WO2017148249A1 - 配置资源的方法及其网络设备 - Google Patents

配置资源的方法及其网络设备 Download PDF

Info

Publication number
WO2017148249A1
WO2017148249A1 PCT/CN2017/073066 CN2017073066W WO2017148249A1 WO 2017148249 A1 WO2017148249 A1 WO 2017148249A1 CN 2017073066 W CN2017073066 W CN 2017073066W WO 2017148249 A1 WO2017148249 A1 WO 2017148249A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
iaas
modules
mapping relationship
tenant
Prior art date
Application number
PCT/CN2017/073066
Other languages
English (en)
French (fr)
Inventor
赵凯
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17759100.5A priority Critical patent/EP3376738A4/en
Publication of WO2017148249A1 publication Critical patent/WO2017148249A1/zh
Priority to US16/016,343 priority patent/US10616133B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H04L47/82—Miscellaneous aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061—Partitioning or combining of resources
    • G06F9/5077—Logical partitioning of resources; Management or configuration of virtualized resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances

Definitions

  • the present invention relates to the field of communications, and in particular, to a method for resource configuration in a cloud computing domain and a network device thereof.
  • Firewalls are configured between security domains to control cross-domain information traffic.
  • IaaS Infrastructure as a Service
  • IaaS Infrastructure as a Service
  • IaaS provides tenants with virtual resource service capabilities. Tenants can obtain virtual resources from IaaS.
  • Virtual resources refer to the use of virtualization technology to divide physical resources into multiple independent parts that can be used by tenants. These parts have all the user-active features of the original physical resources, and these divided resources become "virtual resources.”
  • IaaS performs resource isolation on a tenant basis.
  • tenant A can only use the IaaS interface to operate virtual resources belonging to A's own, but cannot operate virtual resources of other tenants.
  • the IaaS can provide network resources for tenants and implement network access control through network resource configuration.
  • the network resources are virtual resources, virtual networks, or security groups.
  • the virtual resources are generated and managed by IaaS for network composition and control.
  • the OpenStack cloud computing management platform provides a security group.
  • the security group can configure a virtual machine (English: Virtual Machine, short name: VM) to flow in and out of the flow control policy.
  • the virtual machine in the same security group can Access to each other over the network, while network access across security groups is governed by the traffic control policies of the security group. Therefore, tenants can divide the security domain by creating different security groups.
  • the virtual resource isolation mechanism provided by the IaaS is between the tenants. Although the VMs in different security groups under the same tenant can control the traffic of the network resources, the VMs in a security group under the same tenant remain.
  • the IaaS interface can be invoked through the management network to operate the virtual resources of other security groups under the same tenant. Therefore, there is a security risk of IaaS virtual resource calls.
  • the application expects that the security domains can not only control the flow of network resources, but also isolate the virtual resources.
  • Embodiments of the present invention provide a method for configuring resources in a cloud environment and a network device, which can implement virtualization across security domains. Resource isolation.
  • the first aspect provides a method for configuring resources in a cloud environment, including: determining M security domains of a target application, and a first mapping relationship between the M security domains and N modules of the target application.
  • M ⁇ N, N is an integer, and M is an integer greater than 1;
  • the first request message is sent to the infrastructure-as-a-service IaaS layer device, the first request message is used to request the IaaS layer device to create the M
  • An IaaS tenant corresponding to each security domain in the security domain obtains M IaaS tenants; receives a first response message sent by the IaaS layer device, where the first response message carries the M security domains and the a second mapping relationship between the M IaaS tenants; determining a third mapping relationship between the N modules and the M IaaS tenants according to the first mapping relationship and the second mapping relationship;
  • the first request message requests the IaaS layer device to create M IaaS tenants, and can also be said to be a process of creating M IaaS tenants by calling the interface of the IaaS layer device.
  • the use of the IaaS tenant corresponding to the i-th module of the N modules to allocate the virtual machine resource for the i-th module means that the identity authentication data of the IaaS tenant needs to be transmitted when the deployment system invokes the IaaS interface to apply for the virtual machine resource. Therefore, the VM resource created by using the identity authentication data of the IaaS tenant corresponding to the i-th module uses the IaaS tenant corresponding to the i-th module to allocate virtual machine resources for the i-th module.
  • the embodiment of the present invention creates a corresponding one IaaS tenant on each security domain in the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security.
  • the modules corresponding to the domain allocate the required virtual machine resources. Therefore, the above application partitions the virtual resources between different modules on different security domains.
  • the determining, by the M security groups, the M security groups, a third request message, the third request message is used to request the IaaS layer device to create a security group corresponding to each security domain in the M security domains, to obtain the M security groups, and receive the IaaS layer device to send
  • the second response message, the second response message carries a third mapping relationship between the M security domains and the M security groups.
  • the method further includes: performing a second presence between the M security domains and the M IaaS tenants a mapping relationship, and a fourth mapping relationship between the M security domains and the M security groups, determining a fifth mapping relationship between the M IaaS tenants and the M security groups;
  • the IaaS layer device sends a fourth request message, where the fourth request message is used to request the IaaS layer device to configure the jth security group in the M security groups as the M according to the fifth mapping relationship.
  • the tenth IaaS tenant of the tenant is used, where 1 ⁇ j ⁇ M.
  • configuring the jth security group to be used by the jth IaaS tenant means that the jth security group is used for the jth tenant.
  • the determining the M security domains of the target application, and the M security domains and the N applications of the target application The first mapping relationship between the modules includes: obtaining, from the application design template of the target application, identification information of each security domain in the M security domains; and from an application design template of the target application, Obtaining identification information of each of the N modules, and acquiring identification information of a security domain corresponding to each of the N modules; and identifying information and information of each security domain in the M security domains.
  • the identification information of the security domain corresponding to each of the N modules is determined, and the first mapping relationship existing between the M security domains and the N modules is determined.
  • the second aspect provides a method for configuring a virtual resource in a cloud environment, including: receiving a first request message sent by a deployment device, where the first request message carries an identifier of each security domain in the M security domains of the target application. Information, where M is an integer greater than 1; according to the first request message, each security and corresponding one IaaS tenant in the M security domains is created, and M IaaS tenants and the M IaaS tenants are obtained. The first mapping relationship exists between the M security domains; the first response message is returned to the deployment device, where the first response message carries the first mapping relationship.
  • the embodiment of the present invention creates a corresponding one IaaS tenant in each security domain of the at least two security domains by dividing the application into the at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security domain.
  • the corresponding module allocates the required virtual machine resources, thereby isolating the virtual resources that the created application can implement between different security domains, thereby realizing the isolation of virtual resources between modules on different security domains.
  • the method further includes: receiving a second request message sent by the deployment device, and using the target application according to the second request message, including The IaaS tenant corresponding to the i-th module of the N modules, the virtual machine resource is allocated to the i-th module, wherein the second request message carries the N modules and the M IaaS tenants
  • the second mapping relationship that exists between 1 ⁇ i ⁇ N, M ⁇ N, and N is an integer.
  • the method before the virtual machine resource is allocated to the i th module The method further includes: receiving a third request message sent by the deployment device, and creating a security group corresponding to each security domain in the M security domains according to the third request message, to obtain M security groups and the M a third mapping relationship between the security group and the M security domains; sending a second response message to the deployment device, where the second response message carries the M security domains and the M security groups There is a third mapping relationship between them.
  • the assigning the virtual machine resource to the i th module includes: receiving the Deploying a fourth request message sent by the device, and configuring, according to the fourth request message, the security group to which the i-th module belongs as an access-access security group of the virtual machine resource of the i-th module, where The fourth request message carries a fourth mapping relationship that exists between the M security groups and the N modules.
  • the method further includes: receiving, by the deployment device, a fifth request message, according to The fifth request message configures the jth security group of the M security groups to be used by the jth IaaS tenant of the M tenants, where the fourth request message includes the M security groups A fifth mapping relationship existing between the M IaaS tenants, 1 ⁇ j ⁇ M.
  • the embodiment of the present invention creates a corresponding one IaaS tenant in each security domain of the at least two security domains by dividing the application into the at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security domain.
  • the corresponding module allocates the required virtual machine resources, and further, creates a corresponding security group for the IaaS tenant corresponding to each security domain. Therefore, the created application can not only isolate the virtual resources that can be implemented between different security domains, but also implement network traffic control between different security groups.
  • the third aspect provides a network device, including: a determining unit, a creating unit, and a receiving unit, where the network device is configured to perform the method in any one of the foregoing first aspect or the first aspect.
  • a fourth aspect provides a network device, including: a receiving unit, a creating unit, and a sending unit, where the network device is configured to perform the method in any of the foregoing second aspect or the second aspect.
  • an apparatus comprising: a processor, a receiver, a transmitter, and a memory, the processor and the memory being connected by a bus system, the memory is for storing instructions, and the processor is configured to execute The memory stores instructions to control the receiver to receive a signal, the transmitter to transmit a signal, such that the apparatus performs the method of any of the first aspect or the first aspect of the first aspect.
  • an apparatus including: a processor, a memory, a receiver, and a transmitter, wherein the processor, the memory, and the receiver are connected by a bus system, and the memory is configured to store an instruction
  • the processor is configured to execute instructions stored in the memory to control the receiver to receive a signal, the transmitter to transmit a signal, such that the apparatus performs the second aspect or any of the possible implementations of the second aspect method.
  • a seventh aspect a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.
  • a computer readable medium for storing a computer program comprising instructions for performing the method of the second aspect or any of the possible implementations of the second aspect.
  • FIG. 1 is a schematic block diagram of a system architecture of an embodiment of the present invention.
  • FIG. 2 is a schematic block diagram of one embodiment of an existing application deployment.
  • FIG. 3 is a schematic block diagram of a method for configuring resources according to an embodiment of the present invention.
  • FIG. 4 is a schematic block diagram of one embodiment of an application deployment of the present invention.
  • FIG. 5 is a schematic diagram of a data structure of an application design template according to an embodiment of the present invention.
  • FIG. 6 is an interaction flowchart of a method for resource configuration according to an embodiment of the present invention.
  • FIG. 7 is a schematic block diagram of resource configuration according to an embodiment of the present invention.
  • FIG. 8 is a schematic block diagram of a network device according to an embodiment of the present invention.
  • FIG. 9 is a schematic block diagram of a network device according to another embodiment of the present invention.
  • FIG. 10 is a schematic diagram of a network device of an embodiment of the present invention.
  • FIG. 11 is a schematic block diagram of a network device according to another embodiment of the present invention.
  • FIG. 1 is a schematic block diagram of a system architecture of an embodiment of the present invention.
  • the system architecture includes a deployment system 110 and an infrastructure as a service system 120, wherein the deployment system 110 provides an interactive interface for a user deployment application and reads design data from an application design file, invoking an infrastructure as a service 120.
  • the interface in the system (for example, the OpenStack architecture) completes the creation and configuration of resources required for the application, including the use of IaaS security group resources to complete the division of the business security domain.
  • the deployment system 110 needs to obtain the design data in the application design file, and the application design file needs to provide an interactive interface for the user to design the application by using the design tool, and the user can design the application security domain through the application design;
  • the design input is saved to the application design file.
  • the application deployment of the IaaS layer device is designed by the deployment system according to the application, and the operation and configuration of the application and the deployment of the application software are performed by scheduling and driving a series of interfaces of the IaaS layer device and the peripheral modules. Therefore, implementing the present invention requires multiple links of application design, application deployment scheduling, and the like.
  • Cloud Computing is a computing method used to obtain computing power from a service provider.
  • the computing, storage, and network resources required to provide computing power are virtual; the virtual machine is a cloud computing service.
  • the provided computing node; the security zone (English: Security Zone) refers to the subnet or network with the same security protection requirements, mutual trust, and the same security access control and border control policies in the same system, and the same network security.
  • the same security policy as domain sharing can be understood as a collection of IT system elements with the same business requirements and security requirements. Firewalls need to be set up for security protection between different security domains.
  • Firewall (English: Firewal l) is a Devices that help ensure information security will allow or restrict the transmission of data according to specific rules; tenant (English Tenant) refers to users who use cloud computing service interfaces to use various resources provided by cloud computing in a cloud computing environment; Application (English: Application) refers to the network, storage, and computing provided by cloud computing. Resources, established software systems that provide certain capabilities to the outside; applications consist of a series of computing nodes running software instances, each node communicating with each other; the security group is in the OpenStack cloud computing management platform, used under a security domain A virtual resource that manages the network traffic control area can be configured to control the inflow or outbound traffic.
  • the security group can belong to a tenant. Generally, the security zone and the security zone are in one-to-one correspondence.
  • FIG. 2 is a schematic block diagram of one embodiment of an application deployment.
  • the application A includes two modules, namely, a module one and a module two, wherein the module one is located in the security domain A, corresponding to the security group A, and the second module is located in the security domain B, corresponding to the security group B, wherein
  • the functions of module one and module two are implemented by multiple virtual machine VMs.
  • VMs in module one and VMs in module two implement cross-security groups between module one and module two by configuring accessible security group identifiers. Network flow control.
  • the application A belongs to the tenant A. Since both the security domain A and the security domain B are created by the tenant A, the virtual resources at the IaaS layer belong to the same tenant A. Therefore, the virtual resources across the security group are It is impossible to isolate.
  • FIG. 3 is a schematic block diagram of a method for configuring a resource according to an embodiment of the present invention.
  • the execution body of the method may be a deployment system. As shown in FIG. 3, the method 300 includes:
  • Step 310 The deployment system determines the M security domains of the target application, and the first mapping relationship between the M security domains and the N modules of the target application, where M ⁇ N, N is an integer, and M is greater than An integer of 1.
  • the target application is divided into the M security domains, and the N modules included in the target application have a first mapping relationship with the M security domains, that is, one or more modules are located in a security domain to obtain the target application.
  • the method may be obtained by using the local storage of the deployment system, or may be obtained by the user deploying the target application, and the present invention is not limited thereto.
  • the first mapping relationship between the N modules includes: obtaining, from the application design template of the target application, identification information of each security domain in the M security domains; and acquiring N from the application design template of the target application
  • the identification information of the domain determines the first mapping relationship existing between the M security domains and the N modules.
  • the application design of the target application includes: an application identifier of the target application, a list of N modules, and a list of M security domains, wherein the module design of the i-th module of the N modules may further include at least the following A type: a module identifier of the i-th module, an identifier of the security domain to which the module belongs, and a VM specification of the at least one VM belonging to the module, and a security domain identifier of the j-th security domain in the M security domains.
  • the VM specification of the VM specification further includes a network card list in the VM, and each network card specification in the network card list includes an identifier of the network card and a security domain identifier that the network card can communicate with.
  • the IaaS tenant corresponding to the i th module of the N modules is used, and the virtual machine resource is allocated to the i th module, including: creating an interface of the IaaS for each NIC of the VM.
  • a port object ; and record the mapping relationship between the VM network card and the port; for each network card, obtain a list of the communicationable security domains specified in the design.
  • the IaaS security group corresponding to the security domain is read in turn, and the IaaS interface is invoked to update the corresponding security group to the communicable list of the port.
  • the deployment system may determine whether there are multiple security domains in the target application through the data structure of the target application, and if there are multiple security domain partitions, the above process will be performed.
  • Step 320 The deployment system sends a tenant creation request to the IaaS layer device, where the tenant creation request includes identification information of each security domain in the M security domains, so that the IaaS layer device can be used according to each security domain in the M security domains.
  • the identification information creates an IaaS tenant corresponding to each security domain in the M security domains, and obtains M IaaS tenants.
  • the deployment system sends a tenant creation request to the IaaS layer device, where the request is used to request the IaaS layer device to utilize the administrator user to create a corresponding tenant for each security domain in the M security domains.
  • the IaaS layer device receives the tenant creation request sent by the deployment device, where the tenant creation request carries the identification information of each security domain in the M security domains of the target application, where M is an integer greater than 1; a tenant creation request, creating an IaaS tenant corresponding to each security domain in the M security domains, and obtaining a second mapping relationship between the M IaaS tenants and the M IaaS tenants and the M security domains; Returning a tenant creation response to the deployment device, where the tenant creation response carries the second mapping relationship.
  • Step 340 The deployment system receives a tenant creation response sent by the IaaS layer device, where the tenant creation response includes the second mapping relationship.
  • the tenant creation response sent by the IaaS layer device is received, where the tenant creation response carries the second mapping relationship between the M security domains and the M IaaS tenants, that is, the tenant creation response carries M
  • the deployment system stores the identifiers of the M security domains and the M IaaS tenants and determines the first mapping relationship between them.
  • Step 350 The deployment system determines a third mapping relationship between the N modules and the M IaaS tenants according to the first mapping relationship and the second mapping relationship.
  • the deployment system may locally store the first mapping relationship, the second mapping relationship, or the third mapping relationship, so that The virtual resources are allocated to the N modules according to the mapping relationship.
  • Step 360 The deployment system sends a resource allocation request to the IaaS layer device, so as to request the IaaS layer device to allocate the virtual machine resource to the i-th module by using the IaaS tenant corresponding to the i-th module in the N modules according to the resource allocation request.
  • the resource allocation request includes a third mapping relationship.
  • Step 370 The IaaS layer device receives a resource allocation request sent by the deployment device, where the resource allocation request carries a third mapping relationship between the N modules and the M IaaS tenants, where 1 ⁇ i ⁇ N, M ⁇ N, N is an integer; according to the third mapping relationship, the IaaS tenant corresponding to the i th module of the N modules is used, and the virtual resource is allocated for the i th module.
  • the IaaS tenant corresponding to the i-th module of the N modules is used.
  • the i-th module allocates virtual machine resources.
  • the deployment system calls the IaaS interface to apply for the virtual machine resource, the identity authentication data of the tenant needs to be transmitted. Therefore, the VM resource created by using the identity authentication data of the IaaS tenant corresponding to the i-th module uses the IaaS tenant corresponding to the i-th module.
  • the i-th module allocates virtual machine resources.
  • the resource allocation request further includes a resource specification of each of the N modules, so that the IaaS layer device according to the third mapping relationship and resource specifications of each of the N modules. , allocate virtual resources for N modules.
  • the IaaS layer device may allocate virtual resources to the i-th module according to resource specifications of the i-th module in the N modules.
  • the i-th module resource specification includes a list of network cards corresponding to the i-th module, specifically including a network card identifier of each network card, and a list of security domains that each network card can communicate with.
  • determining the M security groups corresponding to the M security domains includes: sending a security group creation request to the IaaS layer device, where the security group creation request is used to request the IaaS layer device to create the M security domains.
  • Each security zone corresponds to a security group and obtains M security groups.
  • the security group response message sent by the IaaS layer device is received.
  • the security group response message carries a fourth mapping relationship between the M security zones and the M security zones.
  • the deployment system sends a security group creation request to the IaaS layer device, and invokes the IaaS interface to create an IaaS security group for each security domain. Further, the deployment system receives the identifiers of the M security groups sent by the IaaS layer device, and Record the mapping relationship between M security domains and M security groups.
  • the specific implementation manner is to configure the security group corresponding to each security domain in the security domain list as the first Allow access to security groups for i modules.
  • the i-th module after the virtual resource allocated for the i-th module, the i-th module has access rights to the security group in the list of allowed access security groups, and when the security component of the i-th module has access rights, the first The security group to which the i modules belong can be managed by the network traffic generated by the network card of the VM created by the tenant corresponding to the i-th module.
  • the embodiment of the present method creates a corresponding one IaaS tenant in each security domain of the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain.
  • the module corresponding to the security domain allocates the required virtual machine resources, thereby creating the isolation of the virtual resources that the application can implement between different security domains.
  • each security group is created on each security domain in at least two security domains, and each security group can be configured to be used by a tenant corresponding to the security domain to which it belongs, network traffic control across the security domain can be implemented. .
  • the target application can be divided between different modules on different security domains to control network traffic and to isolate virtual resources.
  • the embodiment of the present invention creates a corresponding one IaaS tenant on each security domain in the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security.
  • the modules corresponding to the domain allocate the required virtual resources, and thus the above application partitions the virtual resources between different modules on different security domains.
  • FIG. 4 is a schematic block diagram of one embodiment of an application deployment of the present invention.
  • application A is divided into security zone A and security zone B.
  • Tenant A is created in security domain A
  • tenant B is created in security domain B.
  • Application A includes two modules, namely module one.
  • Module 2 and Module 2 of Application A belong to Security Zone A and Security Zone B respectively. Therefore, Module 1 and Module 2 belong to Tenant A and Tenant B respectively.
  • security group B configure tenant B to access security group A and security group B. Therefore, network traffic control between security domain A and security domain B can be implemented through security A and security group B, and because tenant A and tenant B
  • the virtual resources are isolated, so virtual resource isolation across security domains (or security groups) can be achieved.
  • the module one is located in the security group A
  • the module two is located in the security group B, wherein the functions of the module one and the second module are implemented by multiple VMs
  • the security group can implement the module by configuring the VM in the module one and the VM in the second module.
  • the embodiment of the application deployment shown in FIG. 4 can implement network traffic control across security groups and isolation of virtual resources across security groups.
  • the embodiment of the present invention creates a corresponding one IaaS tenant on each security domain in the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security.
  • the modules corresponding to the domain allocate the required virtual machine resources. Therefore, the above application partitions the virtual resources between different modules on different security domains.
  • FIG. 5 is a schematic diagram of a data structure of an application design template according to an embodiment of the present invention.
  • the above mapping relationship obtained in the embodiment shown in FIG. 3 can be obtained by using the application design template shown in FIG. 5.
  • the application design template 510 includes an application identifier, a module list, and a security domain list, where the module list includes at least two modules, and the security domain list includes at least two security domains, and the number of modules is greater than or equal to the security domain. quantity.
  • the next layer of the application design template 510 includes a module design template 520 that includes the identity of the module, the security domain to which the module belongs (eg, the identity of the security domain), and the VM specification.
  • each module included in the application design template 510 corresponds to one module design
  • the number of the application design target 510 and the module design template 520 in FIG. 5 indicates the number of module designs corresponding to the application design template 510, for example,
  • the application design template 510 includes two modules, and the * symbol indicates two.
  • the next layer of the application design target 510 further includes a security domain template 530, which includes the identification of the security domain. It should be understood that each security domain included in the application design template 510 corresponds to a security domain design.
  • the * between the application design target 510 and the security domain template 530 indicates the number of security domain designs corresponding to each application design. For example, if the application design template 510 includes two security domains, then the * indicates 2 One.
  • the next layer of the module design template 520 includes a VM specification design template 540, which includes a list of network cards including one or more VM network card specifications. It should be understood that one module design corresponds to one VM specification. design.
  • the next layer of the VM specification design template 540 includes a VM network card specification design template 550 that includes a network card identification and a list of security domains that the network card can communicate with.
  • each network card in the list of network cards included in the VM specification design template 540 corresponds to one VM network card specification.
  • the * between the VM specification design template 540 and the VM network card specification design template 550 in FIG. 5 indicates the corresponding design of each VM specification.
  • the number of VM network card specifications is designed. For example, if the network card list in a VM specification includes three network cards, then the * indicates three, and each network card specification design includes the identifier of the network card and a list of security domains that the network card can communicate with.
  • the specific security domain list includes the identity of the communicable security domain.
  • FIG. 6 is an interaction flowchart of a method for resource configuration according to an embodiment of the present invention. As shown in FIG. 6, the method includes:
  • step 601 the user inputs an application design template to the deployment system.
  • the application design template is used to describe the resource topology of the application, such as the application design template shown in FIG. 6, the application design needs to include the unique identifier of the application; the design list of all modules in the application, and the application planning Security domain; each security domain needs to describe a unique identifier; the module design needs to describe the unique identifier of the template, the VM specification, and specify the security domain identifier to which the module belongs; the VM specification of the module needs to describe the list of VM network cards; each VM network card You need to specify one or more security domain IDs that can communicate.
  • step 602 the deployment system saves the application design template.
  • step 603 the user deploys the target application using the application design template.
  • the target application is a specific application that the user requests to create.
  • step 601 to step 603 correspond to step 310 of the embodiment shown in FIG. 3, and details are not described herein again.
  • Step 604 the deployment system parses the application design of the target application, and determines whether the division of the security domain is required.
  • the target application is deployed in the two security domains.
  • the security domain is divided and configured. Otherwise, the implementation is implemented according to the existing application deployment process.
  • Step 605 The deployment system calls the IaaS administrator account preset by the IaaS layer device to create an IaaS tenant for each security domain in the design.
  • One security domain corresponds to one IaaS tenant, and the mapping relationship between multiple IaaS tenants and multiple security domains is saved.
  • a plurality refers to at least two.
  • step 605 corresponds to step 320 and step 330 of the embodiment shown in FIG. 3, and details are not described herein again.
  • Step 606 The IaaS layer device returns the identifiers of the multiple tenants and the mapping relationship between the multiple tenants and multiple security domains to the deployment system.
  • Step 607 The deployment system records a mapping relationship between the multiple tenants and multiple security domains.
  • steps 606 and 607 correspond to step 340 of the embodiment shown in FIG.
  • Step 608 The deployment system invokes the IaaS interface, and uses an IaaS administrator account to create an IaaS security group for each security domain in multiple security domains, and records the mapping relationship between multiple security domains and multiple IaaS security groups.
  • Step 609 The IaaS layer device returns a mapping relationship between multiple security domains and multiple security groups to the deployment system.
  • Step 610 The deployment system records a security group corresponding to each security domain in multiple security domains.
  • the deployment system reads the IaaS security group and the IaaS tenant data corresponding to each security domain, and invokes the IaaS interface.
  • the IaaS security group corresponding to the security domain can be configured by the IaaS tenant corresponding to the same security domain. use.
  • Step 612 Query the tenants corresponding to the security domain corresponding to each module of the multiple modules in the target application design, and create a VM corresponding to each module.
  • the IaaS tenant corresponding to the security domain to which each module belongs is first read; then, using the IaaS tenant, the IaaS interface is invoked to create a VM of the specified VM specification.
  • Step 613 The IaaS layer device returns the identifier of the VM corresponding to each module to the deployment system, and the deployment system saves the VM identifier corresponding to each module.
  • step 614 the deployment system requests the IaaS layer device to create a network port for each VM in each module.
  • an interface of the IaaS is called to create a port object.
  • Step 615 the IaaS layer device returns an identifier of each VM port to the deployment system.
  • step 616 the deployment system records the mapping relationship between each VM NIC and its port, that is, records the port identifier corresponding to the VM.
  • Step 617 Query the security group ID corresponding to the security domain that the VM can communicate with.
  • Step 618 Configure the security group ID into the allowed access list of the corresponding VM.
  • a list of communicateable security domains specified in the target application design is obtained.
  • the IaaS security group corresponding to the security domain is read in turn, and the IaaS interface is invoked to update the corresponding security group to the communicable list of the port.
  • deployment system also needs to perform other software installation and configuration operations to complete the deployment of the application.
  • VMs of each module of the application created at this time satisfy the requirements of resource isolation and security domain division.
  • VMs in each security domain are created by different IaaS tenants, and VMs between different security domains are IaaS.
  • the tenant isolation mechanism is isolated from each other; each network card on each module's VM performs security group configuration according to the communication domain's communicable data, so that the communication between the network cards receives the role of the security group flow control policy. Divide the security domain to control traffic.
  • FIG. 7 is a schematic block diagram of resource configuration according to an embodiment of the present invention.
  • the target application is a webpage web application 700
  • the application 700 includes the following modules: a front-end web module 710, a service background module 720, and
  • the database module 730 is configured to process the web request of the public network user; the service background module 720 is configured to implement the logic of the service core; and the database module 730 is configured to be responsible for storing the user and the service data.
  • the front-end Web module 710 is a cluster composed of a plurality of nodes, and two virtual machine nodes are listed in FIG. 7, which are a virtual machine front-end Web1 and a virtual machine front-end Web2. Since the front-end Web module 710 communicates with the public network ingress network device, the public network request needs to be processed, so the security level is low, and needs to be classified in a low-level security domain. In addition, the front-end Web module 710 needs to communicate with the service background module 720. Process user requests.
  • the service background module 720 is a core module of the application implementation business logic. It needs to receive and process the request of the foreground web module 710, and needs to communicate with the database module 730 to store user data and business data generated during the business process. Since the logic in the module is the core of the service and needs to be secured, it is necessary to divide the module into a medium-level security domain.
  • the database module 730 is responsible for storing user data and service data. It only communicates with the service backend module 720, where the data often involves data related to user sensitive data and business competitiveness, and therefore requires reliable protection. This module needs to be divided into high-level security domains.
  • the embodiment of the present invention creates a corresponding one IaaS tenant on each security domain in the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security.
  • the modules corresponding to the domain allocate the required virtual machine resources. Therefore, the above application partitions the virtual resources between different modules on different security domains.
  • FIG. 8 is a schematic block diagram of a network device according to an embodiment of the present invention. As shown in FIG. 8, the network device includes:
  • the determining unit 910 is configured to determine M security domains of the target application, and a first mapping relationship between the M security domains and the N modules of the target application, where M ⁇ N, N is an integer, M Is an integer greater than 1.
  • the creating unit 920 is configured to send a tenant creation request to the infrastructure-as-a-service IaaS layer device, where the tenant creation request includes identification information of each security domain in the M security domains, so that the IaaS layer device is based on the M security. Create an IaaS tenant for each security zone in the M security zone and obtain M IaaS tenants.
  • the receiving unit 930 is configured to receive a tenant creation response sent by the IaaS layer device, where the tenant creation response carries a second mapping relationship between the M security domains and the M IaaS tenants.
  • the creating unit 920 is further configured to determine, according to the first mapping relationship and the second mapping relationship, a third mapping relationship existing between the N modules and the M IaaS tenants.
  • the sending unit 910 is further configured to send a resource allocation request to the IaaS layer device, so as to request the IaaS layer device to use the IaaS tenant corresponding to the i th module in the N modules according to the resource allocation request to allocate the virtual to the i th module.
  • the machine resource where 1 ⁇ i ⁇ N, the resource allocation request includes a third mapping relationship.
  • the resource allocation request further includes protecting a resource specification of the i-th module in the N modules.
  • the determining unit 810 is specifically configured to: obtain, from an application design template of the target application, identifier information of each security domain in the M security domains; and use an application design template of the target application. Obtaining identification information of each module in the N modules, and obtaining identification information of a security domain corresponding to each module in the N modules; and identifying information of each security domain in each of the M security domains and each of the N modules. The identification information of the security domain corresponding to the module determines the first mapping relationship between the M security domains and the N modules.
  • a network device may correspond to a method for resource configuration according to an embodiment of the present invention, and each unit/module in the device and the other operations and/or functions described above are respectively implemented in order to implement the deployment system in FIG. 1 to FIG. Method The corresponding process, for the sake of brevity, will not be described here.
  • the embodiment of the present invention creates a corresponding one IaaS tenant on each security domain in the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security.
  • the modules corresponding to the domain allocate the required virtual machine resources. Therefore, the above application partitions the virtual resources between different modules on different security domains.
  • FIG. 9 is a schematic block diagram of a network device according to another embodiment of the present invention. As shown in FIG. 9, the network device 900 includes
  • the receiving unit 910 is configured to receive a tenant creation request sent by the deployment device, where the tenant creation request carries identifier information of each security domain in the M security domains of the target application, where M is greater than 1. Integer.
  • a creating unit 920 configured to create one IaaS tenant corresponding to each security domain in the M security domains according to the tenant creation request, to obtain M IaaS tenants, and the M IaaS tenants and the M A second mapping relationship between security domains.
  • the sending unit 930 is configured to return a tenant creation response to the deployment device, where the tenant creation response carries the second mapping relationship.
  • the receiving unit 910 is further configured to receive a resource allocation request that is sent by the deployment device, where the resource allocation request carries a third mapping relationship that exists between the N modules and the M IaaS tenants, 1 ⁇ i ⁇ N, M ⁇ N, and N is an integer.
  • the resource allocation unit 940 is configured to allocate a virtual resource to the i-th module by using an IaaS tenant corresponding to the i-th module of the N modules according to the third mapping relationship.
  • the resource allocation request carries a resource specification of each of the N modules
  • the resource allocation unit 940 is configured to: according to the resource specification of the i-th module in the N modules, the i-th Modules allocate virtual resources.
  • the embodiment of the present invention creates a corresponding one IaaS tenant on each security domain in the at least two security domains by dividing the application into at least two security domains, and adopts the IaaS tenant corresponding to each security domain as the security.
  • the modules corresponding to the domain allocate the required virtual machine resources. Therefore, the above application partitions the virtual resources between different modules on different security domains.
  • FIG. 10 is a schematic diagram of a network device of an embodiment of the present invention.
  • an embodiment of the present invention further provides a network device 1000, which includes a processor 1001, a memory 1002, a bus system 1003, and a receiver 1004.
  • the processor 1001, the memory 1002 and the receiver 1004 are connected by a bus system 1003 for storing instructions for executing instructions stored in the memory 1002 and controlling the receiver 1004 to receive information.
  • the network device 1000 can implement the corresponding processes in the foregoing method embodiments. To avoid repetition, details are not described herein again.
  • the processor 1001 may be a central processing unit (“CPU"), and the processor 1001 may also be other general-purpose processors, digital signal processors (DSPs). , an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, and the like.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the memory 1002 can include read only memory and random access memory and provides instructions and data to the processor 1001.
  • a portion of the memory 1002 may also include a non-volatile random access memory.
  • the memory 1102 can also store information of the device type.
  • the bus system 1003 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 1003 in the figure.
  • each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1001 or an instruction in a form of software.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 1002, and the processor 1001 reads the information in the memory 1002 and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • FIG. 11 is a schematic block diagram of a network device according to another embodiment of the present invention.
  • an embodiment of the present invention further provides a network device 1100.
  • the network device 1100 includes a processor 1101, a memory 1102, a bus system 1103, and a receiver 1104.
  • the processor 1101, the memory 1102 and the receiver 1104 are connected by a bus system 1103 for storing instructions for executing instructions stored by the memory 1102 and controlling the receiver 1104 to receive information.
  • the network device 1100 can implement the corresponding processes in the foregoing method embodiments. To avoid repetition, details are not described herein again.
  • the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be directed to the embodiments of the present invention.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product. It is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供一种云环境下配置资源的方法及网络设备，该方法包括：确定目标应用的M个安全域，以及该M个安全域与所述目标应用的N个模块的第一映射关系；向基础设施即服务IaaS层设备发送第一请求消息，请求IaaS层设备创建M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户；接收IaaS层设备发送的第一响应消息，第一响应消息中携带M个安全域与M个IaaS租户之间的第二映射关系；确定所述N个模块与所述M个IaaS租户之间存在的第三映射关系；请求IaaS层设备使用所述N个模块中第i个模块对应的IaaS租户，为所述第i个模块分配虚拟机资源。上述方法能够实现应用的不同模块之间的虚拟资源隔离。

Description

配置资源的方法及其网络设备
本申请要求于2016年3月3日提交中国专利局、申请号为201610119659.8，发明名称为“配置资源的方法及其网络设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，更具体地，涉及一种云计算领域资源配置的方法及其网络设备。
背景技术
随着技术发展，云计算的应用越来越普遍，大量的应用需要部署到云计算服务提供的虚拟资源上，以达到节省设备成本，高效运维的目的。
对于拓扑结构复杂的应用，例如电信业务应用等，往往由多个功能模块组成，每个功能模块负责各自专长的领域。应用各个模块的信息安全要求往往不一致，因此在实际部署时，用户会要求将各个模块部署在不同的网络安全域中，安全域之间配置防火墙，以便对跨域的信息流量进行控制。
当这类结构复杂的应用，部署在云计算环境上时，同样需要进行安全域的划分和跨域访问权限的配置，以达到信息安全要求。
基础设施即服务(英文：Infrustructure as a Service，简写：IaaS)是提供虚拟资源的云计算服务形式。作为一种服务，IaaS为租户提供虚拟资源服务能力，租户可以从IaaS中获取虚拟资源，其中，虚拟资源是指采用虚拟化技术，将物理资源划分成多个可被租户使用的独立的部分，这些部分具备原物理资源所有的对用户有效的特性，这些划分出来的资源成为“虚拟资源”。
为确保各个租户彼此不受干扰的使用虚拟资源，IaaS以租户为单位，进行资源隔离。在租户隔离下，租户A只能使用IaaS的接口操作属于A自己的虚拟资源，而无法操作其他租户的虚拟资源。
IaaS同时可以为租户提供网络资源，并通过网络资源的配置实现网络访问控制，其中，网络资源是虚拟交换机、虚拟网络或者安全组等由IaaS产生并管理的、用于网络组成和控制的虚拟资源。例如，OpenStack云计算管理平台提供了安全组(Security Group)，安全组可配置虚拟机(英文：Virtual Machine，简写：VM)流入和流出的流量控制策略，在同一个安全组中的虚拟机可以彼此通过网络进行访问，而跨安全组的网络访问受安全组的流量控制策略约束。因此，租户可通过创建不同的安全组，实现安全域的划分。
由于IaaS提供的虚拟资源隔离机制是在租户之间的，虽然处于同一租户下不同安全组内的VM之间，能够进行网络资源的流量控制，但是处于同一租户下某一安全组内的VM依然可以通过管理网络调用IaaS的接口，操作同一租户下其他安全组的虚拟资源，因此，存在IaaS虚拟资源调用的安全隐患。
在云计算场景下，应用期望安全域之间不仅仅能够进行网络资源的流量控制，还需要进行虚拟资源的隔离。
发明内容
本发明实施例提供一种云环境下配置资源的方法及网络设备，能够实现跨安全域的虚拟 资源隔离。
第一方面，提供一种云环境下配置资源的方法，包括：确定目标应用的M个安全域，以及所述M个安全域与所述目标应用的N个模块之间存在的第一映射关系，其中，M≤N，N为整数，M为大于1的整数；向基础设施即服务IaaS层设备发送第一请求消息，所述第一请求消息用于请求所述IaaS层设备创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户；接收所述IaaS层设备发送的第一响应消息，所述第一响应消息中携带所述M个安全域与所述M个IaaS租户之间存在的第二映射关系；根据所述第一映射关系和所述第二映射关系，确定所述N个模块与所述M个IaaS租户之间存在的第三映射关系；请求所述IaaS层设备根据所述第三映射关系，使用所述N个模块中第i个模块对应的IaaS租户，为所述第i个模块分配虚拟机资源，其中，1≤i≤N。
应理解，第一请求消息请求IaaS层设备创建M个IaaS租户的过程，也可以说是通过调用IaaS层设备的接口创建M个IaaS租户的过程。
还应理解，使用N个模块中第i个模块对应的IaaS租户，为第i个模块分配虚拟机资源是指，在部署系统调用IaaS接口申请虚拟机资源时，需要传递IaaS租户的身份认证数据，因此利用第i个模块对应的IaaS租户的身份认证数据创建的VM资源即使用第i个模块对应的IaaS租户，为第i个模块分配虚拟机资源。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域上创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，上述应用划分在在不同安全域上的不同模块之间能够实现虚拟资源的隔离。
结合第一方面，在第一方面的第一种可能的实现方式中，所述请求所述IaaS层设备根据所述第三映射关系，使用所述N个模块中第i个模块对应的IaaS租户，为所述第i个模块分配虚拟机资源，包括：确定所述M个安全域对应的M个安全组，所述M个安全域与所述M个安全组之间存在一一对应的第四映射关系；根据所述第一映射关系和所述第四映射关系，确定所述第i个模块所属的安全组；向所述IaaS层设备发送第二请求消息，所述第二请求消息用于请求所述IaaS层设备将所述第i个模块所属的安全组配置为所述第i个模块的虚拟机资源的允许访问安全组。
结合第一方面及其上述实现方式，在第一方面的第二种可能的实现方式中，所述确定所述M个安全域对应的M个安全组，包括：向所述IaaS层设备发送第三请求消息，所述第三请求消息用于请求所述IaaS层设备创建所述M个安全域中每个安全域对应一个安全组，得到所述M个安全组；接收所述IaaS层设备发送的第二响应消息，所述第二响应消息中携带所述M个安全域与所述M个安全组之间存在第三映射关系。
结合第一方面及其上述实现方式，在第一方面的第三种可能的实现方式中，所述方法还包括：根据所述M个安全域与所述M个IaaS租户之间存在的第二映射关系，以及所述M个安全域与所述M个安全组存在的第四映射关系，确定所述M个IaaS租户与所述M个安全组之间存在的第五映射关系；向所述IaaS层设备发送第四请求消息，所述第四请求消息用于请求所述IaaS层设备根据所述第五映射关系，配置所述M个安全组中的第j个安全组为所述M个租户的第j个IaaS租户使用，其中，1≤j≤M。
应理解，配置所述第j个安全组为第j个IaaS租户使用是指，为第j个租户开通第j个安全组的使用权限。
结合第一方面及其上述实现方式，在第一方面的第四种可能的实现方式中，所述确定目标应用的M个安全域，以及所述M个安全域与所述目标应用的N个模块之间存在的第一映射关系，包括：从所述目标应用的应用设计模板中，获取所述M个安全域中每个安全域的标识信息；从所述目标应用的应用设计模板中，获取所述N个模块中每个模块的标识信息，以及获取所述N个模块中每个模块对应的安全域的标识信息；根据所述M个安全域中每个安全域的标识信息和所述N个模块中每个模块对应的安全域的标识信息，确定所述M个安全域与N个模块之间存在的所述第一映射关系。
第二方面，提供一种云环境下配置虚拟资源的方法，包括：接收部署设备发送的第一请求消息，所述第一请求消息中携带目标应用的M个安全域中每个安全域的标识信息，其中，M为大于1的整数；根据所述第一请求消息，创建所述M个安全域中每个安全与对应的一个IaaS租户，得到M个IaaS租户以及所述M个IaaS租户与所述M个安全域之间存在的第一映射关系；向所述部署设备返回第一响应消息，所述第一响应消息中携带所述第一映射关系。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，创建的应用在不同安全域之间能够实现的虚拟资源的隔离，也就实现了不同安全域上的模块之间的虚拟资源的隔离。
结合第二方面，在第二方面的第一种可能的实现方式中，上述方法还包括：接收所述部署设备发送的第二请求消息，并根据所述第二请求消息使用所述目标应用包括的N个模块中的第i个模块对应的IaaS租户，为所述第i个模块分配虚拟机资源，其中，所述第二请求消息中携带所述N个模块与所述M个IaaS租户之间存在的的第二映射关系，1≤i≤N，M≤N，N为整数。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述在为所述第i个模块分配虚拟机资源之前，所述方法还包括：接收所述部署设备发送的第三请求消息，并根据所述第三请求消息创建所述M个安全域中每个安全域对应的一个安全组，得到M个安全组以及所述M个安全组与所述M个安全域之间存在第三映射关系；向所述部署设备发送第二响应消息，所述第二响应消息中携带所述M个安全域与所述M个安全组之间存在第三映射关系。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第三种可能的实现方式中，所述为所述第i个模块分配虚拟机资源，包括：接收所述部署设备发送的第四请求消息，并根据所述第四请求消息将所述第i个模块所属的安全组配置为所述第i个模块的虚拟机资源的允许访问安全组，其中，所述第四请求消息中携带所述M个安全组与所述N个模块之间存在的第四映射关系。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第四种可能的实现方式中，所述方法还包括：接收所述部署设备发送第五请求消息，并根据所述第五请求消息配置所述M个安全组中的第j个安全组为所述M个租户的第j个IaaS租户使用，其中，所述第四请求消息中包括所述M个安全组与所述M个IaaS租户之间存在的第五映射关系，1≤j≤M。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，进一步地，通过为每个安全域对应的IaaS租户创建相应的安全组， 由此，创建的应用不仅能够在不同安全域之间能够实现的虚拟资源的隔离，也能够实现不同安全组之间的网络流量控制。
第三方面，提供了一种网络设备，包括：确定单元、创建单元和接收单元，所述网络设备用于执行上述第一方面或第一方面的任一可能的实现方式中的方法。
第四方面，提供了一种网络设备，包括：接收单元、创建单元和发送单元，所述网络设备用于执行上述第二方面或第二方面的任一可能的实现方式中的方法。
第五方面，提供了一种装置，包括：处理器、接收器、发送器和存储器，所述处理器和所述存储器通过总线系统相连，所述存储器用于存储指令，所述处理器用于执行该存储器存储的指令，以控制所述接收器接收信号、所述发射器发送信号，使得所述装置执行上述第一方面或第一方面的任一可能的实现方式中的方法。
第六方面，提供了一种装置，包括：处理器、存储器、接收器和发送器，所述处理器、所述存储器和所述接收器通过总线系统相连，所述存储器用于存储指令，所述处理器用于执行该存储器存储的指令，以控制所述接收器接收信号、所述发射器发送信号，，使得所述装置执行上述第二方面或第二方面的任一可能的实现方式中的方法。
第七方面，提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的指令。
第八方面，提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第二方面或第二方面的任意可能的实现方式中的方法的指令。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例的系统架构的示意性框图。
图2是现有应用部署的一个实施例的示意性框图。
图3是本发明一个实施例的配置资源的方法示意性框图。
图4是本发明应用部署的一个实施例的示意性框图。
图5是本发明一个实施例的应用设计模板的数据结构示意图。
图6是本发明实施例的资源配置的方法的交互流程图。
图7是本发明一个实施例的资源配置的示意性框图。
图8是本发明一个实施例的网络设备的示意性框图。
图9是本发明另一个实施例的网络设备的示意性框图。
图10是本发明一个实施例的网络设备的示意性装置图。
图11是本发明另一个实施例的网络设备的示意性装置图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明的一部分实施例，而不是全部实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都应属于本发明保护的范围。
图1是本发明实施例的系统架构的示意性框图。
如图1所述，该系统架构包括部署系统110和基础设施即服务系统120，其中部署系统110为用户部署应用提供交互界面，并读取应用设计文件中的设计数据，调用基础设施即服务120系统(例如，OpenStack架构)中的接口完成应用所需的资源的创建和配置，包括使用IaaS的安全组资源，完成业务安全域的划分。
其中，部署系统110需要通过获取应用设计文件中的设计数据，该应用设计文件需要借助设计工具，为用户进行应用设计提供交互界面，通过该应用设计，用户可进行应用安全域的设计；并将该设计输入到应用设计文件中保存。
IaaS层设备的应用部署是由部署系统根据应用设计，调度驱动IaaS层设备及周边模块一系列的接口完成资源的申请配置、应用软件的部署等操作。因此实现本发明，需要应用设计、应用部署调度等多个环节相互配合。
应理解，云计算(英文：Cloud Comput ing)是一种从服务提供商获取计算能力来使用的计算方式，提供计算能力所需的计算、存储、网络资源是虚拟的；虚拟机为云计算服务提供的计算节点；安全域(英文：Security Zone)是指同一系统内有相同的安全保护需求，相互信任，并具有相同的安全访问控制和边界控制策略的子网或网络，且相同的网络安全域共享一样的安全策略，广义可理解为具有相同业务要求和安全要求的IT系统要素的集合，在不同的安全域之间需要设置防火墙以进行安全保护；防火墙(英文：Firewal l)是一项协助确保信息安全的装置，会依照特定的规则，允许或者限制传输的资料通过；租户(英文Tenant)是指在云计算环境中，通过云计算服务接口使用云计算提供的各类资源的用户；应用(英文：Application)是指是指使用云计算提供的网络、存储、计算等资源，建立的可对外提供一定能力的软件系统；应用由一系列运行了软件实例的计算节点组成，各个节点彼此进行网络通信；安全组为OpenStack云计算管理平台中，用于对一个安全域下进行网络流量控制区域管理的虚拟资源，可配置流入或流出流量的控制策略，安全组可以归属于某个租户，通常情况下，安全域和安全组是一一对应的。
图2是应用部署的一个实施例的示意性框图。
如图2所示，应用A包括两个模块，分别为模块一和模块二，其中，模块一位于安全域A，对应于安全组A，模块二位于安全域B，对应于安全组B，其中模块一和模块二的功能都是由多个虚拟机VM实现，模块一中的VM和模块二中的VM通过配置可访问的安全组标识，实现了模块一和模块二之间跨安全组的网络流量控制。
然而，该应用A归属于租户A，由于安全域A和安全域B都是由租户A创建的，因此该应用中在IaaS层的虚拟资源同属于一个租户A，因此，跨安全组的虚拟资源是无法隔离的。
图3是本发明一个实施例的配置资源的方法示意性框图，该方法的执行主体可以为部署系统，如图3所示，该方法300包括：
步骤310，部署系统确定目标应用的M个安全域，以及该M个安全域与该目标应用的N个模块之间存在的第一映射关系，其中，M≤N，N为整数，M为大于1的整数。
具体地，目标应用划分在M个安全域中，而目标应用包括的N个模块与M个安全域存在第一映射关系，也就是说，一个或多个模块位于一个安全域当中，获取目标应用的方式可以通过部署系统的本地存储中获取，也可以通过用户部署目标应用的方式获取，本发明不限于此。
作为本发明一个实施例，确定目标应用的M个安全域，以及M个安全域与所述目标应用 的N个模块之间存在的第一映射关系，包括：从目标应用的应用设计模板中，获取M个安全域中每个安全域的标识信息；从目标应用的应用设计模板中，获取N个模块中每个模块的标识信息，以及获取N个模块中每个模块对应的安全域的标识信息；根据M个安全域中每个安全域的标识信息和N个模块中每个模块对应的安全域的标识信息，确定M个安全域与N个模块之间存在的所述第一映射关系。
具体地，用户向部署系统输入目标应用的应用设计，部署系统通过该目标应用的应用设计，获取第一映射关系。该目标应用的应用设计中包括：该目标应用的应用标识、N个模块的列表以及M个安全域的列表，其中，该N个模块中第i个模块的模块设计还可以包括下列中的至少一种：第i个模块的模块标识、模块归属的安全域的标识以及该属于该模块的至少一个VM的VM规格，该M个安全域中第j个安全域的安全域标识。
进一步地，VM规格的VM规格设计中还包括该VM中的网卡列表，该网卡列表中每个网卡规格包括该网卡的标识以及该网卡可通信的安全域标识。
可选地，作为本发明一个实施例，使用N个模块中第i个模块对应的IaaS租户，为所述第i个模块分配虚拟机资源，包括：对VM的各个网卡，调用IaaS的接口创建一个端口(Port)对象；并记录VM网卡与端口的映射关系；针对各个网卡，获取设计中其指定的可通信的安全域列表。依次读取安全域对应的IaaS安全组，调用IaaS的接口，将对应的安全组更新到端口的可通信列表中。
应理解，还需要通过执行其他软件安装、配置操作等，完成目标应用的部署，在此不再赘述。
应理解，在步骤310之前，部署系统可以通过目标应用的数据结构，判断是否在目标应用中具有多个安全域，如果具有多个安全域的划分，那么将进行上述流程。
步骤320，部署系统向IaaS层设备发送租户创建请求，所述租户创建请求包含M个安全域中每个安全域的标识信息，以便于IaaS层设备根据所述M个安全域中每个安全域的标识信息创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户。
具体地，在步骤320中，部署系统向IaaS层设备发送租户创建请求，该请求用于请求IaaS层设备利用管理员用户，为M个安全域中的每个安全域创建对应的一个租户。
步骤330，IaaS层设备接收部署设备发送的租户创建请求，所述租户创建请求中携带目标应用的M个安全域中每个安全域的标识信息，其中，M为大于1的整数；根据所述租户创建请求，创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户以及所述M个IaaS租户与所述M个安全域之间存在的第二映射关系；向所述部署设备返回租户创建响应，所述租户创建响应中携带所述第二映射关系。
步骤340，部署系统接收IaaS层设备发送的租户创建响应，该租户创建响应包含上述第二映射关系。
具体地，接收IaaS层设备发送的租户创建响应，该租户创建响应中携带上述M个安全域与上述M个IaaS租户之间存在的第二映射关系，也就是说该租户创建响应中携带M个安全域和M个IaaS租户的标识信息，部署系统存储该M个安全域与M个IaaS租户的标识以及确定它们之间的第一映射关系。
步骤350，根据第一映射关系和第二映射关系，部署系统确定上述N个模块与上述M个IaaS租户之间存在的第三映射关系。
应理解，部署系统可以在本地存储第一映射关系、第二映射关系或第三映射关系，以便 于根据上述映射关系，为上述N个模块分配虚拟资源。
步骤360，部署系统向IaaS层设备发送资源分配请求，以便于请求IaaS层设备根据资源分配请求，使用N个模块中第i个模块对应的IaaS租户，为第i个模块分配虚拟机资源，其中，1≤i≤N，资源分配请求包含第三映射关系。
步骤370，IaaS层设备接收部署设备发送的资源分配请求，其中，资源分配请求中携带N个模块与M个IaaS租户之间存在的的第三映射关系，1≤i≤N，M≤N，N为整数；根据第三映射关系，使用N个模块中的第i个模块对应的IaaS租户，为第i个模块分配虚拟资源。
具体地，由于部署系统已经获得N个模块与M个IaaS租户之间的对应关关系，即通过步骤350确定的第三映射关系后，使用N个模块中第i个模块对应的IaaS租户，为第i个模块分配虚拟机资源。在部署系统调用IaaS接口申请虚拟机资源时，需要传递租户的身份认证数据，因此利用第i个模块对应的IaaS租户的身份认证数据创建的VM资源即使用第i个模块对应的IaaS租户，为第i个模块分配虚拟机资源。
可选地，作为本发明一个实施例，上述资源分配请求还包括N个模块中每个模块的资源规格，以便于IaaS层设备根据上述第三映射关系和N个模块中每个模块的资源规格，为N个模块分配虚拟资源。
具体地，IaaS层设备可以根据N个模块中第i个模块的资源规格，为第i个模块分配虚拟资源。
应理解，第i个模块资源规格包括该第i个模块对应的网卡列表，具体包括每个网卡的网卡标识，以及每个网卡可通信的安全域列表。
下面继续介绍安全域中存在安全组的情况下的方案。
可选地，作为本发明一个实施例，确定M个安全域对应的M个安全组，包括：向IaaS层设备发送安全组创建请求，安全组创建请求用于请求IaaS层设备创建M个安全域中每个安全域对应一个安全组，得到M个安全组；接收IaaS层设备发送的安全组响应消息，安全组响应消息中携带M个安全域与M个安全组之间存在第四映射关系。
具体地，部署系统向IaaS层设备发送安全组创建请求，调用IaaS接口，为每个安全域创建一个IaaS安全组；更进一步地，部署系统接收IaaS层设备发送的M个安全组的标识，并记录M个安全域与M个安全组的映射关系。
进一步地，当第i个模块的虚拟资源的资源规格包括与第i个模块通信的模块所属的安全域列表，具体的实现方式就是将安全域列表中每个安全域对应的安全组配置为第i个模块的允许访问安全组。
按照上述方法，为第i个模块分配的虚拟资源之后，第i个模块对允许访问安全组列表中的安全组具有访问权限，当该第i个模块某个安全组具有访问权限后，该第i个模块所属的安全组可以该第i个模块对应的租户创建的VM的网卡产生的网络流量进行管理。
因此，本法实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，创建的应用在不同安全域之间能够实现的虚拟资源的隔离。
进一步地，由于在至少两个安全域中的每个安全域上创建安全组，并且配置每个安全组可以为其所属的安全域对应的租户使用，因此，能够实现跨安全域的网络流量控制。
因此，通过上述的资源部署方案，实现了跨安全组的网络流量控制以及虚拟资源的隔离， 目标应用划分在不同安全域上的不同模块之间既能够进行网络流量的控制，也能够实现了虚拟资源的隔离。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域上创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟资源，由此，上述应用划分在在不同安全域上的不同模块之间能够实现虚拟资源的隔离。
图4是本发明应用部署的一个实施例的示意性框图。
如图4所示，应用A划分在安全域A和安全域B中，在安全域A中创建租户A，在安全域B中创建租户B；并且，应用A包括两个模块，分别为模块一和模块二，应用A的模块一和模块二分别归属于安全域A和安全域B，因此，也就是说模块一和模块二分别归属于租户A和租户B，配置租户A可以访问安全组A和安全组B，配置租户B可以访问安全组A和安全组B，因此可以通过安全A和安全组B实现安全域A和安全域B之间的网络流量控制，同时由于租户A和租户B之间的虚拟资源隔离的，因此，可以实现跨安全域(或者安全组)的虚拟资源隔离。
由于模块一位于安全组A，模块二位于安全组B，其中模块一和模块二的功能都是由多个VM实现，安全组通过配置模块一中的VM和模块二中的VM，能够实现模块一和模块二之间跨安全域(或者安全组)的网络流量控制。
因此，图4所示的应用部署的实施例既能够实现跨安全组的网络流量控制，也能够实现跨安全组的虚拟资源的隔离。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域上创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，上述应用划分在在不同安全域上的不同模块之间能够实现虚拟资源的隔离。
图5是本发明一个实施例的应用设计模板的数据结构示意图。图3所示实施例中的获取的上述映射关系可以通过图5所示的应用设计模板获得。
如图5所示，应用设计模板510，包括应用标识、模块列表以及安全域列表，其中，模块列表包括至少两个模块，安全域列表包括至少两个安全域，模块的数量大于或等于安全域的数量。
应用设计模板510的下一层包括模块设计模板520，该模块设计模板520中包括模块的标识、该模块归属的安全域(例如，安全域的标识)、VM规格。
应理解，应用设计模板510中包括的每个模块都对应于一个模块设计，图5中应用设计目标510与模块设计模板520的*号表示应用设计模板510对应的模块设计的个数，例如，应用设计模板510中包括2个模块，那么该*号就表示2个。
应用设计目标510的下一层还包括安全域模板530，该安全域目标530中包括安全域的标识，应理解，应用设计模板510中包括的每个安全域都对应于一个安全域设计，图5中应用设计目标510与安全域模板530之间的*号表示每个应用设计对应的安全域设计的个数，例如，应用设计模板510中包括2个安全域，那么该*号就表示2个。
模块设计模板520的下一层包括VM规格设计模板540，该VM规格设计模板540包括网卡列表，该网卡列表中包括一个或多个VM网卡规格设计，应理解，一个模块设计对应于一个VM规格设计。
VM规格设计模板540的下一层包括VM网卡规格设计模板550，该VM网卡规格设计模板550包括网卡标识、网卡可通信的安全域列表。
应理解，VM规格设计模板540包括的网卡列表中每个网卡对应于一个VM网卡规格，图5中VM规格设计模板540与VM网卡规格设计模板550之间的*表示每个VM规格设计对应的VM网卡规格设计数目，例如，一个VM规格中的网卡列表包括3个网卡，那么该*就表示3个，每个网卡规格设计中包括该网卡的标识以及该网卡可通信的安全域的列表，具体的该安全域列表中包括可通信的安全域的标识。
应理解，上述数字仅仅是示例性的，本发明不限于此。
下面将结合图6具体说明资源配置的方法的具体流程。
图6是本发明实施例的资源配置的方法的交互流程图。如图6所示，该方法包括：
步骤601，用户向部署系统输入应用设计模板。
具体地，应用设计模板用于描述应用的资源拓扑结构，如图6所示的应用设计模板，该应用设计中需要包含应用的唯一标识；应用中所有模块的设计的列表，以及应用规划的全部安全域；各个安全域需要描述唯一标识；模块设计中需要描述模板的唯一标识、VM规格，并指定此模块归属的安全域标识；模块的VM规格中，需要描述VM网卡的列表；各个VM网卡需要指定可通信的一个或者多个安全域标识。
步骤602，部署系统保存应用设计模板。
步骤603，用户使用应用设计模板部署目标应用。应理解，该目标应用为用户请求创建的具体应用。
步骤601至步骤603的具体步骤与图3所示实施例的步骤310对应，在此不再赘述。
步骤604，部署系统解析目标应用的应用设计，判断是否需要进行安全域的划分。
具体地，如果该目标应用的应用设计中包括至少两个安全域，那么在部署该目标应用划分在该两个安全域中。
如果确定需要进行安全域的划分，那么将进行进行安全域的划分和配置操作，否则，按照现有应用部署流程进行实现。
当需要进行安全域划分时，需要继续执行以下步骤：
步骤605，部署系统调用IaaS层设备预置的IaaS管理员账户，为设计中各个安全域创建IaaS租户，一个安全域对应一个IaaS租户，并保存多个IaaS租户与多个安全域的映射关系，其中，多个指至少两个。
应理解，步骤605与图3所示实施例的步骤320和步骤330对应，在此不再赘述。
步骤606，IaaS层设备向部署系统返回上述多个租户的标识，以及该多个租户与多个安全域的映射关系。
步骤607，部署系统记录该多个租户与多个安全域的映射关系。
应理解，步骤606、步骤607与图3所示实施例的步骤340对应。
步骤608，部署系统调用IaaS接口，使用IaaS管理员帐户，为多个安全域中的每个安全域创建一个IaaS安全组，并记录多个安全域与多个IaaS安全组的映射关系。
步骤609，IaaS层设备向部署系统返回多个安全域与多个安全组的映射关系。
步骤610，部署系统记录多个安全域中每个安全域分别对应的安全组。
步骤611，部署系统读取每个安全域对应的IaaS安全组和IaaS租户数据，并调用IaaS接口，使用管理员用户配置安全域对应的IaaS安全组可被同一个安全域对应的IaaS租户使 用。
步骤612，查询目标应用设计中多个模块中每个模块对应的安全域对应的租户，创建每个模块对应的VM。
具体地，首先读取每个模块归属的安全域对应的IaaS租户；然后，使用此IaaS租户，调用IaaS接口创建指定VM规格的VM。
步骤613，IaaS层设备向部署系统返回每个模块对应的VM的标识，部署系统保存每个模块对应的VM标识。
步骤614，部署系统请求IaaS层设备为每个模块中的每个VM创建网络端口。
具体地，对VM的各个网卡，调用IaaS的接口创建一个端口(Port)对象。
步骤615，IaaS层设备向部署系统返回每个VM端口的标识。
步骤616，部署系统记录每个VM网卡与其端口的映射关系，即记录VM对应的端口标识。
步骤617，查询VM可通信的安全域对应的安全组ID。
步骤618，将安全组ID配置到对应的VM的允许访问列表中。
具体地，针对各个网卡，获取目标应用设计中其指定的可通信的安全域列表。依次读取安全域对应的IaaS安全组，调用IaaS的接口，将对应的安全组更新到端口的可通信列表中。
应理解，部署系统还需要执行其他软件安装、配置操作，完成应用的部署。
因此，此时创建出的应用的各个模块的VM，就同时满足资源隔离和安全域划分的要求，各个安全域中的VM使用不同的IaaS租户创建出来，则不同安全域之间的VM因IaaS的租户隔离机制，彼此资源隔离；各个模块的VM上的各个网卡，根据安全域的可通信数据进行了安全组的配置，使得网卡之间的通讯收到安全组流量控制策略的作用，起到划分安全域控制流量的目的。
图7是本发明一个实施例的资源配置的示意性框图。
图7所示的实施例是采用上述资源配置方法的具体实施例，如图7所示，该目标应用为网页Web应用700，该应用700包括以下模块：前台Web模块710、业务后台模块720以及数据库模块730，其中，前台Web模块710用于处理公网用户的Web请求；业务后台模块720用于实现业务核心的逻辑；数据库模块730用于负责用户和业务数据的存储。
具体地，前台Web模块710是由多个节点组成的集群，图7中列出两个虚拟机节点，分别为虚拟机前台Web1和虚拟机前台Web2。由于前台Web模块710与公网入口网络设备通信，需要处理公网请求，因此安全等级较低，需要划分在低等级的安全域中，此外，前台Web模块710需要与业务后台模块720通讯，来处理用户请求。
具体地，业务后台模块720，是应用实现业务逻辑的核心模块。它需要接收、处理前台Web模块710的请求，并需要与数据库模块730通讯，来存储业务处理过程中产生的用户数据和业务数据。由于模块中的逻辑是业务的核心，需要进行安全保护，因此需要将此模块划分到中等级的安全域中。
具体地，数据库模块730，用于负责用户数据和业务数据的存储。它仅与业务后台模块720通讯，其中的数据往往涉及用户敏感数据和业务竞争力相关的数据，因此需要可靠的保护。这个模块需要划分到高等级的安全域中。
因此，Web应用中需要的三个安全域的网络流量控制配置如表1：
表1
Figure PCTCN2017073066-appb-000001
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域上创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，上述应用划分在在不同安全域上的不同模块之间能够实现虚拟资源的隔离。
上文结合图1至图7详细说明用于本发明实施例的资源配置的方法及具体流程，下面结合图8至图11详细说明用于本发明实施例的资源配置的网络设备。
图8是本发明一个实施例的网络设备的示意性框图。如图8所示，该网络设备包括：
确定单元910，确定单元910用于确定目标应用的M个安全域，以及M个安全域与目标应用的N个模块之间存在的第一映射关系，其中，M≤N，N为整数，M为大于1的整数。
创建单元920，创建单元920用于用于向基础设施即服务IaaS层设备发送租户创建请求，租户创建请求包含M个安全域中每个安全域的标识信息，以便于IaaS层设备根据M个安全域中每个安全域的标识信息，创建M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户。
接收单元930，接收单元930用于接收IaaS层设备发送的租户创建响应，租户创建响应中携带M个安全域与M个IaaS租户之间存在的第二映射关系。
创建单元920还用于，根据第一映射关系和第二映射关系，确定N个模块与M个IaaS租户之间存在的第三映射关系。
发送单元910还用于，向IaaS层设备发送资源分配请求，以便于请求IaaS层设备根据所述资源分配请求，使用N个模块中第i个模块对应的IaaS租户，为第i个模块分配虚拟机资源，其中，1≤i≤N，资源分配请求包含第三映射关系。
可选地，作为本发明一个实施例，资源分配请求还包括保护所述N个模块中第i个模块的资源规格。
可选地，作为本发明一个实施例，上述确定单元810具体用于：从目标应用的应用设计模板中，获取M个安全域中每个安全域的标识信息；从目标应用的应用设计模板中，获取N个模块中每个模块的标识信息，以及获取N个模块中每个模块对应的安全域的标识信息；根据M个安全域中每个安全域的标识信息和N个模块中每个模块对应的安全域的标识信息，确定M个安全域与N个模块之间存在的第一映射关系。
根据本发明实施例的网络设备可对应于本发明实施例资源配置的方法，并且，该装置中的各个单元/模块和上述其他操作和/或功能分别为了实现图1至图7中部署系统所示方法的 相应流程，为了简洁，在此不再赘述。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域上创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，上述应用划分在在不同安全域上的不同模块之间能够实现虚拟资源的隔离。
图9是本发明另一个实施例的网络设备的示意性框图。如图9所示，该网络设备900包括
接收单元910，接收单元910用于用于接收部署设备发送的租户创建请求，所述租户创建请求中携带目标应用的M个安全域中每个安全域的标识信息，其中，M为大于1的整数。
创建单元920，创建单元920用于根据所述租户创建请求，创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户以及所述M个IaaS租户与所述M个安全域之间存在的第二映射关系。
发送单元930，发送单元930用于向所述部署设备返回租户创建响应，所述租户创建响应中携带所述第二映射关系。
接收单元910还用于接收所述部署设备发送的资源分配请求，其中，所述资源分配请求中携带所述N个模块与所述M个IaaS租户之间存在的的第三映射关系，1≤i≤N，M≤N，N为整数。
资源分配单元940，资源分配单元940用于根据所述第三映射关系，使用所述N个模块中的第i个模块对应的IaaS租户，为所述第i个模块分配虚拟资源。
可选地，作为本发明一个实施例，资源分配请求中携带N个模块中每个模块的资源规格，资源分配单元940用于：根据N个模块中第i个模块的资源规格，为第i个模块分配虚拟资源。
本发明实施例通过将应用划分于至少两个安全域上，在该至少两个安全域中的每个安全域上创建对应的一个IaaS租户，并通过每个安全域对应的IaaS租户为该安全域对应的模块分配所需的虚拟机资源，由此，上述应用划分在在不同安全域上的不同模块之间能够实现虚拟资源的隔离。
图10是本发明一个实施例的网络设备的示意性装置图。
如图10所示，本发明实施例还提供了一种网络设备1000，该网络设备1000包括处理器1001、存储器1002、总线系统1003和接收器1004。其中，处理器1001、存储器1002和接收器1004通过总线系统1003相连，该存储器1002用于存储指令，该处理器1001用于执行该存储器1002存储的指令，并控制该接收器1004接收信息。网络设备1000能够实现前述方法实施例中的相应流程，为避免重复，这里不再赘述。
应理解，在本发明实施例中，该处理器1001可以是中央处理单元(Central Processing Unit，简称为“CPU”)，该处理器1001还可以是其他通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
该存储器1002可以包括只读存储器和随机存取存储器，并向处理器1001提供指令和数据。存储器1002的一部分还可以包括非易失性随机存取存储器。例如，存储器1102还可以存储设备类型的信息。
该总线系统1003除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1003。
在实现过程中，上述方法的各步骤可以通过处理器1001中的硬件的集成逻辑电路或者软件形式的指令完成。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1002，处理器1001读取存储器1002中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
图11是本发明另一个实施例的网络设备的示意性装置图。
如图11所示，本发明实施例还提供了一种网络设备1100，该网络设备1100包括处理器1101、存储器1102、总线系统1103和接收器1104。其中，处理器1101、存储器1102和接收器1104通过总线系统1103相连，该存储器1102用于存储指令，该处理器1101用于执行该存储器1102存储的指令，并控制该接收器1104接收信息。网络设备1100能够实现前述方法实施例中的相应流程，为避免重复，这里不再赘述。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本发明的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存 储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (10)

  1. 一种云环境下配置资源的方法，其特征在于，包括：
    确定目标应用的M个安全域，以及所述M个安全域与所述目标应用的N个模块之间存在的第一映射关系，其中，M≤N，N为整数，M为大于1的整数；
    向基础设施即服务IaaS层设备发送租户创建请求，所述租户创建请求包含所述M个安全域中每个安全域的标识信息，以便于IaaS层设备根据所述M个安全域中每个安全域的标识信息，创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户；
    接收所述IaaS层设备发送的租户创建响应，所述租户创建响应中携带所述M个安全域与所述M个IaaS租户之间存在的第二映射关系；
    根据所述第一映射关系和所述第二映射关系，确定所述N个模块与所述M个IaaS租户之间存在的第三映射关系；
    向所述IaaS层设备发送资源分配请求，以便于请求所述IaaS层设备根据所述资源分配请求，使用所述N个模块中第i个模块对应的IaaS租户，为所述第i个模块分配虚拟资源，其中，1≤i≤N，所述资源分配请求包含所述第三映射关系。
  2. 根据权利要1所述的方法，其特征在于，所述资源分配请求还包括所述N个模块中每个模块的资源规格。
  3. 根据权利要求1或2所述的方法，其特征在于，所述确定目标应用的M个安全域，以及所述M个安全域与所述目标应用的N个模块之间存在的第一映射关系，包括：
    从所述目标应用的应用设计模板中，获取所述M个安全域中每个安全域的标识信息；
    从所述目标应用的应用设计模板中，获取所述N个模块中每个模块的标识信息，以及获取所述N个模块中每个模块对应的安全域的标识信息；
    根据所述M个安全域中每个安全域的标识信息和所述N个模块中每个模块对应的安全域的标识信息，确定所述M个安全域与N个模块之间存在的所述第一映射关系。
  4. 一种云环境下配置虚拟资源的方法，其特征在于，包括：
    接收部署设备发送的租户创建请求，所述租户创建请求中携带目标应用的M个安全域中每个安全域的标识信息，其中，M为大于1的整数；
    根据所述租户创建请求，创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户以及所述M个IaaS租户与所述M个安全域之间存在的第二映射关系；
    向所述部署设备返回租户创建响应，所述租户创建响应中携带所述第二映射关系；
    接收所述部署设备发送的资源分配请求，其中，所述资源分配请求中携带所述N个模块与所述M个IaaS租户之间存在的的第三映射关系，1≤i≤N，M≤N，N为整数；
    根据所述第三映射关系，使用所述N个模块中的第i个模块对应的IaaS租户，为所述第i个模块分配虚拟资源。
  5. 根据权利要求4所述的方法，其特征在于，所述资源分配请求中携带所述N个模块中每个模块的资源规格，所述为所述第i个模块分配虚拟资源还包括：
    根据所述N个模块中第i个模块的资源规格，为所述第i个模块分配虚拟资源。
  6. 一种网络设备，其特征在于，包括：
    确定单元，用于确定目标应用的M个安全域，以及所述M个安全域与所述目标应用的N个模块之间存在的第一映射关系，其中，M≤N，N为整数，M为大于1的整数；
    创建单元，用于向基础设施即服务IaaS层设备发送租户创建请求，所述租户创建请求 包含所述M个安全域中每个安全域的标识信息，以便于IaaS层设备根据所述M个安全域中每个安全域的标识信息，创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户；
    接收单元，用于接收所述IaaS层设备发送的租户创建响应，所述租户创建响应中携带所述M个安全域与所述M个IaaS租户之间存在的第二映射关系；
    所述确定单元，还用于根据所述第一映射关系和所述第二映射关系，确定所述N个模块与所述M个IaaS租户之间存在的第三映射关系；
    所述发送单元，还用于向所述IaaS层设备发送资源分配请求，以便于请求所述IaaS层设备根据所述资源分配请求，使用所述N个模块中第i个模块对应的IaaS租户，为所述第i个模块分配虚拟机资源，其中，1≤i≤N，所述资源分配请求包含所述第三映射关系。
  7. 根据权利要求6所述的网络设备，其特征在于，所述资源分配请求还包括保护所述N个模块中第i个模块的资源规格。
  8. 根据权利要求6或7所述的网络设备，其特征在于，所述确定单元具体用于：
    从所述目标应用的应用设计模板中，获取所述M个安全域中每个安全域的标识信息；
    从所述目标应用的应用设计模板中，获取所述N个模块中每个模块的标识信息，以及获取所述N个模块中每个模块对应的安全域的标识信息；
    根据所述M个安全域中每个安全域的标识信息和所述N个模块中每个模块对应的安全域的标识信息，确定所述M个安全域与N个模块之间存在的所述第一映射关系。
  9. 一种网络设备，其特征在于，包括：
    接收单元，用于接收部署设备发送的租户创建请求，所述租户创建请求中携带目标应用的M个安全域中每个安全域的标识信息，其中，M为大于1的整数；
    创建单元，用于根据所述租户创建请求，创建所述M个安全域中每个安全域对应的一个IaaS租户，得到M个IaaS租户以及所述M个IaaS租户与所述M个安全域之间存在的第二映射关系；
    发送单元，用于向所述部署设备返回租户创建响应，所述租户创建响应中携带所述第二映射关系；
    所述接收单元还用于接收所述部署设备发送的资源分配请求，其中，所述资源分配请求中携带所述N个模块与所述M个IaaS租户之间存在的的第三映射关系，1≤i≤N，M≤N，N为整数；
    资源分配单元，用于根据所述第三映射关系，使用所述N个模块中的第i个模块对应的IaaS租户，为所述第i个模块分配虚拟资源。
  10. 根据权利要求9所述的网络设备，其特征在于，所述资源分配请求中携带所述N个模块中每个模块的资源规格，所述资源分配单元用于：根据所述N个模块中第i个模块的资源规格，为所述第i个模块分配虚拟资源。
PCT/CN2017/073066 2016-03-03 2017-02-07 配置资源的方法及其网络设备 WO2017148249A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17759100.5A EP3376738A4 (en) 2016-03-03 2017-02-07 RESOURCE CONFIGURATION METHOD AND NETWORK DEVICE
US16/016,343 US10616133B2 (en) 2016-03-03 2018-06-22 Resource configuration method and network device thereof

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610119659.8 2016-03-03
CN201610119659.8A CN107153565B (zh) 2016-03-03 2016-03-03 配置资源的方法及其网络设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/016,343 Continuation US10616133B2 (en) 2016-03-03 2018-06-22 Resource configuration method and network device thereof

Publications (1)

Publication Number Publication Date
WO2017148249A1 true WO2017148249A1 (zh) 2017-09-08

Family

ID=59742516

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/073066 WO2017148249A1 (zh) 2016-03-03 2017-02-07 配置资源的方法及其网络设备

Country Status (4)

Country Link
US (1) US10616133B2 (zh)
EP (1) EP3376738A4 (zh)
CN (1) CN107153565B (zh)
WO (1) WO2017148249A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110955409A (zh) * 2019-12-02 2020-04-03 郑州阿帕斯数云信息科技有限公司 在云平台上创建资源的方法和装置
CN112491630A (zh) * 2020-12-07 2021-03-12 北京华胜天成科技股份有限公司 一种裸机自动部署方法、装置及云环境平台
CN114629958A (zh) * 2022-03-15 2022-06-14 北京字节跳动网络技术有限公司 资源分配方法、装置、电子设备及存储介质

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9560078B2 (en) * 2015-02-04 2017-01-31 Intel Corporation Technologies for scalable security architecture of virtualized networks
CN107888597A (zh) * 2017-11-16 2018-04-06 杭州迪普科技股份有限公司 一种FWaaS安全域配置方法及装置
CN108093026B (zh) * 2017-11-17 2020-04-07 阿里巴巴集团控股有限公司 多租户请求的处理方法及装置
CN109040276B (zh) * 2018-08-20 2022-03-22 郑州云海信息技术有限公司 一种构建云平台的方法、装置、计算机存储介质及终端
US11038866B2 (en) * 2018-09-18 2021-06-15 Microsoft Technology Licensing, Llc Securing an injection of a workload into a virtual network hosted by a cloud-based platform
CN112889247B (zh) * 2018-10-18 2022-05-31 华为技术有限公司 Vnf服务实例化方法及装置
CN109636438B (zh) * 2018-10-31 2023-09-12 创新先进技术有限公司 一种虚拟资源业务系统、虚拟资源的处理方法和装置
CN110474913A (zh) * 2019-08-20 2019-11-19 福建伊时代信息科技股份有限公司 一种云环境下的虚拟化防护方法及终端
CN114982199A (zh) * 2020-01-17 2022-08-30 Oppo广东移动通信有限公司 一种安全信息发现方法、安全信息配置方法及设备
WO2021142849A1 (zh) * 2020-01-19 2021-07-22 Oppo广东移动通信有限公司 安全域的配置、发现和加入方法及装置、电子设备
US11316791B2 (en) * 2020-01-24 2022-04-26 Corsa Technology Inc. Methods and apparatus for scalable network security functions
US11985043B2 (en) * 2020-04-07 2024-05-14 Arbor Networks, Inc. Automated classification of network devices to protection groups
US11349883B2 (en) * 2020-05-20 2022-05-31 At&T Intellectual Property I, L.P. Determining relevant security policy data based on cloud environment
CN111800482B (zh) * 2020-06-18 2022-09-13 北京智优集品科技有限公司 工业互联网的动态安全防护、装置及服务器
CN114785612B (zh) * 2022-05-10 2024-07-09 深信服科技股份有限公司 一种云平台管理方法、装置、设备及介质
CN117319212B (zh) * 2023-11-29 2024-02-02 中安网脉(北京)技术股份有限公司 云环境下多租户隔离的密码资源自动化调度系统及其方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103001945A (zh) * 2012-10-23 2013-03-27 中国科学院信息工程研究所 一种多元化资源标识安全访问方法
CN103747059A (zh) * 2013-12-26 2014-04-23 华中科技大学 一种面向多租户的云计算服务器集群网络保障方法和系统
US20150242197A1 (en) * 2014-02-25 2015-08-27 Red Hat, Inc. Automatic Installing and Scaling of Application Resources in a Multi-Tenant Platform-as-a-Service (PaaS) System
CN105335235A (zh) * 2015-11-24 2016-02-17 浪潮电子信息产业股份有限公司 一种基于IaaS模式的资源管理系统及方法

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8281307B2 (en) * 2009-06-01 2012-10-02 International Business Machines Corporation Virtual solution composition and deployment system and method
CN102932382B (zh) * 2011-08-08 2018-03-23 中兴通讯股份有限公司 安全按需供给方法及系统、业务类型获取方法
US9003502B2 (en) * 2012-03-19 2015-04-07 Empire Technology Development Llc Hybrid multi-tenancy cloud platform
US9270701B1 (en) * 2012-04-27 2016-02-23 Stc.Unm System and methods for usage management in multi-level security networks
WO2013185166A1 (en) * 2012-06-14 2013-12-19 Linwood Evan System management tool
CN102769615B (zh) * 2012-07-02 2014-11-26 北京大学 一种基于MapReduce机制的任务调度方法和系统
US20140052877A1 (en) * 2012-08-16 2014-02-20 Wenbo Mao Method and apparatus for tenant programmable logical network for multi-tenancy cloud datacenters
EP2932667A4 (en) * 2012-10-03 2016-09-28 Distrix Networks Ltd SYSTEMS AND METHODS FOR ADAPTIVE LOAD BALANCING COMMUNICATIONS, ROUTING, FILTERING AND ACCESS CONTROL IN DISTRIBUTED NETWORKS
US10469304B1 (en) * 2013-01-16 2019-11-05 Amazon Technologies, Inc. Network visualization service
CN103354530B (zh) * 2013-07-18 2016-08-10 北京启明星辰信息技术股份有限公司 虚拟化网络边界数据流汇聚方法及装置
CN103607308B (zh) * 2013-11-29 2016-09-21 杭州东信北邮信息技术有限公司 云计算环境下的虚拟机多网络管理系统和方法
US9807119B2 (en) * 2014-01-21 2017-10-31 Oracle International Corporation System and method for supporting web services in a multitenant application server environment
GB2523331A (en) * 2014-02-20 2015-08-26 Ibm Attribute-based access control
WO2015200379A1 (en) * 2014-06-23 2015-12-30 Oracle International Corporation System and method for supporting security in a multitenant application server environment
US10540606B2 (en) * 2014-06-30 2020-01-21 Amazon Technologies, Inc. Consistent filtering of machine learning data
US10318882B2 (en) * 2014-09-11 2019-06-11 Amazon Technologies, Inc. Optimized training of linear machine learning models
US9825881B2 (en) * 2014-09-30 2017-11-21 Sony Interactive Entertainment America Llc Methods and systems for portably deploying applications on one or more cloud systems
US10581755B2 (en) * 2015-04-03 2020-03-03 Nicira, Inc. Provisioning network services in a software defined data center
US10324701B1 (en) * 2015-08-21 2019-06-18 Amazon Technologies, Inc. Rapid deployment of computing instances
CN106549793B (zh) * 2015-09-23 2020-08-07 华为技术有限公司 流量控制方法及设备
WO2017067598A1 (en) * 2015-10-22 2017-04-27 Nokia Solutions And Networks Oy Security mechanism for communication network including virtual network functions

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103001945A (zh) * 2012-10-23 2013-03-27 中国科学院信息工程研究所 一种多元化资源标识安全访问方法
CN103747059A (zh) * 2013-12-26 2014-04-23 华中科技大学 一种面向多租户的云计算服务器集群网络保障方法和系统
US20150242197A1 (en) * 2014-02-25 2015-08-27 Red Hat, Inc. Automatic Installing and Scaling of Application Resources in a Multi-Tenant Platform-as-a-Service (PaaS) System
CN105335235A (zh) * 2015-11-24 2016-02-17 浪潮电子信息产业股份有限公司 一种基于IaaS模式的资源管理系统及方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3376738A4 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110955409A (zh) * 2019-12-02 2020-04-03 郑州阿帕斯数云信息科技有限公司 在云平台上创建资源的方法和装置
CN112491630A (zh) * 2020-12-07 2021-03-12 北京华胜天成科技股份有限公司 一种裸机自动部署方法、装置及云环境平台
CN112491630B (zh) * 2020-12-07 2023-08-04 北京华胜天成科技股份有限公司 一种裸机自动部署方法、装置及云环境平台
CN114629958A (zh) * 2022-03-15 2022-06-14 北京字节跳动网络技术有限公司 资源分配方法、装置、电子设备及存储介质
CN114629958B (zh) * 2022-03-15 2024-01-30 抖音视界有限公司 资源分配方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
EP3376738A4 (en) 2019-01-16
EP3376738A1 (en) 2018-09-19
CN107153565B (zh) 2020-06-16
CN107153565A (zh) 2017-09-12
US10616133B2 (en) 2020-04-07
US20180302337A1 (en) 2018-10-18

Similar Documents

Publication Publication Date Title
WO2017148249A1 (zh) 配置资源的方法及其网络设备
US11429408B2 (en) System and method for network function virtualization resource management
US10701139B2 (en) Life cycle management method and apparatus
US10320674B2 (en) Independent network interfaces for virtual network environments
CN107534579B (zh) 资源管理的系统和方法
EP3358806B1 (en) Method, device and server for service migration during software upgrade under nfv architecture
US20190081921A1 (en) Management of domain name systems in a large-scale processing environment
US10999326B1 (en) Fine grained network security
US8589554B2 (en) Intelligent and elastic resource pools for heterogeneous datacenter environments
US10924966B2 (en) Management method, management unit, and system
EP3432515B1 (en) Management method and device
CN109479059B (zh) 用于容器流量的传输层等级标识和隔离的系统和方法
CN106031116A (zh) 一种ns与vnf的关联方法、装置及系统
US9686237B2 (en) Secure communication channel using a blade server
EP3672314B1 (en) Network management method, device and system
CN103685608A (zh) 一种自动配置安全虚拟机ip地址的方法及装置
US20180276026A1 (en) Scalable policy assignment in an edge virtual bridging (evb) environment
WO2022056845A1 (en) A method of container cluster management and system thereof
CN113918268A (zh) 一种多租户管理方法及装置
EP3893437B1 (en) Method and device for deploying virtual network function
CN107408058B (zh) 一种虚拟资源的部署方法、装置及系统
CN114071488A (zh) 策略配置方法、装置、设备及存储介质
CN109933959B (zh) 一种许可证控制方法及相关设备
CN116436968A (zh) 一种服务网格通信方法、系统、装置以及存储介质
US11025594B2 (en) Secret information distribution method and device

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE