WO2018027586A1 - 云计算系统中虚拟机访问物理服务器的方法、装置和系统 - Google Patents

云计算系统中虚拟机访问物理服务器的方法、装置和系统 Download PDF

Info

Publication number
WO2018027586A1
WO2018027586A1 PCT/CN2016/094225 CN2016094225W WO2018027586A1 WO 2018027586 A1 WO2018027586 A1 WO 2018027586A1 CN 2016094225 W CN2016094225 W CN 2016094225W WO 2018027586 A1 WO2018027586 A1 WO 2018027586A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
address
virtual machine
publishing
physical server
Prior art date
Application number
PCT/CN2016/094225
Other languages
English (en)
French (fr)
Inventor
李俊武
申思
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202110098217.0A priority Critical patent/CN112995272A/zh
Priority to EP16912041.7A priority patent/EP3493510B1/en
Priority to CN201680086943.8A priority patent/CN109314724B/zh
Priority to PCT/CN2016/094225 priority patent/WO2018027586A1/zh
Priority to CA3033217A priority patent/CA3033217C/en
Priority to JP2019507139A priority patent/JP6771650B2/ja
Publication of WO2018027586A1 publication Critical patent/WO2018027586A1/zh
Priority to US16/262,872 priority patent/US10659471B2/en
Priority to US15/931,217 priority patent/US11418512B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2539—Hiding addresses; Keeping addresses anonymous
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2557—Translation policies or rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2575—NAT traversal using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45562—Creating, deleting, cloning virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the present invention relates to the field of IT technologies, and in particular, to a method, an apparatus, and a system for a virtual machine to access a physical server in a cloud computing system.
  • PM physical machine
  • DB Oracle's database
  • the user logs in to the virtual machine (VM) and accesses the physical server that deploys the above types of services through the network.
  • VM virtual machine
  • the VM needs to obtain the IP address of the PM to access various services on the physical server.
  • the VM can obtain the real IP address of the PM or PM cluster running the service, the network planning information of the physical server where the service is located on the cloud platform is exposed, and the malicious user can perform network attack on the network where the PM is located and the device in the network. , thus endangering the security of the cloud platform.
  • the embodiment of the invention describes a method, device and system for a virtual machine to access a physical server, which prevents the virtual machine from acquiring the real address of the physical server and jeopardizing network security.
  • an embodiment of the present invention provides a system for a virtual machine to access a physical server, where the system includes a cloud platform, at least one physical server, at least one host, and at least one access network element, the host, the physical server.
  • the cloud platform communicates with each other, and the host runs at least one virtual machine, and the virtual machine accesses the physical server by using the access network element, where the physical server is deployed with a service, where the cloud
  • the platform allocates a publishing IP address and a publishing port corresponding to the service to the service, and establishes a correspondence between the publishing IP address and an IP address and a port of the publishing port and the physical server running the service, where the cloud
  • the platform issues the service, so that the service is visible to the virtual machine;
  • the cloud platform sends a NAT rule associated with the virtual machine to the access network element, where the NAT rule includes the publishing IP address and the publishing port Corresponding relationship between the IP address and the port of the physical server running the service;
  • the access network element receives the service
  • virtual The machine can access the service without knowing the real IP address and port of the physical server that deploys the service.
  • the service can be uniquely identified by the publishing IP address and the publishing port corresponding to the service, even if the service is deployed in multiple On a different physical server or physical server cluster of IP addresses, different virtual machines can use the same published IP address and publishing port to access the same service without paying attention to the real IP address of the physical server or physical server cluster where the service is actually located. And the port, the unified access to the service.
  • the source address of the service response message is an IP address and a port of the physical server
  • the NAT rule may also be used according to the NAT rule.
  • the real address of the physical server is still not included.
  • the source address of the service response message sent by the cloud platform may also be directly set to the publishing IP address and the publishing port, without the access unit modifying the source address.
  • the physical server When the source address of the service response packet sent by the physical server is the real address of the physical server, the physical server does not need to be modified to adapt to the embodiment of the present invention, thereby improving the efficiency of service deployment and distribution.
  • the physical server When the source address of the service response packet sent by the physical server is the advertised IP address and the advertised port corresponding to the service, the physical server needs to be adaptively modified, and the service and the advertised IP address and the advertised port are recorded.
  • the physical server sends a service response message, the source address of the service response message is set to the advertised IP address and the advertised port. At this time, the access network element does not need to perform the source address of the service response message.
  • the NAT conversion improves the efficiency of the virtual machine accessing the service deployed on the physical server.
  • the physical server needs to be modified to implement the solution of the embodiment of the present invention, thereby reducing the efficiency of service deployment and release.
  • the cloud platform can publish the service in a plurality of manners.
  • the cloud platform has a user-oriented service presentation interface and a management presentation interface for the operation and maintenance personnel, and the user can log in.
  • the service presents an interface, browses various services provided by the cloud platform, and initiates a service application.
  • the cloud platform displays service information on the service presentation interface, and provides an introduction to the service to the user, the service information including an external display address of the service.
  • the external display address of the service may be the publishing IP address and the publishing port, or may be the domain name corresponding to the service.
  • the virtual machine may request the access service from the physical server by using the publishing IP address and the publishing port as the destination address; when the external display address is the domain name The virtual machine needs to obtain the address corresponding to the domain name first. Therefore, the virtual machine sends the DNS service.
  • the server initiates a domain name resolution operation, and obtains an address corresponding to the domain name from the DNS server, where the address corresponding to the domain name is the publishing IP address and the publishing port.
  • the cloud platform may send the mapping between the domain name and the publishing IP address and the publishing port corresponding to the service to the DNS server in advance through a registration process. Specifically, the cloud platform sends the domain platform to the DNS server of the domain name system. Corresponding relationship between the domain name and the publishing IP address and the publishing port; the virtual machine is configured to initiate a domain name resolution operation, and obtain the publishing IP address and the publishing corresponding to the service from the DNS server according to the domain name port.
  • the user logs in to the service presentation page to apply for a service to the cloud platform, and the cloud platform returns a service request response to the virtual machine, and the service request response carries the external display address.
  • the cloud platform After the cloud platform determines that the service authorization is passed, the cloud platform records the authorization information of the user to which the virtual machine belongs, and the authorization information of the user includes the user identifier and the virtual machine identifier. And an account number and password assigned to the user. The cloud platform can use the recorded authorization information to authenticate the user's service access request.
  • the cloud platform may perform service authorization at a user granularity, that is, if the user has multiple virtual machines, the user may access the authorized service through any one of the virtual machines, when When the user creates a new virtual machine, the cloud platform sends the NAT rule to the access network element connected to the new virtual machine, so that the user can access the physical server normally through the new virtual machine.
  • Service Service authorization by user granularity can bring greater convenience to users, so that users do not need to separately apply for service authorization for each virtual machine separately. Further, when the user deletes any virtual machine that belongs to the user, the cloud platform notifies the access network element to delete the NAT rule associated with the virtual machine when deleting the virtual machine. .
  • the user may actively request to terminate the service authorization or the cloud platform may actively terminate the service authorization for the user when the user owes a fee.
  • the cloud platform determines that the service authorization of the user needs to be terminated, the cloud platform determines the involved
  • the virtual machine sends a delete message to the access network element that is connected to the virtual machine, and notifies the access network element to delete the NAT rule of the virtual machine.
  • the cloud platform may also have the capability of service detection/collection.
  • service information and the information of the physical server deploying the service may be obtained in time.
  • the physical server is a single physical server or a cluster of physical servers.
  • an embodiment of the present invention provides a method for a virtual machine to access a physical server in a cloud computing system, The station performs the steps in the above system.
  • an embodiment of the present invention provides a method for a virtual machine to access a physical server in a cloud computing system, where the access network element performs the steps in the foregoing system.
  • an embodiment of the present invention provides a cloud platform, which has the function of implementing the cloud platform defined in the foregoing system.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the embodiment of the present invention further provides a host, where the virtual machine defined in the system and the access network element are run, and the access network element may be a virtual machine network element.
  • the access network element may be a virtual machine network element.
  • the openvswitch, or the access network element can be implemented in hardware, specifically a top-of-rack switch on the host.
  • the host has the function of implementing an access network element defined in the above system. Further, the host may also have the function of a virtual machine defined in the above system.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the cloud platform and host are implemented by a general purpose or dedicated server, and the structure of the server includes a processor, a memory, a system bus, and an input and output interface, and the processor is configured to support the system.
  • the input and output interface is for communicating with other components in the cloud computing system, and the processor executes instructions stored in the memory.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the cloud platform, which includes a program designed to perform the above aspects.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use by the host, including a program designed to perform the above aspects.
  • the solution provided by the embodiment of the present invention can shield the virtual machine from the real address of the physical server that provides the service, and provide a unified access mode to the virtual machine, which not only ensures the network security of the cloud platform, but also improves the network security of the cloud platform. The convenience of the user accessing the service.
  • FIG. 1A is a schematic diagram of a network architecture of a cloud computing system according to an embodiment of the present invention
  • 1B is a schematic diagram of a network architecture of another cloud computing system according to an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a hardware of a computer device according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a virtualization structure on a host according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of packet forwarding processing of a virtual machine accessing a physical server according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of a virtual machine accessing a service running on a physical server according to an embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of a cloud platform according to an embodiment of the present disclosure.
  • FIG. 7A is a schematic structural diagram of an access device according to an embodiment of the present invention.
  • FIG. 7B is a schematic structural diagram of another access device according to an embodiment of the present invention.
  • the network architecture and the service scenario described in the embodiments of the present invention are used to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation of the technical solutions provided by the embodiments of the present invention.
  • the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.
  • FIG. 1A and FIG. 1B are network architecture diagrams of a cloud computing system according to an embodiment of the present invention.
  • the cloud computing system includes a host 101, a cloud platform 102, a physical server 103, a network 104, and an access network element 105.
  • a plurality of virtual machines are running on the host 101, and the virtual machines are connected to the network 104, the access cloud platform 102, and the physical server 103 through the access network element 105.
  • the virtual machine running on the host 101 carries the service of the user, and the user logs in to the virtual machine by using the client, and then accesses various services externally distributed by the cloud platform 102 through the network 104, and the service is a service running on the physical server 103, for example, Database services, etc.
  • Cloud computing systems can be divided into infrastructure as a service (Infrastructure as a Service, IAAS), Platform as a Service (PAAS) layer, and Software as a Service (SAAS) layer.
  • the services deployed on the physical server 103 are generally PAAS layer services.
  • the cloud platform 102 is a management terminal of the cloud computing system, and is used for managing the underlying devices and services provided by the cloud computing provider, including managing resources such as computing, network, and storage, and monitoring operation and maintenance.
  • the cloud platform 102 also includes a service presentation page for the user and a management presentation page for the administrator.
  • the administrator configures and manages the services deployed on the physical server by managing the presentation page.
  • the user logs in to the service presentation page of the cloud platform 102 to view the available services, which are displayed on the service presentation page.
  • the service information includes an external display address of the service.
  • the VM When the VM needs to access the foregoing service, the VM initiates a request for accessing the service by using the external display address, where the external display address may uniquely identify the service deployed on the physical server, and the external display address may specifically be The publishing IP address and publishing port corresponding to the service, or the domain name corresponding to the service.
  • the cloud platform 102 establishes a correspondence between the publishing IP address and the publishing port and the real address of the physical server 103 where the service is deployed, and sends the corresponding relationship to the access network of each virtual machine. Yuan 105.
  • the virtual machine initiates a service access process by using the publishing IP address and the publishing port as a destination address of the service access request;
  • the virtual machine needs to initiate the domain name resolution process, obtain the publishing IP address and the publishing port corresponding to the domain name from the DNS server, and then use the publishing IP address and the publishing port as the service access.
  • the destination address of the request initiates a service access process.
  • the cloud platform 102 is also used to the domain name system DNS server. Corresponding relationship between the domain name and the publishing IP address and the publishing port.
  • the DNS server is used internally by the cloud computing system, and the DNS server is connected to the host 101 and the cloud platform 102 through the network 104.
  • the cloud platform 102 includes an SDN (Software Defined Network) controller.
  • SDN controller in the cloud platform 102 obtains the network topology of the virtual machine and is in the form of a flow table.
  • the network address translation (NAT) rule is sent to the access network element 105 of the virtual machine, where the NAT rule includes the publishing IP address and the publishing port and the IP address of the physical server 103 running the service. Correspondence with the port.
  • the issuing IP and the publishing port are specifically an IP and a port corresponding to the service, that is, a service can be uniquely determined through the publishing IP address and the publishing port.
  • the issuing IP may adopt a reserved address, where the reserved address is data.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • the external display addresses of the same service are the same for different users.
  • the cloud platform 102 can have the following functions:
  • the operation and maintenance function that is, the system administrator can configure and manage the service through the management presentation interface provided by the cloud platform 102;
  • the monitoring function is to monitor the physical server in real time and obtain the information of the service going online/offline;
  • the network information acquisition function is to acquire the network topology of the virtual machine running on the host 101 and obtain the IP address and port of the physical server 103 running the service;
  • Service publishing function that is, presenting service information to a user through a service presentation interface
  • the cloud platform 102 can also have functions such as service billing and alarms.
  • Physical server 103 A physical server that deploys the above services, which may be a single physical server or a server cluster.
  • the virtual machine accesses the physical server 103 through the network 104 to access services running on the physical server 103.
  • the real address of the physical server of the deployed service is an address that is externally presented by the physical server cluster.
  • the cluster is in the active/standby mode, the active and standby physical servers have the same Address, the same address is the address that the physical server cluster presents externally; or, when multiple physical servers form a cluster, the virtual IP address of the primary node in the cluster is externally presented as the address externally presented by the physical server cluster.
  • a service access request of a virtual machine When a service access request of a virtual machine is routed to an externally presented address of the physical server cluster, it can be served by a server in the cluster in a load balancing manner.
  • the implementation form of the foregoing server cluster is not limited, as long as the service access request can be routed to the server cluster through the address presented by the server cluster, and the load balancing inside the server cluster is Implementations can employ a variety of approaches in the prior art.
  • the physical server 103 Upon receiving the service access request from the virtual machine, the physical server 103 processes the service access request and returns a service access response.
  • the service access request may be a virtual machine initiated database query request for querying data to a database service deployed on the physical server 103, where the database query request may carry a query condition.
  • the physical server 103 When the database query request is routed to the physical server 103, the physical server 103 generates a query result according to the query condition, and carries the query result in the service access response, and returns the service access response to the virtual machine.
  • the embodiment of the present invention does not limit the type and purpose of the service access request, and does not limit the specific method for the physical server 103 to process the service access request.
  • Various service access requests common in the prior art are in the present invention. The methods of processing a service access request by a physical server disclosed in the prior art may also be directly cited in the embodiment of the present invention.
  • the access network element 105 may be a virtual network element (for example, an Open vSwitch) running on the host 101 or a Top Of Rack (TOR) of the host, and the access network element 105 is connected to the virtual machine, and The virtual machine provides network access capabilities.
  • the access network element 105 can be located in the virtualization layer of the host 101 as shown in FIG. 1A. Alternatively, as shown in FIG. 1B, it is a top-of-rack switch physically connected to the host 101.
  • the top-of-rack switch is an independent hardware device. In a specific application scenario, the host may independently share a top-of-rack switch, multiple hosts may share one top-of-rack switch, or multiple hosts share multiple top-of-rack switches, which is not limited in this embodiment of the present invention.
  • a NAT rule is configured on the access network element, and the NAT rule includes a corresponding relationship between the publishing IP address and the publishing port corresponding to the service and the IP address and port of the physical server. Further, the NAT rule can be directed to both the VM direction and the VM direction. It should be noted that, in the embodiments of the present invention, the IP address and port of the physical server are real IP addresses and ports of the physical server, which are different from the publishing IP address and the publishing port corresponding to the service.
  • the NAT rule may be implemented by using the Iptables in the Linux system or the flow table sent by the SDN controller.
  • the specific implementation manner is not limited in the embodiment of the present invention.
  • a VM on the IAAS layer of a cloud platform vendor accesses a PAAS service running on a PM through a network.
  • the IAAS and the PAAS are respectively provided by different vendors, the IAAS can be implemented for the PAAS service running on the PM.
  • PAAS decoupling facilitates rapid integration of IAAS and PAAS.
  • the method for accessing a physical server by the virtual machine in the embodiment of the present invention can make the real address of the physical server invisible to the virtual machine, thereby shielding the virtual machine from the physical server and improving the security of the cloud computing system;
  • the physical server externally presents the same external display address.
  • the same access mode is provided for different users to access the service running on the physical server, and the access address is normalized, and the cloud platform is deployed on the physical server. The efficiency of the new service.
  • the cloud platform can control the deployment of the physical server. After running the service on the physical server, the cloud platform publishes information about the services running on the physical server. The user can view the published service through the service presentation interface provided by the cloud platform, and initiate a service application, and the cloud platform approves the service application of the user. If the approval is passed, the authorization information is returned to the user, and the authorization information may include the user identifier. , virtual machine identification, permissions, and account and password assigned to the user. The user information of the user is recorded in the cloud platform, including information of each virtual machine used by the user. The cloud platform can authorize the user to access the service on the physical server at the granularity of the user.
  • each virtual machine of the user can access the server; the cloud platform can also authorize the user to access the service on the physical server by using the virtual machine as a granularity, that is, The cloud platform authorizes users to access services through specific virtual machines.
  • the cloud platform can determine the list of authorized virtual machines, and the cloud platform delivers the NAT rule to the access network element connected to each authorized virtual machine, and converts the external display address of the service into physical through the NAT rule.
  • the access network element may be a mounted network element or a tunnel encapsulating network element of the virtual machine.
  • the cloud platform, the host, the physical server deploying the service, and the access network element in the cloud computing system shown in FIG. 1A and FIG. 1B can be implemented by hardware/software. Illustratively, as shown in FIG. 2, the present invention is implemented.
  • the computer device 200 includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.
  • the processor 201 can be a general purpose central processing unit (CPU) or microprocessor that executes the instructions in the memory 203 to implement the functions of the various devices described above.
  • CPU central processing unit
  • microprocessor that executes the instructions in the memory 203 to implement the functions of the various devices described above.
  • Communication bus 202 can include a path for communicating information between the components described above.
  • the communication interface 304 uses devices such as any transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the memory 203 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory can exist independently and be connected to the processor via a bus.
  • the memory 203 is used to store application code for executing the solution of the present invention, and is controlled by the processor 201 for execution.
  • the processor 201 is configured to execute application code stored in the memory 203.
  • processor 201 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • computer device 200 can include multiple processors, such as processor 201 and processor 208 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • computer device 200 may also include an output device 205 and an input device 206.
  • Output device 205 is in communication with processor 201 and can display information in a variety of ways.
  • the output device 205 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector.
  • Input device 206 is in communication with processor 201 and can accept user input in a variety of ways.
  • input device 206 can be a mouse, keyboard, touch screen device or sensing device, and the like.
  • the computer device 200 described above can be a general purpose computer device or a special purpose computer device.
  • the computer device 200 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet, a wireless terminal device, a communication device, an embedded device, or have FIG. A device of similar structure.
  • Embodiments of the invention do not limit the type of computer device 200.
  • the cloud platform, the host, the physical server for deploying the service, and the access network element in FIG. 1A and FIG. 1B may be the device shown in FIG. 2, and the memory stores one or more software modules for implementing the cloud platform, the host, and the The physical server that deploys the service and the functions of the access NE (for example, NAT translation function, etc.).
  • the cloud platform, the host, the physical server deploying the service, and the access network element can implement a method for the virtual machine to access the service deployed on the physical server through the processor and the program code in the memory.
  • FIG. 2 merely gives possible hardware implementations of various parts of the cloud computing system, and may add or delete hardware components of the computer device according to different functions or changes of various parts of the system. In order to match the functions of the various parts of the system.
  • FIG. 3 it is a schematic diagram of a virtualization structure on a host provided by an embodiment of the present invention.
  • the host is a physical server.
  • the bottom layer of the host is the hardware layer.
  • the hardware layer mainly includes hardware resources such as a central processing unit (CPU), memory, hard disk, and physical network card.
  • Server virtualization is based on virtualized software on physical servers (eg VMWare ESX, Citrix XEN) implements a virtualized running environment for multiple virtual machines (VMs).
  • the software layer installed on the server to implement the virtualized environment is called Virtual Machine Monitor (VMM).
  • the VMM running on top of the hardware layer assumes the scheduling, allocation, and management of hardware resources in the hardware layer. Multiple virtual machine VMs are run on the VMM.
  • the VMM provides virtualized CPU, memory, storage, IO devices (such as physical network cards) and Ethernet switches for each virtual machine to ensure that multiple virtual machines run in isolation.
  • the VMM creates a virtual network interface card (vNIC) for each virtual machine.
  • the virtual switch vSwitch provides communication between virtual machines and between virtual machines and external networks.
  • the virtual NIC of each virtual machine corresponds to a virtual port of the vSwitch.
  • the physical NIC of the host corresponds to the port that the vSwitch connects to the external top-of-rack switch.
  • the dashed lines in Figure 3 represent logical connections in the virtual network and the solid lines represent physical connections.
  • the function of the access network element is implemented by a virtual switch (vSwitch), and the cloud platform sends the NAT rule of the virtual machine to the virtual switch, where the virtual switch is configured on the virtual port connected to the virtual machine.
  • the NAT rule when the virtual machine switch receives the service access request from the virtual machine, uses the NAT rule to modify the destination address of the service access request to the publishing IP address and the publishing port corresponding to the service, thereby The message access request is routed to the physical server where the service is deployed.
  • the function of the access network element is implemented by a top-of-rack switch connected to the host, and the cloud platform generates the NAT rule of the virtual machine to the top-of-rack switch, and configures the virtual machine on the top-of-rack switch.
  • the NAT rule when the top-of-rack switch receives the service access request from the virtual machine, uses the NAT rule to modify the destination address of the service access request to the publishing IP address and the publishing port corresponding to the service, thereby The message access request is routed to the physical server where the service is deployed.
  • NAT translation is performed on the address of the physical server, and in the direction of the VM, The destination address of the packet is modified to the advertised IP address and the advertised port corresponding to the service. In the direction of the VM, the source address of the packet is modified to the advertised IP address and the advertised port corresponding to the service.
  • the routing process of the packet between the host and the physical server is performed according to the existing standard definition manner, which is not limited by the embodiment of the present invention, as long as the packet can be routed to the physical server according to the publishing IP address and the publishing port. .
  • the packet forwarding processing process of the virtual machine accessing the physical server includes:
  • Step 401 The external display address of the service running on the physical server is visible to the virtual machine, and the virtual machine sends a service access request to the physical server.
  • the destination address of the service access request is a publishing IP address and an issuance port corresponding to the service.
  • the external display address includes a publishing IP address and an issuing port, and the publishing IP address and the publishing port may uniquely identify a service running by the physical server;
  • the external display address is a domain name
  • the domain name can uniquely identify a service run by the physical server.
  • the virtual machine initiates a domain name resolution operation on the domain name, and obtains a publishing IP address and a publishing port corresponding to the service run by the physical server.
  • the virtual machine After the virtual machine obtains the publishing IP address and the publishing port corresponding to the service running by the physical server, the virtual machine initiates the service access request with the publishing IP address and the publishing port as the destination address.
  • Step 402 The access network element receives the service access request, and replaces the destination address carried by the request packet with an IP address and a port of a physical server running the service according to the NAT rule, where the NAT rule includes an operation center.
  • the NAT rule may be a flow table delivered by an SDN controller in the cloud platform.
  • Step 403 The NAT-transformed service access request is routed through the network to the physical server running the service.
  • Step 404 The physical server receives a service access request of the virtual machine, and returns a service response message to the virtual machine.
  • the source address of the service response packet sent by the physical server may be a publishing IP address and an advertised port corresponding to the service, and when the access network element receives the service response packet, The NAT of the source address of the service response packet is translated to ensure that the virtual machine cannot obtain the real address of the physical server.
  • the physical server needs to be modified to record the publishing IP address and the publishing port corresponding to the service, and set the source address as the publishing IP address and the publishing port in the returned response message, the above modification.
  • the access network element does not need to replace the source address of the service response packet after receiving the service response packet, so that the efficiency of the virtual machine accessing the service on the physical server can be improved.
  • the source address of the service response packet sent by the physical server may be the real IP address and port of the physical server, and the service response packet is routed to the access network element through the network, And the access network element replaces the source address of the service response packet with the publishing IP address and the publishing port corresponding to the service, and returns the service response packet to the virtual machine according to the NAT rule. .
  • the virtual machine can access the physical server running the service.
  • the same service has the same external display address, which unifies the access mode of the virtual machine.
  • the real address of the physical server is invisible to the virtual machine, which ensures the network security of the physical server.
  • the cloud platform deletes the authorized information of the recorded user, terminates the service authorization, and notifies the access network element connected to the virtual machine to delete the NAT rule associated with the user.
  • the NAT rule corresponding to the virtual machine is dynamically migrated.
  • the dynamic migration can be implemented through the migration tool or the openflow can be dynamically sent through the SDN controller.
  • the flow table and other methods are implemented to ensure continuous access to the services on the physical server when the virtual machine is migrated.
  • the access network element before the virtual machine is migrated to establish a connection with the migrated access network element, and the NAT rule corresponding to the virtual machine is sent to the access network element after the virtual machine is migrated;
  • the SDN controller obtains the address of the access NE after the virtual machine is migrated, and sends the NAT rule to the migrated access NE in the form of a flow table to ensure that the virtual machine can be normal after the migration. Access the service. To ensure that the virtual machine access service is not interrupted during the migration process, you can use the tools such as Conntrackd to transfer the status information of the virtual machine to host 2.
  • the physical server running the service may be a single physical server or a cluster of physical servers with high availability.
  • the server cluster may be implemented according to the performance requirements of the service based on existing tools or protocols. Not limited.
  • the physical server is a server cluster, it may specifically be a shared service cluster or a single instance service cluster, and the shared service cluster provides a cluster of physical servers that are isolated from each other based on user access rights, and the single instance service cluster provides user access rights.
  • the service access methods provided by the embodiments of the present invention are applicable.
  • FIG. 5 provides a schematic diagram of a process for a virtual machine to access a service running on a physical server, including a service deployment phase, a service application phase, and a service access phase.
  • Step 501 After the physical server is online, deploy one or more services provided to the virtual machine on the physical server.
  • These services can be deployed on a single physical server or on a cluster of highly available physical servers.
  • the cloud platform administrator configures the physical server through the management presentation interface and deploys the service on the physical server.
  • the specific process may adopt an existing solution, which is not limited by the embodiment of the present invention.
  • Step 502 The cloud platform records an IP address and a port of a physical server running the service.
  • the virtual machine accesses the single physical server to access the service; when the service is deployed on the physical server cluster, the cloud platform records the physical server running the service.
  • the IP address and port are the IP addresses and ports that the physical server cluster presents externally. For example, when the cluster is in the active/standby mode, the primary and secondary physical servers have the same IP address and port. The same IP address and port are the externally presented addresses of the physical server cluster. Alternatively, when multiple physical servers form a cluster, The virtual IP address and virtual port of the primary node in the cluster are externally presented as the external address of the physical server cluster.
  • Step 503 The cloud platform allocates an external display address to the service, and the external display address can uniquely identify the service.
  • the external display address includes a publishing IP address and a publishing port.
  • the external display address is a domain name corresponding to the service, and the cloud platform And assigning an IP address and a publishing port to the service, and establishing a mapping relationship between the domain name and the publishing IP address and the publishing port.
  • the cloud platform records the IP address and port of the physical server, the identifier of the service running by the physical server, and the association between the publishing IP address and the publishing port corresponding to the service. Further, when the external display address is a domain name corresponding to the service, the association relationship may further include a domain name corresponding to the service.
  • Step 504 After the service deployment is completed, the cloud platform externally issues service information, where the service information includes an external display address of the service.
  • Step 505 The user queries the service provided by the cloud platform, and initiates a service request request to the cloud platform.
  • the service presentation interface of the cloud platform is visible to the user, and the user logs in to the service presentation interface by using the virtual machine to query the service information, and initiates a service request request to the cloud platform, where the service application request can carry the identifier and user of the service to be applied for. Identification and virtual machine identification, etc. It should be noted that, the embodiment of the present invention does not limit the content carried in the service request request, as long as the cloud platform can obtain the information required for performing the service approval from the service application request.
  • Step 506 The cloud platform approves the service request request, and after the approval is passed, records the user authorization information, where the authorization information includes a user identifier, a virtual machine identifier, a rights, an account number and a password assigned to the user, and the like.
  • the cloud platform After receiving the service request from the user, the cloud platform can be automatically approved or manually approved by the administrator.
  • the service request returns the reason for the failure to the virtual machine.
  • the cloud platform After the service request request approval is passed, the cloud platform returns the authorization information to the virtual machine.
  • the service authorization may be user-granular, that is, after the user's service application request is approved, all the virtual machines belonging to the user may access the service, and the authorization information may not include the virtual machine identifier;
  • the authorization may be virtual machine granularity, that is, the qualified user can only access the service through the virtual machine that obtains the approval.
  • the authorization information may not include the user identifier.
  • the authority in the authorization information refers to the operation authority of the user to access the service.
  • the authority in the authorization information may be used to restrict the user to only have the query permission of the database service, or to grant the user the update authority for the database service.
  • Step 507 The cloud platform returns a service request response to the virtual machine.
  • the service request response includes an external display address of the service, the authorization information, and the like.
  • Step 508 The cloud platform sends a NAT rule to the access network element of the virtual machine, where the NAT rule includes an IP address and a port of the physical server running the service, and a publishing IP address and a publishing port corresponding to the service. Correspondence relationship.
  • Step 509 The access network element of the virtual machine receives and records the NAT rule, and is used for processing subsequent data packets.
  • Step 510 The virtual machine sends a service access request, where the destination address of the service access request is a publishing IP address and an issuance port corresponding to the service.
  • the external display address of the service can be a domain name.
  • the cloud platform may send the corresponding relationship between the domain name and the publishing IP address corresponding to the service to the domain name system DNS server through a registration process; the virtual machine is used to initiate the domain name.
  • the parsing operation acquires the publishing IP address and the publishing port corresponding to the service from the DNS server according to the domain name.
  • the DNS server is an internal DNS server of the cloud computing system.
  • Step 511 The access network element receives the service access request, and replaces the destination address of the service access request with an IP address and a port of a physical server running the service according to a NAT rule, where the NAT rule includes running the The corresponding relationship between the IP address of the service's physical server and the port's publishing IP address and the publishing port.
  • Step 512 The NAT-translated service access request is routed through the network to the physical server running the service.
  • Step 513 The physical server receives the service access request of the virtual machine, and returns a service response message, where the source address of the service response message is an IP address and a port of the physical server.
  • Step 514 The service response packet is routed to the access network element through a network.
  • Step 515 The access network element replaces the source address of the service response packet with the publishing IP address and the publishing port corresponding to the service according to the NAT rule, and returns the service response packet. Give the virtual machine.
  • the method for accessing a physical server by using a virtual machine can shield the virtual machine from the real IP address of the physical server that provides the service, and provide a unified access mode to the virtual machine, thereby ensuring network security of the cloud platform and improving The convenience of the user accessing the service.
  • the same access mode is configured for the same service, which reduces the complexity of the deployment and operation and maintenance management services on the physical server, and the user does not need to pay attention to the functions of online service, operation and maintenance, upgrade, and high availability of the physical server;
  • the tunneling technology such as Vxlan is not required in the process, and the transmission efficiency is higher.
  • the access NEs connected to each virtual machine implement NAT rules, which improves the concurrent processing efficiency of massive users' secure access to PAAS services.
  • the user can log in to the service presentation interface provided by the cloud platform, view the service information, and initiate a service application.
  • the cloud platform can authenticate the service request from the virtual machine, and the specific authentication mode can be the account password mode or other manners, which is not limited by the embodiment of the present invention.
  • the cloud platform can control the access of the virtual machine to the service by the granularity of the user, the virtual machine, or the host.
  • the cloud platform can perform service authorization for the user, and the virtual machine belonging to the user can access the service; or the cloud platform is for the virtual machine.
  • Service access authorization each virtual machine accesses the service of the physical server with different IPs; or, multiple virtual machines on one host share IP, and the cloud platform presents the same IP address to access the physical server service. Different virtual machines on the same host can be distinguished by unused message ports.
  • the cloud platform may also terminate the service access authorization of the virtual machine, and the termination of the service access authorization may be caused by the user actively initiating the termination application or the cloud platform determining the user's arrears.
  • the cloud platform sends a delete message to the access network element where the virtual machine is located, and deletes the NAT rule of the virtual machine recorded on the access network element, deletes the user information recorded in the cloud platform, and stops accessing the user.
  • Authorization The cloud platform can retain the data copy service for storing the user's data for a certain period of time and for the user. During the validity period of the reasonable time period, the user can choose to renew and continue to use the service provided by the PM.
  • FIG. 6 is a schematic structural diagram of a cloud platform according to an embodiment of the present invention, including: processing Unit 601, publishing unit 602, receiving unit 603, and transmitting unit 604,
  • the processing unit 601 is configured to allocate a publishing IP address and an issuing port corresponding to the service to the service, and record a correspondence between the publishing IP address and an IP address and a port of the publishing port and a physical server running the service;
  • the issuing unit 602 is configured to publish the service
  • the receiving unit 603 is configured to receive a service request request sent by the virtual machine.
  • the sending unit 604 is configured to send a NAT rule to an access network element of the virtual machine, where the NAT rule includes the publishing IP address and an IP address and a port of the publishing port and the physical server running the service. Corresponding relationship, wherein the virtual machine accesses the network of the cloud computing system through the access network element.
  • the cloud platform externally releases the service information through the foregoing publishing unit, specifically:
  • the issuing unit 602 is specifically configured to provide a service presentation interface to the virtual machine, and display service information, where the service information includes an external display address of the service.
  • the external display address includes a domain name corresponding to the service, or a publishing IP address and an issuance port corresponding to the service.
  • the external display address can uniquely identify the service.
  • the cloud computing system further includes a DNS server, which is a DNS server used internally by the cloud computing system, and the host, the cloud platform, and the DNS server running the virtual machine are connected through a network, and the cloud platform is completed.
  • the sending unit 604 is further configured to deliver the domain name, the publishing IP address, and the publishing port to the domain name system DNS server.
  • the sending unit 604 is further configured to return a service request response to the virtual machine, where the service request response carries the external display address.
  • the processing unit 601 is further configured to record authorization information of a user to which the virtual machine belongs, where the authorization information of the user includes a user identifier, a virtual machine identifier, and an account and password assigned to the user.
  • the receiving unit 603 is further configured to receive a virtual machine creation request.
  • the processing unit 601 is further configured to create another virtual machine for the user according to the virtual machine creation request;
  • the sending unit 604 is further configured to deliver the NAT rule to an access network element that is connected to the another virtual machine after the another virtual machine is created.
  • the processing unit 601 is further configured to terminate service authorization for the virtual machine
  • the sending unit 604 is further configured to send a delete message to the access network element, to notify the access network element to delete the NAT rule of the virtual machine.
  • an access device implements the function of an access network element in the foregoing system, where the access device includes:
  • a client sending unit 701 configured to forward a service request request of the virtual machine to the cloud platform;
  • the client receiving unit 702 is configured to receive a NAT rule of the virtual machine returned by the cloud platform after the approval of the service request request, the NAT rule including the publishing IP address and the publishing port, and the running the service Corresponding relationship between the IP address and the port of the physical server, wherein the virtual machine accesses the network of the cloud computing system through the access network element;
  • the client sending unit 701 is further configured to receive a service access request sent by the virtual machine, where the destination address of the service access request is the publishing IP address and the publishing port corresponding to the service;
  • the client processing unit 703 is configured to replace, according to the NAT rule, a destination address of the service access request with an IP address and a port of the physical server;
  • the client sending unit 701 is further configured to route the modified service access request to the physical server;
  • the client receiving unit 702 is configured to receive a service response message returned by the physical server.
  • client processing unit 703 is further configured to replace the source address of the service response message with the publishing IP address and the publishing port corresponding to the service according to the NAT rule;
  • the client sending unit 702 is further configured to send the modified service response message to the virtual machine.
  • the access device may be a functional component on the host in the foregoing system, and a central processor running instruction on the host implements the foregoing function of the access device; as shown in FIG. 7B, the access device
  • the device may be a top-of-rack switch as described in the foregoing system, and the top-of-rack switch may be a physical device independent of the host. In another possible design, the top-of-rack switch may be one of the hosts. component.
  • the aforementioned cloud platform and access device can be implemented by using a computer device as shown in FIG. 2.
  • An embodiment of the present invention further provides a computer storage medium for storing computer software instructions for use in the apparatus shown in Figures 6 and 7 above, including a program designed to execute the above method embodiments.
  • a stored program By executing a stored program, you can implement a method for a virtual machine to access a service deployed on a physical server.
  • the method, apparatus, and system for accessing a physical server by a virtual machine can shield a virtual machine from a real IP address of a physical server that provides a service, and provide a unified access mode to the virtual machine.
  • the network security of the cloud platform improves the convenience of users accessing services. Further, configuring the same access mode for the same service reduces the complexity of deployment and operation and maintenance management services on the physical server, and the user does not need to pay attention to the physical service.
  • the server provides services such as on-line, operation and maintenance, upgrade, and high-availability.
  • the virtual machine accesses the physical server without tunneling technology such as Vxlan, and the transmission efficiency is higher.
  • the access NE connected by each virtual machine executes the NAT rule. Improve the concurrent processing efficiency of massive users' secure access to PAAS services.
  • embodiments of the present invention can be provided as a method, apparatus (device), or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program is stored/distributed in a suitable medium, provided with other hardware or as part of the hardware, or in other distributed forms, such as over the Internet or other wired or wireless telecommunication systems.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种云计算系统中虚拟机访问物理服务器的方法、装置和系统，所述物理服务器上部署有服务，云平台为所述服务分配与所述服务对应的发布IP地址和发布端口，对外发布所述服务，并在所述虚拟机的接入网元上配置NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，当所述接入网元接收到虚拟机访问所述服务的服务访问请求时，根据所述NAT规则将所述服务访问请求的目的地址修改为所述物理服务器的IP地址和端口，修改后的服务访问请求路由到所述物理服务器，从而使得所述虚拟机可以在不知道物理服务器真实IP地址和端口的情况下访问所述物理服务器上的服务。

Description

云计算系统中虚拟机访问物理服务器的方法、装置和系统 技术领域
本发明涉及IT技术领域，尤其涉及云计算系统中虚拟机访问物理服务器的方法、装置和系统。
背景技术
在云计算环境下，因为配置或性能等方面的因素，存在着一些服务需要直接运行在物理服务器(Physical Machine，PM)上，比如Oracle的数据库(Database，DB)等。用户登录虚拟机(Virtual Machine，VM)，通过网络访问部署上述类型服务的物理服务器。
现有技术中，VM需要获取PM的IP地址来访问物理服务器上的各种服务。当VM可以获取运行服务的PM或PM集群的真实IP地址时，就暴露了云平台上服务所在的物理服务器的网络规划信息，恶意用户就可以对PM所在网络以及该网络内的设备进行网络攻击，从而危害云平台的安全。
发明内容
本发明实施例描述了一种虚拟机访问物理服务器的方法、装置和系统，避免虚拟机获取物理服务器的真实地址，危害网络安全。
一方面，本发明实施例提供了一种虚拟机访问物理服务器的系统，所述系统包括云平台、至少一个物理服务器、至少一个主机以及至少一个接入网元，所述主机、所述物理服务器以及所述云平台相互通信，所述主机上运行有至少一个虚拟机，所述虚拟机通过所述接入网元访问所述物理服务器，所述物理服务器上部署有服务，其中，所述云平台为所述服务分配与所述服务对应的发布IP地址和发布端口，建立所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，所述云平台发布所述服务，使得所述服务对虚拟机可见；所述云平台向所述接入网元发送与所述虚拟机关联的NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系；所述接入网元接收所述虚拟机发送的服务访问请求，根据所述NAT规则，将所述服务访问请求的目的地址替换为所述物理服务器的IP地址和端口，将修改后的服务访问请求路由到所述物理服务器，并接收所述物理服务器返回的服务响应消息。通过上述过程，虚拟 机在不知道部署服务的物理服务器真实IP地址和端口的情况下，可以访问所述服务，另外，由于服务可以通过与服务对应的发布IP地址和发布端口唯一标识，即使服务部署在具备多个IP地址的不同物理服务器或物理服务器集群上，不同的虚拟机均可以使用相同的所述发布IP地址和发布端口访问相同服务，而无需关注服务实际所在的物理服务器或物理服务器集群的真实IP地址和端口，实现了服务访问方式的统一。
在一种可能的设计中，所述服务响应消息的源地址为所述物理服务器的IP地址和端口，当接入网元接收到云平台返回的服务响应消息时，还可以根据所述NAT规则将所述服务响应消息的源地址替换为与所述服务对应的所述发布IP地址和发布端口，将修改后的服务响应消息发送给所述虚拟机，从而使得虚拟机接收到的服务响应消息中仍然不包含物理服务器的真实地址。需要说明的是，云平台发出的所述服务响应消息的源地址也可以直接设定为所述发布IP地址和发布端口，而无需所述接入单元对所述源地址进行修改。当物理服务器发出的服务响应报文的源地址为物理服务器真实地址时，物理服务器不需要为了适应本发明实施例而进行修改，从而提高了服务部署和发布的效率。当物理服务器发出的服务响应报文的源地址为与服务对应的所述发布IP地址和发布端口时，需要对物理服务器需要进行适应性修改，记录所述服务与所述发布IP地址和发布端口的对应关系，当物理服务器发出服务响应报文时，将服务响应报文的源地址设置为所述发布IP地址和发布端口，此时，接入网元无需对服务响应报文的源地址进行NAT转换，提高了虚拟机访问物理服务器上部署的服务的效率，但另一方面，由于物理服务器需要修改才能执行本发明实施例的方案，降低了服务部署和发布的效率。
在一种可能的设计中，云平台可以采用多种方式对外发布所述服务，需要说明的是，所述云平台具备面向用户的服务呈现界面以及面向运维人员的管理呈现界面，用户可以登录该服务呈现界面，浏览云平台提供的各种服务，并发起服务申请。云平台在所述服务呈现界面显示服务信息，向用户提供对所述服务的介绍，所述服务信息包括所述服务的外部显示地址。
在一种可能的设计中，所述服务的外部显示地址可以为所述发布IP地址和发布端口，也可以为所述服务对应的域名。当所述外部显示地址为所述发布IP地址和发布端口时，虚拟机可以以所述发布IP地址和发布端口作为目的地址向物理服务器请求访问服务；当所述外部显示地址为所述域名时，虚拟机需要首先获取域名对应的地址，因此，虚拟机向DNS服 务器发起域名解析操作，从所述DNS服务器获取所述域名对应的地址，其中，所述域名对应的地址为所述发布IP地址和发布端口。云平台可以预先通过注册流程，将所述域名与所述服务对应的所述发布IP地址和发布端口的对应关系发送到所述DNS服务器，具体的，所述云平台向域名系统DNS服务器下发所述域名与所述发布IP地址和发布端口的对应关系；所述虚拟机用于发起域名解析操作，根据所述域名从所述DNS服务器获取与所述服务对应的所述发布IP地址和发布端口。
在一种可能的设计中，用户登录所述服务呈现页面，向云平台申请服务，所述云平台向所述虚拟机返回服务申请响应，所述服务申请响应携带所述外部显示地址。
在一种可能的设计中，针对用户的服务申请请求，所述云平台确定服务授权通过后，记录所述虚拟机所属的用户的授权信息，所述用户的授权信息包括用户标识、虚拟机标识以及分配给所述用户的账号和密码。云平台可以使用记录的授权信息对用户的服务访问请求进行鉴权。
在一种可能的设计中，所述云平台可以以用户为粒度进行服务授权，即用户有多个虚拟机的情况下，用户可以通过其中的任一一个虚拟机访问获得授权的服务，当用户创建新的虚拟机时，所述云平台向所述新的虚拟机连接的接入网元下发所述NAT规则，以使得用户通过所述新的虚拟机可以正常访问所述物理服务器上的服务。以用户为粒度进行服务授权可以为用户带来较大便利，使得用户无需单独为每个虚拟机分别申请服务授权。更进一步的，当用户删除归属于所述用户的任一虚拟机时，所述云平台在删除所述虚拟机时，通知所述接入网元删除与所述虚拟机关联的所述NAT规则。
用户可以主动请求终止服务授权或者云平台可以在用户欠费时主动终止对所述用户的服务授权，当所述云平台确定需要终止所述用户的服务授权时，所述云平台确定涉及到的虚拟机，向虚拟机连接的所述接入网元发送删除消息，通知所述接入网元删除所述虚拟机的NAT规则。
所述云平台还可以具备服务检测/收集的能力，当物理服务器上上线新的服务时，可以及时获取服务信息以及部署所述服务的物理服务器的信息。
在一种可能的设计中，所述物理服务器为单台物理服务器或者物理服务器集群。
另一方面，本发明实施例提供了一种云计算系统中虚拟机访问物理服务器的方法，云平 台执行上述系统中的步骤。
再一方面，本发明实施例提供了另一种云计算系统中虚拟机访问物理服务器的方法，由接入网元执行上述系统中的步骤。
与前述系统以及方法相对应，本发明实施例提供了一种云平台，该云平台具有实现上述系统中定义的云平台的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
与前述系统以及方法相对应，本发明实施例还提供了一种主机，其上运行有所述系统中定义的虚拟机以及接入网元，所述接入网元可以为虚拟机网元，例如，openvswitch，或者，所述接入网元可以硬件实现，具体为主机上的架顶交换机。该主机具有实现上述系统中定义的接入网元的功能。进一步的，该主机还可以具有上述系统中定义的虚拟机的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，所述云平台和主机由通用或专用的服务器实现，服务器的结构中包括处理器、存储器、系统总线以及输入输出接口，所述处理器被配置为支持所述系统中云平台或主机的相应的功能。所述输入输出接口用于与所述云计算系统中的其他部件进行通信，处理器执行所述存储器中存储的指令。
再一方面，本发明实施例提供了一种计算机存储介质，用于储存为上述云平台所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
再一方面，本发明实施例提供了一种计算机存储介质，用于储存为上述主机所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
相较于现有技术，本发明实施例提供的方案可以对虚拟机屏蔽部署服务的物理服务器的真实地址，同时向虚拟机提供统一的访问方式，既保证了云平台的网络安全，又提高了用户访问服务的便利性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。显而易见地，下面附图中反映的仅仅是本发明的一部分实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据 这些附图获得本发明的其他实施方式。而所有这些实施例或实施方式都在本发明的保护范围之内。
图1A是本发明实施例提供的一种云计算系统的网络架构示意图；
图1B是本发明实施例提供的另一种云计算系统的网络架构示意图；
图2是本发明实施例提供的一种计算机设备硬件结构示意图；
图3是本发明实施例提供的主机上的虚拟化结构示意图；
图4是本发明实施例提供的虚拟机访问物理服务器的报文转发处理流程图；
图5是本发明实施例提供的虚拟机访问物理服务器上运行的服务的流程示意图；
图6是本发明实施例提供的一种云平台的结构示意图；
图7A为本发明实施例提供的一种接入装置的结构示意图；
图7B为本发明实施例提供的另一种接入装置的结构示意图。
具体实施方式
下面将结合附图，对本发明实施例中的技术方案进行清楚、完整地描述。显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有付出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例描述的网络架构以及业务场景是为了更加清楚的说明本发明实施例的技术方案，并不构成对于本发明实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
如图1A和图1B所示，为本发明实施例提供的云计算系统的网络架构图，所述云计算系统包括主机101、云平台102、物理服务器103，网络104以及接入网元105。主机101上运行有若干虚拟机，虚拟机通过接入网元105连接到所述网络104、访问云平台102以及物理服务器103。
运行在主机101上的虚拟机：承载用户的业务，用户使用客户端登录虚拟机，进而通过网络104访问云平台102对外发布的各种服务，所述服务为物理服务器103上运行的服务，例如数据库服务等。云计算系统从结构上可以分为基础设施即服务(Infrastructure as a  Service，IAAS)层、平台即服务(Platform as a Service，PAAS)层以及软件即服务(Software as a Service，SAAS)层，所述物理服务器103上部署的服务一般为PAAS层服务。
云平台102：云计算系统的管理端，用于对云计算提供商提供的底层设备和服务进行管理，包括对计算、网络和存储等资源进行管理以及监控运维等。云平台102还包括针对用户的服务呈现页面以及针对管理员管理呈现页面。管理员通过管理呈现页面对物理服务器上部署的服务进行配置和管理；当服务部署完成后，用户登录云平台102的所述服务呈现页面，查看可用的服务，在所述服务呈现页面上显示的服务信息包括所述服务的外部显示地址。当VM需要访问上述服务时，VM通过所述外部显示地址发起访问上述服务的请求，所述外部显示地址可以唯一标识部署在物理服务器上的上述服务，所述外部显示地址具体可以为与所述服务对应的发布IP地址和发布端口，或者为与所述服务对应的域名。
云平台102建立与所述服务对应的发布IP地址和发布端口与部署所述服务的物理服务器103的真实地址之间的对应关系，并将所述对应关系下发到各个虚拟机的接入网元105。当所述服务的外部显示地址为所述发布IP地址和发布端口时，虚拟机使用所述发布IP地址和发布端口作为服务访问请求的目的地址发起服务访问流程；当所述服务的外部显示地址为与所述服务对应的域名时，虚拟机需要先发起域名解析流程，从DNS服务器获取所述域名对应的所述发布IP地址和发布端口，再使用所述发布IP地址和发布端口作为服务访问请求的目的地址发起服务访问流程，需要说明的是，当所述服务的外部显示地址为与所述服务对应的域名时，在服务部署完成后，云平台102还用于向域名系统DNS服务器下发所述域名与所述发布IP地址和发布端口的对应关系。所述DNS服务器供所述云计算系统内部使用，所述DNS服务器通过所述网络104与所述主机101和所述云平台102相连。
在具体的实现场景中云平台102中包括SDN(Software Defined Network,软件定义网络)控制器，优选的，云平台102中的所述SDN控制器获取虚拟机的网络拓扑，并以流表的形式向虚拟机的接入网元105下发网络地址转换(Network Address Translation，NAT)规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器103的IP地址和端口的对应关系。
所述发布IP以及发布端口具体为与服务对应的IP和端口，即通过所述发布IP地址和发布端口可以唯一确定一项服务。其中，发布IP可以采用保留地址，所述保留地址为数据 业务网络不能使用的IP地址，例如169.254.*.*；发布端口可以采用知名端口，知名端口号(well-known port numbers)为互联网名称与数字地址分配机构(The Internet Corporation for Assigned Names and Numbers，ICANN)预留给传输控制协议(Transmission Control Protocol，TCP)和用户数据报协议(User Datagram Protocol，UDP)使用的端口号。例如，可以使用169.254.169.254+3306代表数据库服务的访问地址。
在本发明实施例中，针对不同用户，同一服务的外部显示地址相同。
所述云平台102可以具备以下功能：
运维功能，即系统管理员可以通过云平台102提供的管理呈现界面对服务进行配置和管理；
监控功能，即实时监控物理服务器，获取服务上线/下线的信息；
网络信息获取功能，即获取主机101上运行的虚拟机的网络拓扑以及获取运行服务的物理服务器103的IP地址和端口；
服务发布功能，即通过服务呈现界面向用户呈现服务信息；
进一步的，云平台102还可以具备服务计费以及告警等功能。
物理服务器103：部署上述服务的物理服务器，可以为单台物理服务器或者服务器集群。虚拟机通过网络104接入到物理服务器103，访问物理服务器103上运行的服务。需要说明的是，当物理服务器103为物理服务器集群时，上述部署服务的物理服务器的真实地址为物理服务器集群对外呈现的地址，例如，当集群为主备模式时，主备物理服务器具备相同的地址，该相同的地址即为物理服务器集群对外呈现的地址；或者，当多个物理服务器组成一个集群，对外呈现集群中主节点的虚拟IP地址作为物理服务器集群对外呈现的地址。当虚拟机的服务访问请求路由到物理服务器集群对外呈现的地址时，可以通过负载均衡的方式由集群中的某个服务器提供服务。需要说明的是，本发明实施例对上述服务器集群的实现形式并不进行限定，只要通过该服务器集群对外呈现的地址可以将服务访问请求路由到该服务器集群即可，服务器集群内部的负载均衡的实现方式可以采用现有技术中的各种方案。
物理服务器103接收到来自虚拟机的服务访问请求时，处理所述服务访问请求，并返回服务访问响应。示例性的，所述服务访问请求可以是虚拟机发起的数据库查询请求，用于向物理服务器103上部署的数据库服务查询数据，所述数据库查询请求可以携带查询条件，当 所述数据库查询请求路由到所述物理服务器103时，所述物理服务器103根据所述查询条件产生查询结果，并在服务访问响应中携带查询结果，返回所述服务访问响应给虚拟机。需要说明的是，本发明实施例并不限定服务访问请求的类型和目的，也不限定物理服务器103处理所述服务访问请求的具体方法，现有技术中常见的各种服务访问请求在本发明实施例中均适用，现有技术中公开的物理服务器处理服务访问请求的各种方法也可以在本发明实施例中被直接引用。
接入网元105：具体可以为在主机101上运行的虚拟网元(例如，Open vSwitch)或者主机的架顶交换机(Top Of Rack，TOR)，接入网元105与虚拟机相连,且向虚拟机提供网络接入能力。接入网元105,可以如图1A所示的,位于主机101的虚拟化层中；也可以如图1B所示,为与主机101物理相连的架顶交换机，架顶交换机是独立的硬件设备，在具体的应用场景中，主机可以独享一个架顶交换机、多个主机可以共享一个架顶交换机或者多个主机共享多个架顶交换机，本发明实施例对此并不进行限定。
在接入网元上配置与虚拟机关联的NAT规则，所述NAT规则包括与所述服务对应的发布IP地址和发布端口与所述物理服务器的IP地址和端口的对应关系。进一步的，所述NAT规则可以同时针对出VM方向和入VM方向。需要说明的是，在本发明各实施例中，所述物理服务器的IP地址和端口为物理服务器的真实IP地址和端口，以区别于服务对应的发布IP地址和发布端口。
在一种可能的实现方式中，NAT规则可以采用Linux系统中的Iptables，或者由SDN控制器下发的流表来实现，本发明实施例对具体的实现方式并不进行限定。
一种典型的场景中，云平台厂商的IAAS层上的的VM通过网络访问PM上运行的PAAS服务，当IAAS和PAAS分别由不同厂商提供时，针对PM上运行的PAAS服务，可以实现IAAS和PAAS解耦，有利于IAAS和PAAS的快速集成。
本发明实施例提出的虚拟机访问物理服务器的方法，能够使得物理服务器的真实地址对虚拟机不可见，进而屏蔽虚拟机对物理服务器的网络攻击，提高了云计算系统的安全性；针对不同用户，物理服务器对外呈现相同的外部显示地址，本发明实施例进而可以为不同的用户提供相同的访问方式访问物理服务器运行的服务，实现访问地址归一化，提高了云平台发布物理服务器上部署的新服务的效率。
在一种可能的实施方式中，云平台可以控制物理服务器的部署。在物理服务器上运行服务后，云平台发布物理服务器上运行的服务的信息。用户可以通过云平台提供的服务呈现界面查看发布的服务，并发起服务申请，云平台对用户的服务申请进行审批，，如果审批通过，则向用户返回授权信息，所述授权信息可以包括用户标识、虚拟机标识、权限以及分配给所述用户的账号和密码等。云平台中记录有用户的信息，包括用户使用的各个虚拟机的信息。云平台可以以用户为粒度授权用户访问物理服务器上的服务，此时，用户的各个虚拟机均可以访问所述服务器；云平台也可以以虚拟机为粒度授权用户访问物理服务器上的服务，即云平台授权用户通过特定的虚拟机访问服务。通过上述方式，云平台可以确定得到授权的虚拟机的清单，云平台向获得授权的各个虚拟机连接的接入网元下发上述NAT规则，通过NAT规则实现将服务的外部显示地址转化为物理服务器的真实IP地址和端口，从而使得用户的虚拟机接入到物理服务器的服务。上述接入网元可以为虚拟机的挂载网元或者隧道封装网元。
图1A和图1B中所示的云计算系统中的云平台、主机、部署服务的物理服务器以及接入网元可以采用硬件/软件实现，示例性的，如图2所示，为本发明实施例提供的计算机设备硬件结构示意图。计算机设备200包括至少一个处理器201，通信总线202，存储器203以及至少一个通信接口204。
处理器201可以是一个通用中央处理器(CPU)或微处理器，执行存储器203中的指令以实现上述各设备的功能。
通信总线202可包括一通路，在上述组件之间传送信息。所述通信接口304，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。
存储器203可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。
其中，所述存储器203用于存储执行本发明方案的应用程序代码，并由处理器201来控制执行。所述处理器201用于执行所述存储器203中存储的应用程序代码。
在具体实现中，作为一种实施例，处理器201可以包括一个或多个CPU，例如图2中的CPU0和CPU1。
在具体实现中，作为一种实施例，计算机设备200可以包括多个处理器，例如图2中的处理器201和处理器208。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，计算机设备200还可以包括输出设备205和输入设备206。输出设备205和处理器201通信，可以以多种方式来显示信息。例如，输出设备205可以是液晶显示器(liquid crystal display，LCD),发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备206和处理器201通信，可以以多种方式接受用户的输入。例如，输入设备206可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的计算机设备200可以是一个通用计算机设备或者是一个专用计算机设备。在具体实现中，计算机设备200可以是台式机、便携式电脑、网络服务器、掌上电脑(Personal Digital Assistant，PDA)、移动手机、平板电脑、无线终端设备、通信设备、嵌入式设备或有图2中类似结构的设备。本发明实施例不限定计算机设备200的类型。
图1A和图1B中的云平台、主机、部署服务的物理服务器以及接入网元可以为图2所示的设备，存储器中存储了一个或多个软件模块，用于实现云平台、主机、部署服务的物理服务器以及接入网元的功能(例如：NAT转换功能等)。云平台、主机、部署服务的物理服务器以及接入网元可以通过处理器以及存储器中的程序代码来实现虚拟机访问物理服务器上部署的服务的方法。
需要说明的是，图2所示的计算机设备仅仅是给出了云计算系统中各部分的可能的硬件实现方式，根据系统各部分功能的不同或者变化，可以对计算机设备的硬件组件进行增删，以使得与系统各部分的功能进行匹配。
如图3所述，为本发明实施例提供的主机上的虚拟化结构示意图。主机为一台物理服务器，该主机的底层为硬件层，硬件层主要包括中央处理器(CPU，Central Processing Unit)、内存、硬盘以及物理网卡等硬件资源。服务器虚拟化是在物理服务器上借助虚拟化软件(如 VMWare ESX、Citrix XEN)实现多个虚拟机(Virtual Machine，VM)的虚拟化运行环境。安装在服务器上实现虚拟化环境的软件层被称为虚拟机监控器(Virtual Machine Monitor)，VMM。运行在硬件层之上的VMM承担对硬件层中的硬件资源进行调度、分配和管理工作。VMM之上运行多个虚拟机VM，VMM为每个虚拟机提供虚拟化的CPU、内存、存储、IO设备(如物理网卡)以及以太网交换机等硬件环境，保证多个虚拟机相互隔离运行。
在虚拟化运行环境中，VMM为每个虚拟机创建一个虚拟网卡(Virtual Network Interface Card，vNIC)，虚拟交换机vSwitch提供了虚拟机之间，以及虚拟机与外部网络之间的通讯能力。对于在VMM中运行的vSwitch，每个虚拟机的虚拟网卡对应到vSwitch的一个虚拟端口上，主机的物理网卡对应于vSwitch与外部架顶交换机相连的端口。图3中的虚线表示虚拟网络中的逻辑连接，实线表示物理连接。
一种可能的设计中，上述接入网元的功能由虚拟交换机(vSwitch)实现，云平台将虚拟机的NAT规则发送给虚拟交换机，虚拟交换机在与所述虚拟机相连的虚拟端口上配置所述NAT规则，当虚拟机交换机接收到来自虚拟机的服务访问请求时，使用所述NAT规则将所述服务访问请求的目的地址修改为与所述服务对应的发布IP地址和发布端口，从而将报文访问请求路由到部署了该服务的物理服务器。
在另一种可能的设计中，上述接入网元的功能由与主机相连的架顶交换机实现，云平台将虚拟机的NAT规则发生给架顶交换机，在架顶交换机上配置所述虚拟机的NAT规则，当架顶交换机收到来自虚拟机的服务访问请求时，使用所述NAT规则将所述服务访问请求的目的地址修改为与所述服务对应的发布IP地址和发布端口，从而将报文访问请求路由到部署了该服务的物理服务器。
需要说明的是，无论所述NAT规则是配置在主机上的虚拟网元还是在架顶交换机上，均实现相同的功能，即针对物理服务器的地址进行NAT转换，在出VM的方向上，将报文的目的地址修改为与所述服务对应的发布IP地址和发布端口，在入VM的方向上，将报文的源地址修改为与所述服务对应的发布IP地址和发布端口。报文在主机和物理服务器之间的路由流程按照现有的标准定义方式进行，本发明实施例并不进行限定，只要可以根据所述发布IP地址和发布端口将报文路由到物理服务器即可。
结合图1A和图1B所示的系统架构，如图4所示，为本发明实施例提供的虚拟机访问物理服务器的报文转发处理流程，包括：
步骤401：物理服务器上运行的服务的外部显示地址对虚拟机可见，虚拟机向物理服务器发送服务访问请求，所述服务访问请求的目的地址为与所述服务对应的发布IP地址和发布端口。
在一种可能的实施场景中，所述外部显示地址包括发布IP地址和发布端口，发布IP地址和发布端口可以唯一标识所述物理服务器运行的服务；
在另一种可能的实施场景中，所述外部显示地址为域名，所述域名可以唯一标识所述物理服务器运行的服务。虚拟机对所述域名发起域名解析操作，获取所述物理服务器运行的服务对应的发布IP地址和发布端口。
虚拟机在获取所述物理服务器运行的服务对应的发布IP地址和发布端口后，以所述发布IP地址和发布端口为目的地址发起所述服务访问请求。
步骤402：接入网元接收所述服务访问请求，根据NAT规则，将所述请求报文携带的目的地址替换为运行所述服务的物理服务器的IP地址和端口，所述NAT规则包括运行所述服务的物理服务器的IP地址和端口与所述服务对应的发布IP地址和发布端口的对应关系。
在一种可能的设计中，所述NAT规则具体可以为所述云平台中的SDN控制器下发的流表。
步骤403：经过NAT转换后的服务访问请求经过网络路由到运行所述服务的物理服务器。
步骤404：所述物理服务器接收所述虚拟机的服务访问请求，向所述虚拟机返回服务响应报文。
一方面，物理服务器发出的所述服务响应报文的源地址可以为与所述服务对应的发布IP地址和发布端口，当所述接入网元接收到所述服务响应报文时，无需对所述服务响应报文的源地址进行NAT转换，即可保证虚拟机无法获得物理服务器真实的地址。需要说明的是，物理服务器需要进行修改以记录与所述服务对应的发布IP地址和发布端口，并在返回的响应报文中将源地址设定为所述发布IP地址和发布端口，上述修改虽然会降低给物理服务器的部署效率，但由于接入网元接收到服务响应报文后无需替换服务响应报文的源地址，因此可以提高虚拟机访问物理服务器上的服务的效率。
另一方面，物理服务器发出的所述服务响应报文的源地址可以为所述物理服务器的真实IP地址和端口，所述服务响应报文经过经过网络路由到所述接入网元，所述接入网元根据所述NAT规则，将所述服务响应报文的源地址替换为与所述服务对应的所述发布IP地址和发布端口，将所述服务响应报文返回给所述虚拟机。经过上述处理流程，可以在不对物理服务 器进行修改的前提下，保证虚拟机无法获取物理服务器真实的地址。
经过上述服务访问流程，虚拟机即可访问运行服务的物理服务器。同一服务具备同一外部显示地址，从而统一了虚拟机的访问方式。同时，物理服务器的真实地址对虚拟机不可见，保障了物理服务器的网络安全。
当虚拟机所属的用户申请终止服务或欠费导致服务终止，云平台删除记录的用户的授权信息，终止服务授权，并通知虚拟机连接的接入网元删除与所述用户关联的NAT规则。
进一步的，在虚拟机迁移场景下，当虚拟机从主机1迁移到主机2时，虚拟机对应的NAT规则也同时动态迁移，具体可以通过迁移工具实现动态迁移或者通过SDN控制器动态下发openflow流表等方式实现，从而保证了虚拟机迁移时可以持续访问物理服务器上的服务。在一种可能的设计中，虚拟机迁移前的接入网元与迁移后的接入网元建立连接，并将虚拟机对应的NAT规则发送到虚拟机迁移后的接入网元；在另一种可能的设计中，SDN控制器获取虚拟机迁移后的接入网元的地址，将NAT规则以流表的形式下发到迁移后的接入网元，保证虚拟机在迁移后可以正常访问服务。为了保证迁移过程中，虚拟机访问服务不中断，可以使用Conntrackd等工具将虚拟机的状态信息传递到主机2。
需要说明的是，运行服务的物理服务器可以是单台物理服务器，也可以是具备高可用性的物理服务器集群，服务器集群可以基于现有工具或者协议根据服务的性能需要来实现，本发明实施例并不进行限定。当物理服务器为服务器集群时，具体可以为共享服务集群或者单实例服务集群，所述共享服务集群提供基于用户访问权限彼此隔离服务的物理服务器的集群，所述单实例服务集群提供基于用户访问权限彼此无法隔离服务的物理服务器的集群。针对前述的不同的物理服务器集群，本发明实施例提供的服务访问方法均适用。
图5对应的实施例给出了虚拟机访问物理服务器上运行的服务的流程示意图，包括服务部署阶段、服务申请阶段、服务接入阶段。
云服务部署阶段：
步骤501：物理服务器上线后，在物理服务器上部署提供给虚拟机的一项或多项服务。
上述服务可以部署在单台物理服务器，也可以是部署在具备高可用性的物理服务器集群上。云平台管理员通过管理呈现界面对物理服务器进行配置以及在物理服务器上部署服务，具体流程可以采用现有方案，本发明实施例对此并不进行限定。
步骤502：云平台记录运行所述服务的物理服务器的IP地址和端口。
当上述服务部署在单台物理服务器上时，虚拟机访问所述单台物理服务器以接入上述服务；当上述服务部署在物理服务器集群上时，云平台记录的运行所述服务的物理服务器的IP地址和端口为物理服务器集群对外呈现的IP地址和端口。例如，当集群为主备模式时，主备物理服务器具备相同的IP地址和端口，该相同的IP地址和端口即为物理服务器集群对外呈现的地址；或者，当多个物理服务器组成一个集群，对外呈现集群中主节点的虚拟IP地址和虚拟端口作为物理服务器集群对外呈现的地址。
需要说明的是，不同服务的端口不同，当多项服务部署在同一物理服务器上时，可以通过端口区分不同的服务。
步骤503：云平台为所述服务分配外部显示地址，所述外部显示地址可以唯一标识所述服务。在一种可能的实现场景中，所述外部显示地址包括发布IP地址和发布端口；在另一种可能的实现场景中，所述外部显示地址为与所述服务对应的域名，所述云平台为所述服务分配发布IP地址和发布端口，建立所述域名与所述发布IP地址和发布端口的映射关系。
在一种可能的设计中，云平台记录有物理服务器的IP地址和端口、物理服务器运行的服务的标识，以及与所述服务对应的发布IP地址和发布端口三者之间的关联关系，更进一步的，当外部显示地址为与服务对应的域名时，所述关联关系还可以包括与服务对应的域名。
步骤504：服务部署完成后，云平台对外发布服务信息，所述服务信息包括服务的外部显示地址。
服务申请阶段
步骤505：用户查询云平台提供的服务，并向云平台发起服务申请请求。
云平台的服务呈现界面对用户可见，用户通过所述虚拟机登录上述服务呈现界面，查询服务信息，并向云平台发起服务申请请求，所述服务申请请求可以携带待申请的服务的标识、用户标识以及虚拟机标识等等。需要说明的是，本发明实施例对服务申请请求携带的内容并不进行限定，只要云平台可以从服务申请请求中获取执行服务审批所需的信息即可。
步骤506：云平台审批上述服务申请请求，审批通过后，记录用户的授权信息，所述授权信息包括用户标识、虚拟机标识、权限以及分配给所述用户的账号和密码等等。
云平台接收到用户的服务申请后，可以自动审批或由管理员手动审批，对于审批不通过 的服务申请，向所述虚拟机返回失败原因。当所述服务申请请求审批通过后，云平台将授权信息返回给所述虚拟机。
需要说明的是，服务授权可以是用户粒度的，即当用户的服务申请请求审批通过后，归属于该用户的所有虚拟机均可以访问该服务，此时授权信息可以不包含虚拟机标识；服务授权可以是虚拟机粒度的，即限定用户仅可以通过获得审批的虚拟机访问服务，此时，授权信息可以不包含用户标识。授权信息中的权限是指用户访问服务的操作权限，例如，可以通过所述授权信息中的权限限定用户仅具备数据库服务的查询权限，或者，授予用户针对数据库服务的更新权限。
步骤507：云平台向虚拟机返回服务申请响应，当来自所述虚拟机的服务申请请求审批通过时，所述服务申请响应包括所述服务的外部显示地址，以及所述授权信息等等。
步骤508：云平台向所述虚拟机的接入网元下发NAT规则，所述NAT规则包括运行所述服务的物理服务器的IP地址和端口与所述服务对应的发布IP地址和发布端口的对应关系。
步骤509：所述虚拟机的接入网元接收并记录所述NAT规则，用于后续数据包的处理。
服务访问阶段
步骤510：虚拟机发送服务访问请求，所述服务访问请求的目的地址为与所述服务对应的发布IP地址和发布端口。
需要说明的是，服务的外部显示地址可以为域名。服务部署完成后，云平台可以通过注册流程，将所述域名与所述服务对应的所述发布IP地址和发布端口的对应关系发送到所述域名系统DNS服务器；所述虚拟机用于发起域名解析操作，根据所述域名从所述DNS服务器获取与所述服务对应的所述发布IP地址和发布端口。所述DNS服务器为所述云计算系统的内部DNS服务器。
步骤511：接入网元接收所述服务访问请求，根据NAT规则，将所述服务访问请求的目的地址替换为运行所述服务的物理服务器的IP地址和端口，所述NAT规则包括运行所述服务的物理服务器的IP地址和端口与所述服务对应的发布IP地址和发布端口的对应关系。
步骤512：NAT转换后的服务访问请求经过网络路由到运行所述服务的物理服务器。
步骤513：所述物理服务器接收所述虚拟机的服务访问请求，返回服务响应报文，所述服务响应报文的源地址为所述物理服务器的IP地址和端口。
步骤514：所述服务响应报文经过经过网络路由到所述接入网元。
步骤515：所述接入网元根据所述NAT规则，将所述服务响应报文的源地址替换为与所述服务对应的所述发布IP地址和发布端口，将所述服务响应报文返回给所述虚拟机。
本发明实施例提供的虚拟机访问物理服务器的方法，可以对虚拟机屏蔽部署服务的物理服务器的真实IP地址，同时向虚拟机提供统一的访问方式，既保证了云平台的网络安全，又提高了用户访问服务的便利性。进一步的，针对同一服务配置相同访问方式，降低了物理服务器上部署和运维管理服务的复杂度，而且用户无需关注物理服务器提供服务的上线、运维、升级和高可用等功能；上述服务访问流程中无需使用Vxlan等隧道技术，传输效率更高；由各个虚拟机连接的接入网元执行NAT规则,提高了海量用户安全访问PAAS服务的并发处理效率。
需要说明的是，用户可以登录到云平台提供的服务呈现界面，查看服务信息，发起服务申请。云平台可以对来自虚拟机的服务申请进行鉴权，具体的鉴权方式可以为账号密码的方式或者其他方式，本发明实施例对此并不进行限定。
云平台可以以用户、虚拟机或主机的粒度控制虚拟机对服务的访问，例如，云平台对用户进行服务授权，归属于所述用户的虚拟机均可以访问服务；或者，云平台针对虚拟机进行服务访问授权，每个虚拟机以不同的IP接入物理服务器的服务；或者，一个主机上的多个虚拟机共享IP，对云平台呈现为相同IP地址接入到物理服务器的服务，此时，可以通过不用的报文端口来区分同一主机上的多个虚拟机。
进一步的，云平台还可以终止虚拟机的服务访问授权，服务访问授权的终止可以是用户主动发起终止申请或者云平台判断用户欠费等原因引起的。云平台向虚拟机所在的接入网元下发删除消息，用于删除所述接入网元上记录的所述虚拟机的NAT规则，删除云平台中记录的用户信息，停止对用户的访问授权。云平台可以保留将用户的数据保存一定的时间，并为用户提供的数据拷贝服务，在合理时间段的有效期内，用户可以选择续费并继续使用该PM提供的服务。
与前述图1A和图1B所示的云计算系统以及图4、5所示的访问流程相对应，如图6所示，为本发明实施例提供的一种云平台的结构示意图，包括：处理单元601、发布单元602、接收单元603以及发送单元604，
所述处理单元601，用于为服务分配与所述服务对应的发布IP地址和发布端口，记录所述发布IP地址和发布端口与运行所述服务的物理服务器的IP地址和端口的对应关系；
所述发布单元602，用于发布所述服务；
所述接收单元603，用于接收虚拟机发送的服务申请请求；
所述发送单元604，用于向所述虚拟机的接入网元发送NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，其中，所述虚拟机通过所述接入网元接入到云计算系统的网络。
进一步的，云平台通过上述发布单元对外发布服务信息具体为：
所述发布单元602，具体用于向所述虚拟机提供服务呈现界面，显示服务信息，所述服务信息包括所述服务的外部显示地址。
所述外部显示地址包括所述服务对应的域名，或者与所述服务对应的发布IP地址和发布端口。所述外部显示地址可以唯一标识所述服务。
更进一步的，云计算系统中还包括DNS服务器，所述DNS服务器为所述云计算系统的内部使用的DNS服务器，运行所述虚拟机的主机、云平台、DNS服务器通过网络相连，云平台完成服务部署后，当所述服务的外部显示地址为与所述服务对应的域名时，所述发送单元604，还用于向域名系统DNS服务器下发所述域名与所述发布IP地址和发布端口的对应关系。
所述发送单元604，还用于向所述虚拟机返回服务申请响应，所述服务申请响应携带所述外部显示地址。
所述处理单元601，还用于记录所述虚拟机所属的用户的授权信息，所述用户的授权信息包括用户标识、虚拟机标识以及分配给所述用户的账号和密码。
所述接收单元603，还用于接收虚拟机创建请求；
所述处理单元601，还用于根据所述虚拟机创建请求为所述用户创建另一虚拟机；
所述发送单元604，还用于在所述另一虚拟机创建完成后，向所述另一虚拟机连接的接入网元下发所述NAT规则。
所述处理单元601，还用于终止对所述虚拟机的服务授权；
所述发送单元604，还用于向所述接入网元发送删除消息，通知所述接入网元删除所述虚拟机的NAT规则。
如图7A和7B所示，为本发明实施例提供的一种接入装置，实现前述系统中的接入网元的功能，所述接入装置包括：
客户端发送单元701，用于向云平台转发虚拟机的服务申请请求；
客户端接收单元702，用于接收云平台在对所述服务申请请求审批通过后返回的虚拟机的NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，其中，所述虚拟机通过所述接入网元接入到云计算系统的网络；
所述客户端发送单元701，还用于接收所述虚拟机发送的服务访问请求，所述服务访问请求的目的地址为与所述服务对应的所述发布IP地址和发布端口；
客户端处理单元703，用于根据所述NAT规则，将所述服务访问请求的目的地址替换为所述物理服务器的IP地址和端口；
所述客户端发送单元701，还用于将修改后的服务访问请求路由到所述物理服务器；
所述客户端接收单元702，用于接收所述物理服务器返回的服务响应消息。
进一步的，所述客户端处理单元703，还用于根据所述NAT规则将所述服务响应消息的源地址替换为与所述服务对应的所述发布IP地址和发布端口；
所述客户端发送单元702，还用于将修改后的服务响应消息发送给所述虚拟机。
如图7A所示，所述接入装置可以为前述系统中所述主机上的功能部件，主机上的中央处理器运行指令实现接入装置的上述功能；如图7B所示，所述接入装置可以为前述系统中所述的架顶交换机，所述架顶交换机可以为与所述主机独立的物理设备，在另一种可能的设计中，架顶交换机可以为所述主机中的一个物理部件。前述云平台以及接入装置可以采用如图2所示的计算机设备实现。
本发明实施例还提供了一种计算机存储介质，用于储存为上述图6和7所示的设备所用的计算机软件指令，其包含用于执行上述方法实施例所设计的程序。通过执行存储的程序，可以实现虚拟机访问物理服务器上部署的服务的方法。
综上所述，本发明实施例提供的虚拟机访问物理服务器的方法，装置和系统，可以对虚拟机屏蔽部署服务的物理服务器的真实IP地址，同时向虚拟机提供统一的访问方式，既保证了云平台的网络安全，又提高了用户访问服务的便利性。进一步的，针对同一服务配置相同访问方式，降低了物理服务器上部署和运维管理服务的复杂度，而且用户无需关注物理服 务器提供服务的上线、运维、升级和高可用等功能；虚拟机对物理服务器的访问不使用Vxlan等隧道技术，传输效率更高；由各个虚拟机连接的接入网元执行NAT规则,提高了海量用户安全访问PAAS服务的并发处理效率。
尽管在此结合各实施例对本发明进行了描述，然而，在实施所要求保护的本发明过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
本领域技术人员应明白，本发明的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。计算机程序存储/分布在合适的介质中，与其它硬件一起提供或作为硬件的一部分，也可以采用其他分布形式，如通过Internet或其它有线或无线电信系统。
本发明是参照本发明实施例的方法、装置(设备)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本发明进行了描述，显而易见的，在不脱离本发明的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本发明的示例性说明，且视为已覆盖本发明范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (22)

  1. 一种云计算系统，其特征在于，所述系统包括云平台、至少一个物理服务器、至少一个主机以及至少一个接入网元，所述主机、所述物理服务器以及所述云平台相互通信，所述主机上运行有至少一个虚拟机，所述虚拟机通过所述接入网元访问所述物理服务器，所述物理服务器上部署有服务，
    所述云平台用于为所述服务分配与所述服务对应的发布IP地址和发布端口，记录所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，发布所述服务；
    所述云平台还用于接收所述虚拟机发送的服务申请请求，向所述接入网元发送NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系；
    所述接入网元用于接收所述虚拟机发送的服务访问请求，所述服务访问请求的目的地址为与所述服务对应的所述发布IP地址和发布端口；
    所述接入网元还用于根据所述NAT规则，将所述服务访问请求的目的地址替换为所述物理服务器的IP地址和端口，将修改后的服务访问请求路由到所述物理服务器，并接收所述物理服务器返回的服务响应消息。
  2. 如权利要求1所述的系统，其特征在于，
    所述服务响应消息的源地址为所述物理服务器的IP地址和端口，
    所述接入网元还用于根据所述NAT规则将所述服务响应消息的源地址替换为与所述服务对应的所述发布IP地址和发布端口，将修改后的服务响应消息发送给所述虚拟机。
  3. 如权利要求1或2所述的系统，其特征在于，
    所述云平台还用于向所述虚拟机提供服务呈现界面，显示服务信息，所述服务信息包括所述服务的外部显示地址。
  4. 如权利要求3所述的系统，其特征在于，
    所述外部显示地址包括所述服务对应的域名，或者与所述服务对应的发布IP地址和发布端口。
  5. 如权利要求4所述的系统，其特征在于，
    当所述服务的外部显示地址为与所述服务对应的域名时，所述云平台还用于向域名系统DNS服务器下发所述域名与所述发布IP地址和发布端口的对应关系；所述虚拟机用于发起域名解析操作，根据所述域名从所述DNS服务器获取与所述服务对应的所述发布IP地址和发布端口。
  6. 如权利要求3-5任一所述的系统，其特征在于，
    所述云平台还用于向所述虚拟机返回服务申请响应，所述服务申请响应携带所述外部显示地址。
  7. 如权利要求6所述的系统，其特征在于，
    所述云平台还用于记录所述虚拟机所属的用户的授权信息，所述用户的授权信息包括用户标识、虚拟机标识以及分配给所述用户的账号和密码。
  8. 如权利要求7所述的系统，其特征在于，
    所述云平台还用于接收虚拟机创建请求，为所述用户创建另一虚拟机，向所述另一虚拟机连接的接入网元下发所述NAT规则。
  9. 如权利要求1-8任一所述的系统，其特征在于，
    云平台还用于终止对所述虚拟机服务授权，向所述接入网元发送删除消息，通知所述接入网元删除所述虚拟机的NAT规则。
  10. 一种云计算系统中虚拟机访问物理服务器的方法，其特征在于，包括：
    云平台为服务分配与所述服务对应的发布IP地址和发布端口，记录所述发布IP地址和发布端口与运行所述服务的物理服务器的IP地址和端口的对应关系，发布所述服务；
    所述云平台接收虚拟机发送的服务申请请求，向所述虚拟机的接入网元发送NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，其中，所述虚拟机通过所述接入网元接入到云计算系统的网络；
    所述接入网元接收所述虚拟机发送的服务访问请求，所述服务访问请求的目的地址为与所述服务对应的所述发布IP地址和发布端口；
    所述接入网元根据所述NAT规则，将所述服务访问请求的目的地址替换为所述物理服务器的IP地址和端口，将修改后的服务访问请求路由到所述物理服务器；
    所述接入网元接收所述物理服务器返回的服务响应消息，将所述服务响应消息发送给所 述虚拟机。
  11. 如权利要求10所述的方法，其特征在于，所述云平台发布所述服务包括：
    所述云平台向所述虚拟机提供服务呈现界面，显示服务信息，所述服务信息包括所述服务的外部显示地址。
  12. 如权利要求11所述的方法，其特征在于，所述外部显示地址包括所述服务对应的域名，或者与所述服务对应的发布IP地址和发布端口。
  13. 如权利要求12所述的方法，其特征在于，当所述服务的外部显示地址为与所述服务对应的域名时，在所述云平台接收虚拟机发送的服务申请请求之前，所述方法还包括：
    所述云平台向域名系统DNS服务器下发所述域名与所述发布IP地址和发布端口的对应关系，以使得所述虚拟机发起域名解析操作时，根据所述域名从所述DNS服务器获取与所述服务对应的所述发布IP地址和发布端口。
  14. 如权利要求11-13任一所述的方法，其特征在于，所述云平台接收所述虚拟机发送的服务申请请求后，所述方法还包括：
    所述云平台向所述虚拟机返回服务申请响应，所述服务申请响应携带所述外部显示地址。
  15. 如权利要求14所述的方法，其特征在于，在对所述服务申请请求审批通过后，所述方法还包括：
    所述云平台记录所述虚拟机所属的用户的授权信息，所述用户的授权信息包括用户标识、虚拟机标识以及分配给所述用户的账号和密码。
  16. 如权利要求15所述的方法，其特征在于，所述方法还包括：
    所述云平台接收虚拟机创建请求，为所述用户创建另一虚拟机，向所述另一虚拟机连接的接入网元下发所述NAT规则。
  17. 如权利要求10-16任一所述的方法，其特征在于，所述方法还包括：
    所述云平台终止对所述虚拟机的服务授权，向所述接入网元发送删除消息，通知所述接入网元删除所述虚拟机的NAT规则。
  18. 一种云计算系统中虚拟机访问物理服务器的方法，其特征在于，包括：
    接入网元向云平台转发虚拟机的服务申请请求；
    接入网元接收云平台在对所述服务申请请求审批通过后返回的虚拟机的NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，其中，所述虚拟机通过所述接入网元接入到云计算系统的网络；
    所述接入网元接收所述虚拟机发送的服务访问请求，所述服务访问请求的目的地址为与所述服务对应的所述发布IP地址和发布端口；
    所述接入网元根据所述NAT规则，将所述服务访问请求的目的地址替换为所述物理服务器的IP地址和端口，将修改后的服务访问请求路由到所述物理服务器，并接收所述物理服务器返回的服务响应消息。
  19. 如权利要求18所述的方法，其特征在于，所述服务响应消息的源地址为所述物理服务器的IP地址和端口，所述方法还包括：
    所述接入网元根据所述NAT规则将所述服务响应消息的源地址替换为与所述服务对应的所述发布IP地址和发布端口，将修改后的服务响应消息发送给所述虚拟机。
  20. 一种接入装置，其特征在于，包括：
    客户端发送单元，用于向云平台转发虚拟机的服务申请请求；
    客户端接收单元，用于接收云平台在对所述服务申请请求审批通过后返回的虚拟机的NAT规则，所述NAT规则包括所述发布IP地址和发布端口与运行所述服务的所述物理服务器的IP地址和端口的对应关系，其中，所述虚拟机通过所述接入网元接入到云计算系统的网络；
    所述客户端发送单元，还用于接收所述虚拟机发送的服务访问请求，所述服务访问请求的目的地址为与所述服务对应的所述发布IP地址和发布端口；
    客户端处理单元，用于根据所述NAT规则，将所述服务访问请求的目的地址替换为所述物理服务器的IP地址和端口；
    所述客户端发送单元，还用于将修改后的服务访问请求路由到所述物理服务器；
    所述客户端接收单元，用于接收所述物理服务器返回的服务响应消息。
  21. 如权利要求20所述的接入装置，其特征在于，
    所述客户端处理单元，还用于根据所述NAT规则将所述服务响应消息的源地址替换为与所述服务对应的所述发布IP地址和发布端口；
    所述客户端发送单元，还用于将修改后的服务响应消息发送给所述虚拟机。
  22. 一种计算机，其特征在于，包括处理器、存储器以及系统总线，所述存储器中存储有指令，所述处理器执行所述存储器中的指令以执行如权利要求10-19任一所述的方法。
PCT/CN2016/094225 2016-08-09 2016-08-09 云计算系统中虚拟机访问物理服务器的方法、装置和系统 WO2018027586A1 (zh)

Priority Applications (8)

Application Number Priority Date Filing Date Title
CN202110098217.0A CN112995272A (zh) 2016-08-09 2016-08-09 云计算系统中虚拟机访问物理服务器的方法、装置和系统
EP16912041.7A EP3493510B1 (en) 2016-08-09 2016-08-09 Method, device and system for virtual machine to access physical server in cloud computing system
CN201680086943.8A CN109314724B (zh) 2016-08-09 2016-08-09 云计算系统中虚拟机访问物理服务器的方法、装置和系统
PCT/CN2016/094225 WO2018027586A1 (zh) 2016-08-09 2016-08-09 云计算系统中虚拟机访问物理服务器的方法、装置和系统
CA3033217A CA3033217C (en) 2016-08-09 2016-08-09 Method for virtual machine to access physical server in cloud computing system, apparatus, and system
JP2019507139A JP6771650B2 (ja) 2016-08-09 2016-08-09 クラウドコンピューティングシステムにおいて仮想マシンが物理サーバにアクセスするための方法、装置、およびシステム
US16/262,872 US10659471B2 (en) 2016-08-09 2019-01-30 Method for virtual machine to access physical server in cloud computing system, apparatus, and system
US15/931,217 US11418512B2 (en) 2016-08-09 2020-05-13 Method for virtual machine to access physical server in cloud computing system, apparatus, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/094225 WO2018027586A1 (zh) 2016-08-09 2016-08-09 云计算系统中虚拟机访问物理服务器的方法、装置和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/262,872 Continuation US10659471B2 (en) 2016-08-09 2019-01-30 Method for virtual machine to access physical server in cloud computing system, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2018027586A1 true WO2018027586A1 (zh) 2018-02-15

Family

ID=61161254

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/094225 WO2018027586A1 (zh) 2016-08-09 2016-08-09 云计算系统中虚拟机访问物理服务器的方法、装置和系统

Country Status (6)

Country Link
US (2) US10659471B2 (zh)
EP (1) EP3493510B1 (zh)
JP (1) JP6771650B2 (zh)
CN (2) CN109314724B (zh)
CA (1) CA3033217C (zh)
WO (1) WO2018027586A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110535964A (zh) * 2019-09-03 2019-12-03 北京首都在线科技股份有限公司 基于Paas连接器实现的数据处理方法及装置
CN111416792A (zh) * 2019-01-08 2020-07-14 杭州海康威视数字技术股份有限公司 嵌入式设备的内部免认证方法以及嵌入式设备
CN115102720A (zh) * 2022-05-31 2022-09-23 苏州浪潮智能科技有限公司 虚拟机安全管理方法、系统和计算机设备
CN115914389A (zh) * 2021-08-09 2023-04-04 北京字节跳动网络技术有限公司 云服务控制系统、方法、装置、电子设备和存储介质

Families Citing this family (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11824863B2 (en) * 2016-11-03 2023-11-21 Nicira, Inc. Performing services on a host
US10412047B2 (en) 2017-08-17 2019-09-10 Arista Networks, Inc. Method and system for network traffic steering towards a service device
US10721651B2 (en) 2017-09-29 2020-07-21 Arista Networks, Inc. Method and system for steering bidirectional network traffic to a same service device
US11265310B2 (en) * 2017-10-19 2022-03-01 Microsoft Technology Licensing, Llc Isolating networks and credentials using on-demand port forwarding
US10764234B2 (en) * 2017-10-31 2020-09-01 Arista Networks, Inc. Method and system for host discovery and tracking in a network using associations between hosts and tunnel end points
US10917342B2 (en) 2018-09-26 2021-02-09 Arista Networks, Inc. Method and system for propagating network traffic flows between end points based on service and priority policies
US10855733B2 (en) 2018-12-04 2020-12-01 Arista Networks, Inc. Method and system for inspecting unicast network traffic between end points residing within a same zone
US10848457B2 (en) 2018-12-04 2020-11-24 Arista Networks, Inc. Method and system for cross-zone network traffic between different zones using virtual network identifiers and virtual layer-2 broadcast domains
US10749789B2 (en) 2018-12-04 2020-08-18 Arista Networks, Inc. Method and system for inspecting broadcast network traffic between end points residing within a same zone
CN110008005B (zh) * 2019-04-11 2023-07-18 中国南方电网有限责任公司 基于云平台的电网通信资源虚拟机迁移系统及方法
CN112306701B (zh) * 2019-07-25 2024-05-03 中移动信息技术有限公司 服务熔断方法、装置、设备及存储介质
CN112311837A (zh) * 2019-08-02 2021-02-02 上海擎感智能科技有限公司 基于云平台路由服务器的车机数据传输方法、系统及装置
CN110471683B (zh) * 2019-08-06 2023-11-24 上海浦东发展银行股份有限公司信用卡中心 一种基于智能dns的容器云应用蓝绿发布方法
CN110474981A (zh) * 2019-08-13 2019-11-19 中科天御(苏州)科技有限公司 一种软件定义动态安全存储方法及装置
CN110730252A (zh) * 2019-09-25 2020-01-24 南京优速网络科技有限公司 一种通过改造linux内核报文处理功能的地址转换方法
US11550608B2 (en) * 2019-10-31 2023-01-10 International Business Machines Corporation Guest-to-host virtual networking
CN111147550B (zh) * 2019-12-10 2022-06-21 华能集团技术创新中心有限公司 一种基于大数据电商平台的数据访问方法及装置
CN113472831B (zh) * 2020-03-31 2022-12-06 北京金山云网络技术有限公司 一种服务访问方法、装置、网关设备及存储介质
CN113301080B (zh) * 2020-06-09 2022-08-02 阿里巴巴集团控股有限公司 资源调用方法、设备、系统及存储介质
CN112003964B (zh) * 2020-08-27 2023-01-10 北京浪潮数据技术有限公司 一种基于多架构的ip地址的分配方法、装置和介质
EP3975502B1 (de) * 2020-09-28 2023-07-26 Siemens Aktiengesellschaft Verfahren und system zur bereitstellung von zeitkritischen diensten mittels einer ablaufsteuerungsumgebung
CN114650290A (zh) * 2020-12-17 2022-06-21 中移(苏州)软件技术有限公司 网络连通的方法、处理装置、终端及存储介质
CN113010897B (zh) * 2021-03-19 2023-06-13 中国联合网络通信集团有限公司 云计算安全管理方法及其系统
CN113489731B (zh) * 2021-07-12 2022-11-04 于洪 基于虚拟化网络的数据传输方法、系统和网络安全设备
CN113766044A (zh) * 2021-07-30 2021-12-07 广东浪潮智慧计算技术有限公司 一种域名解析方法及系统
CN113760452B (zh) * 2021-08-02 2023-09-26 阿里巴巴新加坡控股有限公司 一种容器调度方法、系统、设备及存储介质
CN114124948A (zh) * 2021-09-19 2022-03-01 济南浪潮数据技术有限公司 一种云端组件高可用的方法、装置、设备及可读介质
US20220014520A1 (en) * 2021-09-23 2022-01-13 Intel Corporation Controlled Network Sharing for Virtual Machines
CN114338382B (zh) * 2021-12-30 2023-11-14 北京天融信网络安全技术有限公司 基于域名的设备上线方法、装置及计算机设备、存储介质
US11799822B2 (en) 2022-01-21 2023-10-24 Google Llc Proxyless network address translation with dynamic port allocation
CN114915420B (zh) * 2022-03-03 2024-04-26 阿里巴巴（中国）有限公司 用于云桌面的通信方法及系统
CN115426324A (zh) * 2022-08-26 2022-12-02 绿盟科技集团股份有限公司 一种实体设备接入网络靶场的方法及装置
CN115529292A (zh) * 2022-10-11 2022-12-27 中国农业银行股份有限公司 访问请求处理方法、装置、设备、系统和存储介质
WO2023151354A2 (zh) * 2022-12-01 2023-08-17 黄建邦 数据传输方法、系统、第一端、中间网络设备及控制设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103326997A (zh) * 2012-03-23 2013-09-25 百度在线网络技术（北京）有限公司 一种访问虚拟服务器的方法及虚拟服务器系统
CN103733574A (zh) * 2011-08-16 2014-04-16 微软公司 虚拟化与非虚拟化网络之间的虚拟化网关
CN105227686A (zh) * 2014-06-20 2016-01-06 中国电信股份有限公司 云主机域名的动态配置方法和系统
CN105577723A (zh) * 2014-10-16 2016-05-11 杭州华三通信技术有限公司 虚拟化网络中实现负载分担的方法和装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1232080C (zh) * 2002-05-15 2005-12-14 华为技术有限公司 网络中节省ip地址提供内部服务器的方法
JP2004112018A (ja) * 2002-09-13 2004-04-08 Johnson Controls Inc インターネットアクセスＷｅｂ監視制御システム
US8489701B2 (en) * 2007-01-30 2013-07-16 Microsoft Corporation Private virtual LAN spanning a public network for connection of arbitrary hosts
US7840701B2 (en) * 2007-02-21 2010-11-23 Array Networks, Inc. Dynamic system and method for virtual private network (VPN) packet level routing using dual-NAT method
US8953592B2 (en) * 2012-09-28 2015-02-10 Juniper Networks, Inc. Network address translation for application of subscriber-aware services
WO2014079009A1 (zh) 2012-11-22 2014-05-30 华为技术有限公司 虚拟机的管理控制方法及装置、系统
JP5977706B2 (ja) * 2013-03-29 2016-08-24 株式会社日立ソリューションズ データ交換システム、及び仮想プライベートクラウド間でデータ交換を可能とする環境を設定する方法
CN103916314A (zh) * 2013-12-26 2014-07-09 杭州华为数字技术有限公司 报文转发控制方法和相关装置及物理主机
US9419937B2 (en) * 2014-01-29 2016-08-16 Vmware, Inc. System and method for dynamically configuring a DNS server in a virtual network environment
US9825854B2 (en) * 2014-03-27 2017-11-21 Nicira, Inc. Host architecture for efficient cloud service access
CN104753930B (zh) * 2015-03-17 2016-10-05 成都盛思睿信息技术有限公司 基于安全网关的云桌面管理系统及其安全访问控制方法
CN105306433B (zh) * 2015-09-10 2019-04-19 深信服科技股份有限公司 一种访问虚拟机服务器的方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103733574A (zh) * 2011-08-16 2014-04-16 微软公司 虚拟化与非虚拟化网络之间的虚拟化网关
CN103326997A (zh) * 2012-03-23 2013-09-25 百度在线网络技术（北京）有限公司 一种访问虚拟服务器的方法及虚拟服务器系统
CN105227686A (zh) * 2014-06-20 2016-01-06 中国电信股份有限公司 云主机域名的动态配置方法和系统
CN105577723A (zh) * 2014-10-16 2016-05-11 杭州华三通信技术有限公司 虚拟化网络中实现负载分担的方法和装置

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111416792A (zh) * 2019-01-08 2020-07-14 杭州海康威视数字技术股份有限公司 嵌入式设备的内部免认证方法以及嵌入式设备
CN110535964A (zh) * 2019-09-03 2019-12-03 北京首都在线科技股份有限公司 基于Paas连接器实现的数据处理方法及装置
CN110535964B (zh) * 2019-09-03 2021-12-14 北京首都在线科技股份有限公司 基于Paas连接器实现的数据处理方法及装置
CN115914389A (zh) * 2021-08-09 2023-04-04 北京字节跳动网络技术有限公司 云服务控制系统、方法、装置、电子设备和存储介质
CN115102720A (zh) * 2022-05-31 2022-09-23 苏州浪潮智能科技有限公司 虚拟机安全管理方法、系统和计算机设备
CN115102720B (zh) * 2022-05-31 2023-08-11 苏州浪潮智能科技有限公司 虚拟机安全管理方法、系统和计算机设备

Also Published As

Publication number Publication date
US20190173888A1 (en) 2019-06-06
CA3033217A1 (en) 2018-02-15
US20200274875A1 (en) 2020-08-27
EP3493510A1 (en) 2019-06-05
CN109314724B (zh) 2021-02-09
EP3493510A4 (en) 2019-07-31
US11418512B2 (en) 2022-08-16
JP2019528005A (ja) 2019-10-03
CN112995272A (zh) 2021-06-18
CA3033217C (en) 2021-09-28
CN109314724A (zh) 2019-02-05
EP3493510B1 (en) 2020-10-07
US10659471B2 (en) 2020-05-19
JP6771650B2 (ja) 2020-10-21

Similar Documents

Publication Publication Date Title
WO2018027586A1 (zh) 云计算系统中虚拟机访问物理服务器的方法、装置和系统
US10701139B2 (en) Life cycle management method and apparatus
US10785029B2 (en) Systems and methods for pairing on-premise clusters to clouds using identity service providers
US11469964B2 (en) Extension resource groups of provider network services
US8959310B2 (en) Dynamic network adapter memory resizing and bounding for virtual function translation entry storage
US8937940B2 (en) Optimized virtual function translation entry memory caching
US10397132B2 (en) System and method for granting virtualized network function life cycle management
US20130034094A1 (en) Virtual Switch Data Control In A Distributed Overlay Network
US20200159555A1 (en) Provider network service extensions
US11048543B2 (en) Computer system and resource access control method for securely controlling access using roles with a plurality of users
US10958654B1 (en) Resource deletion protection service
JP7212158B2 (ja) プロバイダネットワークサービス拡張
US11573719B2 (en) PMEM cache RDMA security

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16912041

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3033217

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2019507139

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2016912041

Country of ref document: EP

Effective date: 20190226