by a government unit or a public security department that has higher requirements for data security, and the second cloud system 20 may be a private cloud system used by the unit that has higher requirements for data security. The private cloud system used by the associated unit. or. The first cloud system 10 may be a local data center used by a government unit or a public security department that has higher requirements on data security, and the second cloud system 20 may be a local data center used by a unit that has higher requirements on data security. The data center used by the associated unit.

The client 101 can be used by a user in the first cloud system 10. For example, when the first cloud system 10 is a private cloud system used by the public security department, at this time, the client 101 can be used by staff in the public security department. For another example, the client 101 can be used by the network manager of the first cloud system 10, the client 101 can be connected to the cloud management platform in the first cloud system 10, and the network manager can operate on the client 101 to achieve Management of the first cloud system 10. In addition, the cloud service used to manage the first cloud system 10 can be deployed on the business node 202 in the second cloud system 20. At this time, the network manager can access the business node 202 through the client 101, and realize the pairing according to the access result. Management of the first cloud system 10. Optionally, cloud services such as authentication, operation and maintenance, application programming interface gateway (APIG), and website portal (portal) may be deployed on the service node 202.

Alternatively, the client 101 may be a host in the cloud management platform, and the host may also initiate an access request message for accessing the host in the second cloud system 20.

Among them, the implementation process of the gatekeeper 30 from receiving the access request message to sending the address-changed access request message to the forwarding node 201 can be as follows: the internal network port of the gatekeeper 30 receives the access request message, and then the gatekeeper 30 The storage medium is connected to the internal network port, the storage medium copies the access request message from the internal network port to the storage medium, and the connection between the two is disconnected after the copy is completed, and then the storage medium reports the access request message The source IP address of the document is changed to the IP address of the external network port, and then the external network port establishes a connection with the storage medium. The external network port copies the access request message from the storage medium to the storage medium, and disconnects it after the copy is completed. Open the connection between the two, and then the external network port obtains the IP address of the forwarding node 201 in the second cloud system 20 for forwarding the access request message according to the information in the access request message, and reports the access request The destination IP address of the document is changed to the IP address of the forwarding node 201.

It should be noted that the operation of changing the source IP address of the access request message to the IP address of the external network port can also be performed by the external network port. However, since the storage medium will not be directly connected to the second cloud system 20, when the storage medium performs the operation of changing the source IP address of the access request message to the IP address of the external network port, the IP address of the client 101 can be reduced The possibility of being leaked into the second cloud system 20 can further improve data security.

Optionally, there may be multiple implementation manners for the gatekeeper 30 to obtain the IP address of the forwarding node 201, and the following two implementation manners will be used as examples for description.

In the first possible implementation manner, the access request message may carry the domain name of the service node that it requests to access, and the gatekeeper 30 may obtain the IP address of the forwarding node 201 through DNS resolution. At this time, as shown in FIG. 2, the second cloud system 20 further includes a first domain name server 203, and the first domain name server 203 records the correspondence between the domain name of the service node and the IP address of the forwarding node 201. Correspondingly, the gatekeeper 30 is also used to send the first domain name resolution request carrying the domain name of the service node to the first domain name server 203. The first domain name server 203 is used to perform domain name resolution based on the domain name of the service node by querying the correspondence between the domain name of the service node and the IP address of the forwarding node 201 to obtain the IP address of the forwarding node 201, and then send the forwarding information to the gatekeeper 30 The first domain name resolution response of the IP address of the node 201, so that the gatekeeper 30 can obtain the IP address of the forwarding node 201.

In the second achievable manner, the access request message may carry at least one of the target information of the domain name of the service node and the port number of the service node that it requests to access, and the gatekeeper 30 may record the target information and the forwarding node The corresponding relationship of the IP address of 201, the gatekeeper 30 can query the corresponding relationship according to the target information to obtain the IP address of the forwarding node 201. For example, the gatekeeper 30 may record the correspondence between the domain name of the service node and the IP address of the forwarding node 201. After the gatekeeper 30 obtains the domain name of the service node carried in the access request message, the gatekeeper 30 may use the service node The corresponding relationship is queried for the domain name of, to obtain the IP address of the forwarding node 201.

It should be noted that, according to whether the gatekeeper 30 supports sending DNS resolution messages, it is possible to determine which method the gatekeeper 30 uses to obtain the IP address of the forwarding node 201. In addition, when the gatekeeper 30 uses DNS resolution to obtain the IP address of the forwarding node 201, since the gatekeeper 30 does not need to record the correspondence between the target information and the IP address of the forwarding node 201, it is possible to reduce the risk of the gatekeeper 30 storing the correspondence. The occupied memory resources can further reduce the cost of the gatekeeper 30.

In addition, the second cloud system 20 may include multiple forwarding nodes 201, and the multiple forwarding nodes 201 may jointly bear the forwarding pressure. When the second cloud system 20 includes multiple forwarding nodes 201, on the one hand, it can avoid low performance or system crash caused by the excessive forwarding pressure of a single forwarding node 201, and on the other hand, it can improve the forwarding in the second cloud system 20. Efficiency, which in turn improves access efficiency. At this time, after the gatekeeper 30 receives the access request message, it may first determine the target forwarding node 201 for forwarding the access request message to the service node 202 among the multiple forwarding nodes 201. Then, the access request message is sent to the target forwarding node 201.

In an implementation manner, the gatekeeper 30 may record the correspondence between different source IP addresses and multiple forwarding nodes 201. Before the gatekeeper 30 sends an access request message to the forwarding node 201, the gatekeeper 30 may also be based on Access the source IP address of the request message, query the correspondence between different source IP addresses and multiple forwarding nodes 201, obtain the target forwarding node 201 used to send the address-changed access request message to the service node 202, and then send the access request The destination IP address of the message is changed to the IP address of the target forwarding node 201, and the address-changed access request message is sent to the target forwarding node 201.

Among them, the forwarding node 201 can be implemented by a virtual machine, a container, or a physical server. For example, the network manager may rent a virtual machine in the second cloud system 20 and configure the virtual machine so that the virtual machine has the function of the forwarding node 201. In addition, the forwarding node 201 may also be a proxy cloud service configured on a virtual machine. For example, the forwarding node 201 may be an Nginx proxy cloud service or an SLB proxy cloud service configured on a virtual machine. Moreover, since the forwarding node 201 is deployed in the second cloud system 20, the scale and number of the forwarding node 201 can be deployed on demand according to application requirements to meet different application scenarios. In addition, because the IP address of the forwarding node 201 usually does not change, for example, the IP address of the forwarding node 201 can be fixed during the system configuration process, or the IP address of the forwarding node 201 can be fixed through the cloud platform settings, so the forwarding is set by The node 201 can avoid the recheck or reconfiguration of the gatekeeper 30 caused by the IP address change, which effectively reduces the labor cost.

Optionally, the implementation manner in which the forwarding node 201 sends the address-changed access request message to the service node 202 may include: forwarding node 201 based on the domain name and port of the business node carried in the address-changed access request message. One or more of the numbers send the access request message with the address changed to the service node 202.

For example, the forwarding node 201 may send the access request message to the service node 202 by way of port mapping. That is, the forwarding node 201 can record the corresponding relationship between the port number and the IP address. After the forwarding node 201 receives the address-changed access request message sent by the external network port of the gatekeeper 30, the forwarding node 201 can obtain The target port of the access request message, and query the corresponding relationship between the port number and the IP address according to the target port, to obtain the IP address corresponding to the port number of the service node 202 that the client 101 requests to access, that is, to obtain the IP of the service node 202 Address, and then send the service request message to the service node 202 according to the IP address of the service node 202.

For another example, the access request message may carry the domain name of the service node that the client 101 requests to access. In this case, the forwarding node 201 may send the access request message to the service node 202 by way of domain name mapping. That is, the forwarding node 201 can record the correspondence between the domain name number and the dynamic IP address. After the forwarding node 201 receives the address-changed access request message sent by the external network port of the gatekeeper 30, the forwarding node 201 can obtain The domain name of the service node carried in the access request message, and the corresponding relationship between the domain name and the dynamic IP address is queried according to the domain name of the service node to obtain the dynamic IP address corresponding to the domain name of the service node, that is, the IP address of the service node 202, Then, the service request message is sent to the service node 202 according to the IP address of the service node 202.

For another example, the access request message may carry the domain name of the service node that the client 101 requests to access. At this time, the forwarding node 201 may also obtain the dynamic IP address corresponding to the domain name of the service node through domain name resolution, that is, obtain the domain name of the service node 202. According to the IP address, the service request message is sent to the service node 202 according to the IP address of the service node 202.

Moreover, since the forwarding node 201 is set in the second cloud system 20, the correspondence between the domain name and the IP address recorded in the forwarding node 201 can be updated in time, so that even if the IP address corresponding to the domain name changes, the access request can be reported. The text is sent to the business node 202 that it requests to access, and compared with related technologies, there is no need to configure the gatekeeper 30 every time the IP address corresponding to the domain name changes, which effectively reduces labor costs and improves access efficiency. At the same time, the client 101 is unaware, and the user experience is improved.

Optionally, when the client 101 accesses the network through a domain name, the client 101 may obtain the IP address required to implement the domain name access through domain name resolution. Correspondingly, as shown in FIG. 3, the first cloud system 10 further includes a second domain name server 102, and the second domain name server 102 records the correspondence between the domain name of the service node and the IP address of the internal network port of the gatekeeper 30. At this time, the client 101 is also used to send a second domain name resolution request carrying the domain name of the business node that it requests to access to the second domain name server 102; the second domain name server 102 is used to based on the domain name of the business node, The corresponding relationship between the domain name and the IP address of the internal network port of the gatekeeper 30 performs domain name resolution to obtain the IP address of the internal network port, and sends a second domain name resolution response carrying the IP address of the internal network port to the client 101. Correspondingly, the client 101 is also used to construct an access request message based on the IP address of the internal network port.

Further, in order to facilitate the service node 202 to send an access response message to the client 101, the gatekeeper 30 may also record the context information of the access request message. Among them, the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message. Alternatively, the context information may also include more information other than the source IP address, source port number, destination IP address, and destination port number, which are not specifically limited in the embodiment of the present application. For example, the context information may also include a transport layer protocol.

Correspondingly, the forwarding node 201 and the gatekeeper 30 also have the following functions:

The forwarding node 201 is also used to receive the access response message sent by the service node 202 based on the access request message, and send the access response message to the external network port. Wherein, the source IP address of the access response message is the IP address of the service node 202, and the destination IP address of the access response message is the IP address of the external network port;

The gatekeeper 30 is also used to obtain the context information of the access response message. When the context information of the access response message matches the context information of the access request message, the source IP address of the access response message is changed to that of the internal network port. IP address, the destination IP address of the access response message is changed to the IP address of the client 101 recorded in the context information of the access request message, and the access response message with the changed address is sent to the client 101. Among them, after the gatekeeper 30 receives the access response message and is to send the address-changed access response message to the client 101, refer to the process of the gatekeeper 30 from receiving the access request message to changing the address. The implementation process of sending the request message to the forwarding node 201 will not be repeated here.

Wherein, the access request message and the access response message in the embodiment of the present application may both be hypertext transport protocol (hypertext transport protocol, http) messages. Information such as the port number and domain name can be carried in the header of the http message.

In addition, in order to realize the transmission of messages in the hybrid cloud system, the hybrid cloud system may further include devices such as switches and network address translation gateways. For example, as shown in FIG. 4, in the hybrid cloud system, a switch 103 may also be set between the client 101 and the internal network port of the gatekeeper 30, and a network may also be set between the forwarding node 201 and the service node 202. Address translation gateway 204. In addition, the external network port of the gatekeeper 30 and the conversion node can also be connected through a dedicated line network or a software-defined wide area network (SD-WAN).

To sum up, in the hybrid cloud system provided by the embodiment of the present application, the forwarding node is configured in the second cloud system, so that the gatekeeper can send the access request message to the forwarding node, and then the access request can be sent to the forwarding node through the forwarding node. The message is sent to the business node, which can realize the client's access to the business node. Compared with related technologies, there is no need to configure the dynamic DNS resolution function in the gatekeeper. The general gatekeeper can be used in the system deployment, and the gatekeeper factor can be reduced. The memory resources occupied by storing DNS resolution addresses make it possible to reduce the cost of the gatekeeper and expand the scope of application of the gatekeeper. Moreover, since configuring the dynamic DNS resolution function in the gatekeeper will destroy the principle of the gatekeeper for static data exchange, and the gatekeeper in the embodiment of this application does not need to be configured with the function of dynamic DNS resolution, so it will not damage the gatekeeper’s ability to exchange static data. The principle of data exchange can guarantee the scope of application of the hybrid cloud system. At the same time, since the forwarding node is deployed in the second cloud system, the scale and number of forwarding nodes can be deployed on demand according to application requirements to meet different application scenarios.

The following takes the hybrid cloud system shown in FIG. 3 as an example to describe the implementation process of implementing network access through the hybrid cloud provided in the embodiments of the present application. As shown in Figure 5, the implementation process of the network access method may include the following steps:

Step 501: The client sends a second domain name resolution request carrying the domain name of the service node to the second domain name server.

When the client accesses the network through the domain name, the client can obtain the IP address required for realizing the domain name access through domain name resolution. Therefore, the client can send a second domain name resolution request carrying the domain name of the service node to the second domain name server.

It should be noted that before the client sends the second domain name resolution request, the second domain name server needs to be matched with the domain name server used by the first cloud system in advance, so that the second domain name server can be used to perform the domain name for the client. Parsing. In addition, since the client's access request message for requesting access to all business nodes in the second cloud system needs to be sent to the second cloud system through the gatekeeper, the second cloud system can be configured in the second domain name server The IP addresses corresponding to the domain names of all the business nodes in the network are the IP addresses of the internal network port of the gatekeeper, so that the access request message can be correctly transmitted. For example, assuming that the IP address of the internal network port is 1.1.1.1, the IP addresses corresponding to the domain names of all business nodes in the second cloud system can be configured as 1.1.1.1 in the second domain name server.

Step 502: The second domain name server performs domain name resolution based on the domain name of the service node to obtain the IP address of the internal network port, and sends a second domain name resolution response carrying the IP address of the internal network port to the client.

After receiving the second domain name resolution request sent by the client, the second domain name server can obtain the domain name corresponding to the domain name of the service node according to the correspondence between the domain name of the service node and the IP address of the internal network port recorded by the second domain name server. The IP address of the network port.

Step 503: The client sends an access request message to the internal network port according to the IP address of the internal network port. The source IP address of the access request message is the IP address of the client and the destination IP address is the IP address of the internal network port.

After the client receives the IP address of the internal network port carried in the second domain name resolution response, it can construct an access request message based on the IP address of the internal network port, and the source IP address of the access request message is the client's IP address , The destination IP address is the IP address of the internal network port. Optionally, the access request message may also carry the port number of the service node that the client requests to access. For example, suppose the port number of the business node that the client requests to access is 8080, the client's IP address is 10.20.0.100, and the IP address of the internal network port is 1.1.1.1, then the destination port of the access request packet is 8080, and the source IP The address is 10.20.0.100, and the destination IP address is 1.1.1.1.

Step 504: The internal network port of the gatekeeper records the context information of the access request message.

After the internal network port of the gatekeeper receives the access request message sent by the client, it can record the context information of the access request message, so that the client can send the access response for the access request message to the client according to the context information Message. The context information may include: the source IP address, source port number, destination IP address, and destination port number of the access request message. Alternatively, the context information may also include more information other than the source IP address, source port number, destination IP address, and destination port number, which are not specifically limited in the embodiment of the present application. For example, the context information may also include a transport layer protocol.

Step 505: The storage medium of the gatekeeper is connected to the internal network port, the access request message is copied to the storage medium, and the source IP address of the access request message is changed to the IP address of the external network port.

For the implementation process of this step 505, reference may be made to the relevant description in the foregoing system embodiment, which is not repeated here.

For example, assuming that the IP address of the external network port is 2.1.1.1, still taking the example in step 503 as an example, after the storage medium copies the access request message to the storage medium, the source IP address of the access request message can be changed from 10.20.0.100 is changed to 2.1.1.1.

Step 506: Connect the external network port of the gatekeeper to the storage medium, copy the access request message to the external network port, obtain the IP address of the forwarding node used to send the access request message to the service node, and transfer the access request message The destination IP address is changed to the IP address of the forwarding node, and the access request message with the changed address is sent to the forwarding node.

For the implementation process of this step 506, reference may be made to the relevant description in the foregoing system embodiment, which is not repeated here.

For example, suppose that the IP address of the forwarding node that sends the access request message to the service node is 10.10.0.253. Still taking the example in step 503 as an example, after the external network port copies the access request message to the storage external network port, you can Change the destination IP address of the access request message from 1.1.1.1 to 10.10.0.253.

Step 507: The forwarding node sends the address-changed access request message to the service node.

The implementation process of step 507 may include: the forwarding node sends the address-changed access request message to one or more of the domain name of the service node and the port number of the service node carried in the access request message after the address is changed. Business node. For the specific implementation process, please refer to the relevant description in the foregoing system embodiment accordingly, which will not be repeated here.

Step 508: The forwarding node receives the access response message sent by the service node based on the access request message, and sends the access response message to the external network port. The source IP address of the access response message is the IP address of the service node, and the destination IP address is The IP address of the external network port.

Step 509: The gatekeeper obtains the context information of the access response message, and when the context information of the access response message matches the context information of the access request message, the source IP address of the access response message is changed to the IP address of the internal network port , Change the destination IP address of the access response message to the client's IP address recorded in the context information of the access request message, and send the access response message with the changed address to the client.

Among them, to ensure data security, the operation of changing the destination IP address of the access response message to the client's IP address recorded in the context information of the access request message can be performed by the internal network port of the gatekeeper. In addition, in the implementation process of the gatekeeper from receiving the access response message and sending the address-changed access response message to the client, you can refer to the gatekeeper from receiving the access request message to sending the access request message after the address is changed. The implementation process to the forwarding node will not be repeated here.

To sum up, in the network access method provided by the embodiment of the present application, the source IP address of the access request message is changed to the IP address of the external network port through the gatekeeper, and the destination IP address of the access request message is changed to forwarding The IP address of the node, the access request message after the address is changed to the forwarding node, and then the access request message is sent to the service node through the forwarding node, which can realize the client's access to the service node. Compared with related technologies, There is no need to configure the dynamic DNS resolution function in the gatekeeper, and the general gatekeeper can be used in system deployment, and the memory resources occupied by the gatekeeper for storing DNS resolution addresses are reduced, so that the cost of the gatekeeper can be reduced and the application of the gatekeeper can be expanded Scope. Moreover, since configuring the dynamic DNS resolution function in the gatekeeper will destroy the principle of the gatekeeper for static data exchange, and the gatekeeper in the embodiment of this application does not need to be configured with the function of dynamic DNS resolution, so it will not damage the gatekeeper’s ability to exchange static data. The principle of data exchange can guarantee the scope of application of the hybrid cloud system. At the same time, since the forwarding node is deployed in the second cloud system, the scale and number of forwarding nodes can be deployed on demand according to application requirements to meet different application scenarios.

It should be noted that the sequence of steps of the network access method provided in the embodiments of the present application can be adjusted appropriately, and the steps can also be increased or decreased accordingly according to the situation. Any person familiar with the technical field can easily think of a method of change within the technical scope disclosed in this application, which should be covered by the protection scope of this application, and therefore will not be repeated.

The embodiment of the application also provides a gatekeeper. The internal network port of the gatekeeper is connected to the first cloud system, and the external network port of the gatekeeper is connected to the second cloud system. As shown in Figure 6, the gatekeeper 60 includes:

The first transceiver module 601 is configured to receive an access request message sent by a client in the first cloud system, the source IP address of the access request message is the IP address of the client, and the destination IP address is the IP address of the internal network port;

The second transceiver module 602 is used to change the source IP address of the access request message to the IP address of the external network port, change the destination IP address of the access request message to the IP address of the forwarding node, and change the address of the access request The message is sent to the forwarding node in the second cloud system, so that the forwarding node sends the address-changed access request message to the service node.

Optionally, the access request message also carries the domain name of the business node. In this case, the second transceiver module 602 is also used to send the first domain name carrying the domain name of the business node to the first domain name server in the second cloud system. Resolve the request, and receive a first domain name resolution response carrying the IP address of the forwarding node sent by the first domain name server, and the first domain name server records the correspondence between the domain name of the service node and the IP address of the forwarding node.

Optionally, the first transceiver module 601 is also used to record the context information of the access request message. The context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.

Optionally, the second transceiver module 602 is further configured to receive an access response message sent by the forwarding node. The access response message is sent by the service node to the forwarding node based on the access request message, and the source IP address of the access response message is the service The IP address of the node, the destination IP address is the IP address of the external network port of the gatekeeper;

Correspondingly, the first transceiver module 601 is also used to obtain the context information of the access response message, and when the context information of the access response message matches the context information of the access request message, change the source IP address of the access response message It is the IP address of the internal network port, the destination IP address of the access response message is changed to the client's IP address recorded in the context information of the access request message, and the access response message with the changed address is sent to the client.

In summary, in the gatekeeper provided in the embodiment of the present application, the source IP address of the access request message is changed to the IP address of the external network port through the second transceiver module, and the destination IP address of the access request message is changed to The IP address of the forwarding node, and the access request message after the address change is sent to the forwarding node, so that the forwarding node can send the access request message to the service node, which can realize the client's access to the service node, compared with related technologies , There is no need to configure dynamic DNS resolution function in the gatekeeper, can use general gatekeeper in system deployment, and reduce the memory resources occupied by the gatekeeper by storing DNS resolution addresses, so that the cost of the gatekeeper can be reduced, and the cost of the gatekeeper can be expanded. Scope of application. Moreover, since configuring the dynamic DNS resolution function in the gatekeeper will destroy the principle of the gatekeeper for static data exchange, and the gatekeeper in the embodiment of this application does not need to be configured with the function of dynamic DNS resolution, so it will not damage the gatekeeper’s ability to exchange static data. The principle of data exchange can guarantee the scope of application of the hybrid cloud system. At the same time, because the forwarding node is deployed in the second cloud system, the scale and number of forwarding nodes can be deployed on demand according to application requirements to meet different application scenarios.

Those skilled in the art can clearly understand that, for the convenience and conciseness of the description, the configuration and specific working process of the gatekeeper and modules described above can refer to the corresponding content in the foregoing system embodiment and method embodiment. Go into details again.

The embodiment of the present application also provides a network access method, which can be applied to a gatekeeper. As shown in Figure 7, the method may include:

Step 701: Receive an access request message sent by a client in the first cloud system, where the source IP address of the access request message is the IP address of the client, and the destination IP address is the IP address of the internal network port.

Step 702: Record the context information of the access request message. The context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.

Step 703: Change the source IP address of the access request message to the IP address of the external network port, change the destination IP address of the access request message to the IP address of the forwarding node, and send the access request message with the changed address to the first Second, the forwarding node in the cloud system enables the forwarding node to send the address-changed access request message to the service node.

Among them, before the gatekeeper changes the destination IP address of the access request message to the IP address of the forwarding node, it needs to obtain the IP address of the forwarding node first, and its implementation may include:

In the first possible implementation manner, the access request message can carry the domain name of the service node that it requests to access, and the gatekeeper can obtain the IP address of the forwarding node through DNS resolution. At this time, as shown in FIG. 2, the second cloud system 20 further includes a first domain name server 203, and the first domain name server 203 records the correspondence between the domain name of the service node and the IP address of the forwarding node 201. Correspondingly, the gatekeeper 30 may send the first domain name resolution request carrying the domain name of the service node to the first domain name server 203, and receive the first domain name resolution response carrying the IP address of the forwarding node sent by the first domain name server 203. Wherein, the first domain name server 203 may perform domain name resolution based on the domain name of the service node by querying the correspondence between the domain name of the service node and the IP address of the forwarding node 201 to obtain the IP address of the forwarding node 201.

In the second achievable manner, the access request message can carry at least one of the target information of the domain name and port number of the business node that it requests to access, and the gatekeeper can record the target information and the IP address of the forwarding node. Correspondence, the gatekeeper can query the correspondence according to the target information to obtain the IP address of the forwarding node. For example, the gatekeeper can record the correspondence between the domain name of the service node and the IP address of the forwarding node. After the gatekeeper obtains the domain name of the service node carried in the access request message, the gatekeeper can query the domain name of the service node according to the domain name of the service node. Correspondence to obtain the IP address of the forwarding node.

Step 704: Receive the access response message sent by the forwarding node. The access response message is sent by the service node to the forwarding node based on the access request message. The source IP address of the access response message is the IP address of the service node, and the destination IP address is the network address. The IP address of the external network port of the gate.

Step 705: Obtain the context information of the access response message, and when the context information of the access response message matches the context information of the access request message, change the source IP address of the access response message to the IP address of the internal network port, and change The destination IP address of the access response message is changed to the client's IP address recorded in the context information of the access request message, and the access response message with the changed address is sent to the client.

To sum up, in the network access method provided by the embodiment of the present application, the source IP address of the access request message is changed to the IP address of the external network port, and the destination IP address of the access request message is changed to that of the forwarding node. IP address, the access request message after the address is changed to the forwarding node, so that the forwarding node can send the access request message to the service node, which can realize the client's access to the service node. Compared with related technologies, there is no need to The dynamic DNS resolution function configured in the gatekeeper can use a general gatekeeper in system deployment and reduce the memory resources occupied by the gatekeeper for storing DNS resolution addresses, so that the cost of the gatekeeper can be reduced and the scope of application of the gatekeeper can be expanded. Moreover, since configuring the dynamic DNS resolution function in the gatekeeper will destroy the principle of the gatekeeper for static data exchange, and the gatekeeper in the embodiment of this application does not need to be configured with the function of dynamic DNS resolution, so it will not damage the gatekeeper’s ability to exchange static data. The principle of data exchange can guarantee the scope of application of the hybrid cloud system. At the same time, since the forwarding node is deployed in the second cloud system, the scale and number of forwarding nodes can be deployed on demand according to application requirements to meet different application scenarios.

Moreover, those skilled in the art can clearly understand that for the convenience and conciseness of the description, the implementation process described above can refer to the corresponding process in the foregoing system embodiment and method embodiment, which will not be repeated here.

The embodiment of the present application also provides another gatekeeper. Figure 8 exemplarily provides a possible architecture diagram of the gatekeeper. As shown in FIG. 8, the gatekeeper 80 may include a processor 801, a memory 802, a first network port 803, a second network port 804, and a bus 805.

In the gatekeeper, the number of processors 801 may be one or more, and FIG. 8 only illustrates one of the processors 801. If the gatekeeper has multiple processors 801, the types of multiple processors 801 may be different or may be the same. Optionally, multiple processors of the gatekeeper can also be integrated into a multi-core processor. The processor 801 may be a hardware chip, which is used to complete the method for detecting lithium evolution of a rechargeable battery provided in the embodiment of the present application. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. Alternatively, the processor 801 may also be a general-purpose processor, for example, a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.

The memory 802 stores computer instructions and data, and the memory 802 can store computer instructions and data required to implement the network access method provided in the present application. The memory 802 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically available Erase programmable read-only memory (electrically EPROM, EEPROM), flash memory (flash memory), hard disk (HDD) or solid-state drive (SSD). The volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), Double data rate synchronous dynamic random access memory (double data date SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and direct Memory bus random access memory (direct rambus RAM, DR RAM).

The first network port 803 may be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with a network access function. The first network port 803 is used for data communication between the gatekeeper and other network nodes.

The second network port 804 may be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with a network access function. The second network port 804 is used for data communication between the gatekeeper and other network nodes.

Wherein, when the processor executes the computer program, the gatekeeper can control the first network port, the second network port and the memory to perform the following steps: one of the first network port and the second network port establishes a connection with the memory after receiving the message, Copy the message to the memory. After the memory is disconnected from one of the first network port and the second network port, the other of the first network port and the second network port establishes a connection with the memory, and the message is copied to the first network port. The other of the first network port and the second network port, and the packet is transmitted through the other of the first network port and the second network port.

FIG. 8 also exemplarily plots the bus 805. The bus 805 can connect the processor 801 with the memory 802 and the first network port 803. In this way, through the bus 805, the processor 801 can access the memory 802, and can also use at least one of the first network port 803 and the second network port 804 to exchange data with other network nodes.

In this application, the gatekeeper executes the computer instructions in the memory 802 to implement the network access method provided in this application. For example, when the gatekeeper executes the computer instructions in the memory 802, the following steps may be performed: receiving an access request message sent by the client in the first cloud system, and the destination port of the access request message is the second cloud system that the client requests to access The port number of the business node, the source IP address is the IP address of the client, and the destination IP address is the IP address of the internal network port; the source IP address of the access request message is changed to the IP address of the external network port, and the The destination IP address is changed to the IP address of the forwarding node, and the address-changed access request message is sent to the forwarding node in the second cloud system, so that the forwarding node sends the address-changed access request message to the service node. In addition, the gatekeeper executes the computer instructions in the memory 802, and the implementation process of executing this step can refer to the corresponding description in the foregoing method embodiment.

The embodiment of the present application also provides a storage medium, which is a non-volatile computer-readable storage medium, and when the instructions in the storage medium are executed by the processor, the network access method as in the embodiment of the present application is implemented.

The embodiments of the present application also provide a computer program product containing instructions. When the computer program product runs on a computer, the computer executes the network access method in the embodiments of the present application.

A person of ordinary skill in the art can understand that all or part of the steps in the above embodiments can be implemented by hardware, or by a program to instruct relevant hardware. The program can be stored in a computer-readable storage medium. The storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.

In the embodiments of the present application, the terms "first", "second" and "third" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "plurality" refers to two or more, unless expressly defined otherwise.

The term "and/or" in this application is merely an association relationship describing associated objects, which means that there can be three types of relationships. For example, A and/or B can mean that there is A alone, and both A and B exist. There are three cases of B. In addition, the character "/" in this text generally indicates that the associated objects before and after are in an "or" relationship.

The above are only optional embodiments of this application and are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the concept and principle of this application shall be included in the protection of this application. Within range.

Claims

A hybrid cloud system, characterized in that the hybrid cloud system includes a first cloud system, a second cloud system, and a gatekeeper, the first cloud system includes a client, and the second cloud system includes a forwarding node and a service Node, the internal network port of the gatekeeper is connected to the first cloud system, and the external network port of the gatekeeper is connected to the second cloud system;

The client is configured to send an access request message to the internal network port, the source Internet Protocol IP address of the access request message is the IP address of the client, and the destination IP address is the IP of the internal network port address;

The gatekeeper is configured to change the source IP address of the access request message to the IP address of the external network port, and change the destination IP address of the access request message to the IP address of the forwarding node, Sending the address-changed access request message to the forwarding node;

The forwarding node is configured to send the address-changed access request message to the service node.
The hybrid cloud system according to claim 1, wherein the second cloud system further comprises a first domain name server, the access request message also carries the domain name of the service node, and the first domain name server The correspondence between the domain name and the IP address of the forwarding node is recorded,

The gatekeeper is further configured to send a first domain name resolution request carrying the domain name to the first domain name server;

The first domain name server is configured to perform domain name resolution based on the domain name to obtain the IP address of the forwarding node, and send a first domain name resolution response carrying the IP address of the forwarding node to the gatekeeper.
The hybrid cloud system according to claim 1 or 2, wherein the first cloud system further comprises a second domain name server, and the second domain name server records the domain name of the service node and the internal network port The corresponding relationship of the IP address;

The client is further configured to send a second domain name resolution request carrying the domain name to the second domain name server;

The second domain name server is configured to perform domain name resolution based on the domain name to obtain the IP address of the internal network port, and send a second domain name resolution response carrying the IP address of the internal network port to the client.
The hybrid cloud system according to any one of claims 1 to 3, wherein:

The forwarding node is specifically configured to transfer the address-changed access based on one or more of the domain name of the service node and the port number of the service node carried in the address-changed access request message The request message is sent to the service node.
The hybrid cloud system according to any one of claims 1 to 4, wherein:

The gatekeeper is also used to record context information of the access request message, where the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.
The hybrid cloud system according to claim 5, wherein:

The forwarding node is further configured to receive an access response message sent by the service node based on the access request message, send the access response message to the external network port, and the source of the access response message The IP address is the IP address of the service node, and the destination IP address is the IP address of the external network port;

The gatekeeper is also used to obtain the context information of the access response message. When the context information of the access response message matches the context information of the access request message, the access response message is The source IP address is changed to the IP address of the internal network port, and the destination IP address of the access response message is changed to the client's IP address recorded in the context information of the access request message. After the address is changed The access response message is sent to the client.
A network access method, characterized in that the method is applied to a hybrid cloud system, the hybrid cloud system includes a first cloud system, a second cloud system, and a gatekeeper, the first cloud system includes a client, the The second cloud system includes a forwarding node and a service node, the internal network port of the gatekeeper is connected to the first cloud system, and the external network port of the gatekeeper is connected to the second cloud system, and the method includes:

The client sends an access request message to the internal network port, the source Internet Protocol IP address of the access request message is the IP address of the client, and the destination IP address is the IP address of the internal network port;

The gatekeeper changes the source IP address of the access request message to the IP address of the external network port, changes the destination IP address of the access request message to the IP address of the forwarding node, and changes the address The subsequent access request message is sent to the forwarding node;

The forwarding node sends the address-changed access request message to the service node.
The method according to claim 7, wherein the second cloud system further comprises a first domain name server, the access request message also carries the domain name of the service node, and the first domain name server records The corresponding relationship between the domain name and the IP address of the forwarding node, the method further includes:

Sending, by the gatekeeper, a first domain name resolution request carrying the domain name to the first domain name server;

The first domain name server performs domain name resolution based on the domain name to obtain the IP address of the forwarding node, and sends a first domain name resolution response carrying the IP address of the forwarding node to the gatekeeper.
The method according to claim 7 or 8, wherein the first cloud system further comprises a second domain name server, and the second domain name server records the domain name of the service node and the IP address of the internal network port The corresponding relationship of addresses, the method further includes:

Sending, by the client, a second domain name resolution request carrying the domain name to the second domain name server;

The second domain name server performs domain name resolution based on the domain name to obtain the IP address of the internal network port, and sends a second domain name resolution response carrying the IP address of the internal network port to the client.
The method according to any one of claims 7 to 9, wherein the forwarding node sending the address-changed access request message to the service node comprises:

The forwarding node sends the address-changed access request message based on one or more of the domain name of the service node and the port number of the service node carried in the address-changed access request message To the service node.
The method according to any one of claims 7 to 10, wherein the method further comprises:

The gatekeeper records the context information of the access request message, and the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.
The method according to claim 11, wherein the method further comprises:

The forwarding node receives the access response message sent by the service node based on the access request message, and sends the access response message to the external network port, and the source IP address of the access response message is The IP address of the service node, and the destination IP address is the IP address of the external network port;

The gatekeeper obtains the context information of the access response message, and when the context information of the access response message matches the context information of the access request message, changes the source IP address of the access response message Is the IP address of the internal network port, the destination IP address of the access response message is changed to the client's IP address recorded in the context information of the access request message, and the access response after the address is changed is reported The text is sent to the client.
A gatekeeper, characterized in that an internal network port of the gatekeeper is connected to a first cloud system, and an external network port of the gatekeeper is connected to a second cloud system, and the gatekeeper includes:

The first transceiver module is configured to receive an access request message sent by a client in the first cloud system, where the source IP address of the access request message is the IP address of the client, and the destination IP address is the intranet IP address of the port;

The second transceiver module is configured to change the source IP address of the access request message to the IP address of the external network port, and change the destination IP address of the access request message to the IP address of the forwarding node, and change The access request message after the address is sent to the forwarding node in the second cloud system, so that the forwarding node sends the access request message after the address is changed to the service node.
The gatekeeper according to claim 13, wherein the access request message also carries the domain name of the service node,

The second transceiver module is further configured to send a first domain name resolution request carrying the domain name to a first domain name server in the second cloud system, and receive a first domain name resolution request sent by the first domain name server carrying the The first domain name resolution response of the IP address of the forwarding node, and the first domain name server records the correspondence between the domain name and the IP address of the forwarding node.
The gatekeeper according to claim 13 or 14, characterized in that:

The first transceiver module is further configured to record context information of the access request message, where the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.
The gatekeeper according to claim 15, wherein:

The second transceiver module is further configured to receive an access response message sent by the forwarding node, where the access response message is sent by the service node to the forwarding node based on the access request message, and the access The source IP address of the response message is the IP address of the service node, and the destination IP address is the IP address of the external network port of the gatekeeper;

The first transceiver module is further configured to obtain context information of the access response message, and when the context information of the access response message matches the context information of the access request message, report the access response message The source IP address of the message is changed to the IP address of the internal network port, and the destination IP address of the access response message is changed to the IP address of the client recorded in the context information of the access request message. The access response message after the address is sent to the client.
A network access method, characterized in that the method is applied to a gatekeeper, the internal network port of the gatekeeper is connected to a first cloud system, and the external network port of the gatekeeper is connected to a second cloud system, and the method includes :

Receiving an access request message sent by a client in the first cloud system, where the source IP address of the access request message is the IP address of the client, and the destination IP address is the IP address of the internal network port;

Change the source IP address of the access request message to the IP address of the external network port, change the destination IP address of the access request message to the IP address of the forwarding node, and change the address of the access request message Sent to the forwarding node in the second cloud system, so that the forwarding node sends the address-changed access request message to the service node.
The method according to claim 17, wherein the access request message also carries the domain name of the service node, and the method further comprises:

Send a first domain name resolution request carrying the domain name to the first domain name server in the second cloud system, and receive the first domain name resolution request carrying the IP address of the forwarding node sent by the first domain name server In response, the first domain name server records the correspondence between the domain name and the IP address of the forwarding node.
The method according to claim 17 or 18, wherein the method further comprises:

Record the context information of the access request message, where the context information includes: the source IP address, source port number, destination IP address, and destination port number of the access request message.
The method according to claim 19, wherein the method further comprises:

Receive an access response message sent by the forwarding node, where the access response message is sent by the service node to the forwarding node based on the access request message, and the source IP address of the access response message is the The IP address of the service node, and the destination IP address is the IP address of the external network port of the gatekeeper;

Acquire the context information of the access response message, and when the context information of the access response message matches the context information of the access request message, change the source IP address of the access response message to the internal The IP address of the network port, the destination IP address of the access response message is changed to the client's IP address recorded in the context information of the access request message, and the access response message with the changed address is sent to all The client.
A gatekeeper, characterized in that the gatekeeper comprises: a first network port, a second network port, a processor, and a memory; the memory stores a computer program; when the processor executes the computer program, the The gatekeeper implements the method described in any one of claims 17 to 20.
A storage medium, characterized in that, when the instructions in the storage medium are executed by a processor, the method according to any one of claims 17 to 20 is implemented.