WO2024067338A1

WO2024067338A1 - Cloud networking system, secure access method, and device and storage medium

Info

Publication number: WO2024067338A1
Application number: PCT/CN2023/120291
Authority: WO
Inventors: 穆立超; 彭觅
Original assignee: 杭州阿里云飞天信息技术有限公司
Priority date: 2022-09-26
Filing date: 2023-09-21
Publication date: 2024-04-04
Also published as: CN115913617A

Abstract

Provided in the embodiments of the present application are a cloud networking system, a secure access method, and a device and a storage medium. In the embodiments of the present application, a security control VPC is introduced to a TR-based networking system, a GWLB is used in the security control VPC, and the GWLB is used as an exposed object for providing a security service to the outside; since the GWLB and a TR are not located in the same plane, a new product object, i.e., a GWLB attachment, is further added to the networking system to serve as a routing medium between the TR and the GWLB, thereby realizing the interconnection between the TR and the GWLB; and the TR is configured with security routing information which is directed towards the GWLB attachment by default, such that a security service can be provided while two client VPCs corresponding to the security routing information perform service access, thereby realizing secure mutual access, and solving the security problem when the client VPCs perform mutual access in a TR networking scenario. Furthermore, the present application also facilitates the simplification of access implementation of the security service in the TR networking scenario, and a traffic forwarding path is relatively short, thereby facilitating the reduction of a transmission delay on the path.

Description

Cloud networking system, secure access method, device and storage medium

This application claims priority to the Chinese patent application filed with the China Patent Office on September 26, 2022, with application number 202211177346.X and application name “Cloud Networking System, Secure Access Method, Device and Storage Medium”, all contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the field of cloud computing technology, and in particular to a cloud networking system, a secure access method, a device, and a storage medium.

Background technique

With the development of cloud computing technology, users can build their own virtual private cloud (VPC) on the cloud network. VPC is an isolated virtual network environment that allows users to manage their own configurations and policies. Different VPCs are isolated from each other to ensure the security of data and services.

In actual applications, different VPCs may need to communicate with each other, so a transit router (TR) appears. TR can be used to achieve intercommunication between different VPCs, and services between different VPCs can access each other, which is referred to as the TR networking scenario.

However, the original intention of VPC is security isolation. After different VPCs are interconnected, services between different VPCs can access each other, which is equivalent to downgrading the security of VPC. Therefore, the TR networking scenario faces the problem of how to solve the security problem of cross-VPC access.

Summary of the invention

Multiple aspects of the present application provide a cloud networking system, a secure access method, a device, and a storage medium to solve the security issues faced by TR networking scenarios when accessing across VPCs.

An embodiment of the present application provides a cloud networking system, including: a forwarding router TR, and multiple customer virtual private clouds VPCs interconnected with the TR; the multiple customer VPCs perform service mutual access through the TR; the cloud networking system also includes: a security management and control VPC, the security management and control VPC includes a gateway-type load balancing device GWLB and multiple security service nodes interconnected with the GWLB, which are used to provide security services to the outside world; a GWLB connection component is also deployed in the cloud networking system, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively; the TR is configured with at least one security routing information pointing to the GWLB connection component by default, which is used to provide security services for the service access process through the GWLB connection component and the GWLB using the security service nodes in the security management and control VPC during the service access process between two customer VPCs corresponding to each security routing information.

An embodiment of the present application also provides a secure access method, which is applied to a forwarding router TR in a cloud networking system, and the method includes: receiving a first tunnel message from any customer VPC in the cloud networking system, wherein the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message belongs to secure routing information, sending the first tunnel message to a GWLB connection component in the cloud networking system, so as to perform security authentication on the original message through the GWLB in the security control VPC using a security service node in the security control VPC; wherein the secure routing information points to the GWLB connection component, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.

An embodiment of the present application also provides a secure access method, which is applied to a gateway load balancing device GWLB connection component in a cloud networking system, the method comprising: receiving a first tunnel message sent by a forwarding router TR in the cloud networking system, the first tunnel message being obtained by tunnel encapsulating an original message in which any customer VPC in the cloud networking system requests a target service from another customer VPC; parsing the original message from the first tunnel message, and sending the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to a security service node in the security control VPC for security authentication; the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.

An embodiment of the present application also provides a secure access method, which is applied to a virtual private cloud (VPC) connection component in a cloud networking system. The method includes: receiving an original message from a client in a customer VPC requesting access to a target service; encapsulating the original message into a first tunnel message based on pre-configured routing information pointing to a forwarding router TR; and sending the first tunnel message to the TR to perform service mutual access with another customer VPC that provides the target service through the TR.

An embodiment of the present application provides a secure access device, which can be implemented in a forwarding router TR in a cloud networking system, and the device includes: a storage module, which is used to store at least one secure routing information that defaults to a gateway load balancing device GWLB connection component in the cloud networking system; a receiving module, which is used to receive a first tunnel message from any customer VPC in the cloud networking system, wherein the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; a sending module, which is used to send the first tunnel message to the GWLB connection component when the routing information corresponding to the first tunnel message belongs to secure routing information, so as to perform security authentication on the original message through the GWLB in the security control VPC using a security service node in the security control VPC; wherein the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.

An embodiment of the present application provides a forwarding router that can be applied to a cloud networking system, comprising: a memory and a processor; the memory is used to store a computer program and at least one piece of security routing information that defaults to a gateway load balancing device GWLB connection component in the cloud networking system; the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method that can be executed by the forwarding router provided in the embodiment of the present application.

The present application embodiment provides a secure access device, which can be located in a gateway of a cloud networking system. The device is implemented in a GWLB connection component of a load balancing device of the type, and the device includes: a receiving module, which is used to receive a first tunnel message sent by a forwarding router TR in a cloud networking system, wherein the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC in the cloud networking system to request a target service from another customer VPC; a decapsulation module, which is used to parse the original message from the first tunnel message; a sending module, which is used to send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication; the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.

An embodiment of the present application provides a cloud computing device, which can be implemented as a gateway-type load balancing device GWLB connection component in a cloud networking system, including: a memory and a processor; the memory is used to store a computer program, and the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method provided in the embodiment of the present application that can be executed by the GWLB connection component.

An embodiment of the present application provides a cloud computing device that can be implemented as a virtual private cloud (VPC) connection component in a cloud networking system, including: a memory and a processor; the memory is used to store a computer program, and the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method that can be executed by the VPC connection component provided in the embodiment of the present application.

An embodiment of the present application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement the steps in each method provided in the embodiment of the present application.

In the embodiment of the present application, in a TR-based networking system, a security control VPC is introduced, GWLB is used in the security control VPC, and GWLB is used as an exposed object for providing security services to the outside world; since GWLB and TR are not on the same plane, a new product object, namely the GWLB connection component, is further added to the networking system as a routing medium between TR and GWLB to achieve interconnection between TR and GWLB, and by configuring security routing information pointing to the GWLB connection component by default on TR, it is possible to provide security services during service access between two customer VPCs corresponding to the security routing information, achieve secure mutual access, and solve the security problems faced by mutual access between customer VPCs in the TR networking scenario.

In addition, in the embodiment of the present application, the method of directly adding a GWLB connection component between TR and GWLB is conducive to simplifying the access implementation of security services in the TR networking scenario. The mutual access traffic between customer VPCs only needs to flow into GWLB through TR and GWLB connection components to use security services. The traffic forwarding path is shorter, which is conducive to reducing the transmission delay on the path.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

FIG1a is a schematic diagram of the structure of a cloud networking system provided by an exemplary embodiment of the present application;

FIG1b is a schematic diagram of the structure of another cloud network system provided by an exemplary embodiment of the present application;

FIG2a is a schematic flow chart of a secure access method provided by an exemplary embodiment of the present application;

FIG2b is a flow chart of another secure access method provided by an exemplary embodiment of the present application;

FIG2c is a flow chart of another secure access method provided by an exemplary embodiment of the present application;

FIG3a is a schematic structural diagram of a secure access device provided by an exemplary embodiment of the present application;

FIG3 b is a schematic structural diagram of another secure access device provided by an exemplary embodiment of the present application;

FIG3c is a schematic structural diagram of another secure access device provided by an exemplary embodiment of the present application;

FIG. 4 is a schematic diagram of the structure of a forwarding router provided in an exemplary embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

The existing TR networking scenario is faced with how to solve the security problem of cross-VPC mutual access. To address this technical problem, in an embodiment of the present application, a security control VPC is introduced in a TR-based networking system, and GWLB is used in the security control VPC, and GWLB is used as an exposed object for providing security services to the outside world. Since GWLB and TR are no longer on the same plane, a new product object, namely the GWLB connection component, is further added to the networking system as a routing medium between TR and GWLB to achieve interconnection between TR and GWLB, and by configuring the default security routing information pointing to the GWLB connection component on TR, it is possible to provide security services during the service access between the two customer VPCs corresponding to the security routing information, achieve secure mutual access, and solve the security problems faced by customer VPCs in the TR networking scenario when they visit each other.

The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

FIG1a is a schematic diagram of the structure of a cloud networking system provided by an exemplary embodiment of the present application. As shown in FIG1a , the system 100 includes: a transit router (TR) 10, and a plurality of customer VPCs (Customer VPCs) interconnected with TR 10. In FIG1a , two customer VPCs are illustrated as an example, namely, customer VPC 11 and customer VPC 12.

In this embodiment, TR 10 refers to a network element instance with a traffic forwarding function, which can forward traffic between different network instances. In the embodiment of the present application, the network instance mainly refers to the customer VPC, but is not limited to this. For example, it can also be a border router (Virtual Border Router, VBR) instance, or a Cloud Connect Network (Cloud Connect Network, CCN) instance. It should be noted that in this embodiment, the customer VPCs interconnected by TR can be located in the same region (Region) or in different regions. In other words, TR can forward traffic within the same region or between different regions. It should be noted that TR can have multiple implementation forms. In addition to being implemented as a router, it can also be implemented as a gateway form. For example, it can be specifically implemented as a forwarding gateway (Transit Gateway, TGW). In Figure 1a, TGW is used In this embodiment, in order to realize the interconnection and traffic forwarding of different customer VPCs, TR 10 has at least rich network interconnection and routing management functions such as interconnection with customer VPCs, support for routing tables, and allowing the addition of routing entries or routing policies.

In this embodiment, the customer VPC is a VPC, which is a logically isolated network environment built on a physical network using virtualization technology. The physical network includes various physical resources, such as physical machines, switches, or gateways. One or more customer VPCs can be deployed on the physical resources in a region, and the same customer VPC is usually deployed in one region. Each customer VPC includes at least one computing node, which can be an Elastic Compute Service (ECS) instance, a bare metal server, a virtual machine, etc. Deploying a customer VPC in a region specifically refers to deploying computing nodes in the customer VPC on physical machines in the region. Various services can be deployed on these computing nodes. Optionally, one service or multiple services can be deployed in the same VPC, and there is no limitation on this. In addition, the same service in the same VPC can be provided by multiple service instances or by one service instance. Optionally, the service instance that can provide the service can be a container, a virtual machine, or an application deployed on a computing node.

These customer VPCs can be located in the same region or in different regions; each region includes one or more availability zones (Azone). For customer VPCs located in the same region, they can be located in the same availability zone or distributed in different availability zones. In addition, for the same customer VPC, it can be located in the same availability zone in the same region, or distributed in different availability zones in the same region, that is, implemented across availability zones; or, it can also be implemented across regions, that is, the same customer VPC is distributed in different regions, specifically, it can be distributed in different availability zones in different regions. In this embodiment, for the case where the same customer VPC is distributed in one or more availability zones, it can also be said that the customer VPC includes at least one availability zone. In Figure 1a, customer VPC 11 includes two availability zones AZ1 and AZ2, that is, customer VPC 11 is distributed in availability zones AZ1 and AZ2; correspondingly, customer VPC 12 includes two availability zones AZ3 and AZ4, that is, customer VPC 12 is distributed in two availability zones AZ3 and AZ4.

In this embodiment, in order to meet a wider range of networking requirements, such as enterprise-level networking requirements, multiple customer VPCs need to be interconnected. Specifically, multiple customer VPCs are interconnected through TR 10, and services can be accessed through TR 10. As shown in Figure 1a, customer VPC 11 and customer VPC 12 are interconnected through TR 10. In this embodiment, TR 10 does not belong to the customer VPC, it belongs to the network element instance at the system level, and can be optionally deployed in the system VPC of the cloud networking system 100. Considering that TR 10 and customer VPC are not on the same plane, one belongs to the system VPC and the other is the customer VPC. In order to realize the interconnection between customer VPC and TR 10, the embodiment of the present application proposes a product object, namely VPC connection component (VPCAttachment). The VPC connection component is deployed in the customer VPC and mounted under TR 10 for interconnection with TR 10, thereby realizing the interconnection between the customer VPC and TR 10. As shown in FIG. 1a, a VPC connection component 11a is deployed in customer VPC 11, and a VPC connection component 12a is deployed in customer VPC 12, and VPC connection component 11a and VPC connection component 12a are interconnected with TR 10 respectively. Mounting the VPC connection component under TR 10 means adding the identifier of the VPC connection component to TR 10 and establishing a binding relationship between TR 10 and the VPC connection component. In addition, in order to achieve the purpose of interconnecting multiple customer VPCs through TR 10, the VPC connection component is configured with default routing information pointing to TR 10. Based on the routing information, the customer VPC to TR 10 can be connected to the VPC connection component. All messages reaching the VPC connection component will be sent to TR 10. Of course, before sending the message to TR 10, the message can also be tunnel-encapsulated using the tunnel protocol used by the customer VPC. For the convenience of distinction and description, in the embodiment of the present application, the message before tunnel encapsulation is called the original message, and the message after tunnel encapsulation is called the tunnel message. In other words, the VPC connection component not only has a routing function but also has a tunnel encapsulation and decapsulation function.

In this embodiment, each customer VPC has its own available IP address network segment, and the service instances in the customer VPC can be allocated IP addresses from the IP address network segment of the customer VPC. From the perspective of access roles, the service instances in the customer VPC are divided, and the service instance that initiates the access request is called the client (client), and the service instance that provides the service is called the server (Server). In Figure 1a, the availability zone AZ1 in the customer VPC 11 includes the client (client), and the availability zone AZ4 in the customer VPC 12 includes the server (Server), and the client in the customer VPC 11 can access the service provided by the server in the customer VPC 12 through TR 10. For the convenience of description, the service provided by the server in the customer VPC 12 is called the target service. In the case of interconnection based on TR, the client in the customer VPC 11 can access the target service provided by the server in the customer VPC 12 through TR 10. The service access process is shown in Figure 1a, including:

Step 1: The client in customer VPC 11 initiates an original message to access the target service to VPC connection component 11a in customer VPC 11. The original message can be a service request, but is not limited to this.

In this embodiment, the original message initiated by the client has five-tuple information, in which the source IP address is the IP address of the client, the source port number is the port number of the client, the destination IP address is the IP address of the target service (or server), the destination port number is the port number of the target service (or server), and the transmission protocol can be TCP or UDP, which is not limited to this embodiment of the present application.

Step 2: VPC connection component 11a receives the original message initiated by the client, encapsulates the original message into a first tunnel message based on the locally pre-configured default routing information pointing to TR 10, and sends the first tunnel message to TR 10.

Specifically, the VPC connection component 11a adds the first tunnel encapsulation information to the original message to generate a first tunnel message. The first tunnel encapsulation information includes the tunnel identifier (ID) corresponding to the customer VPC 11 and the tunnel quintuple information. The source IP address in the tunnel quintuple information is the IP address corresponding to the VPC connection component 11a, which can be the IP address of the VPC connection component 11a itself or the IP address of the virtual network card device carrying the VPC connection component 11a. The source port number is a randomly assigned port number or a default port number. The destination IP address is the IP address of TR 10, and the destination port number is the port number of TR10.

Step 3, TR 10 encapsulates the first tunnel message into a second tunnel message according to the pre-configured routing information between customer VPC 11 and customer VPC 12, and sends the second tunnel message to the VPC connection component 12a in customer VPC 12.

Specifically, TR 10 replaces the first tunnel encapsulation information in the first tunnel message with the second tunnel encapsulation information to obtain the second tunnel message. The second tunnel encapsulation information includes the tunnel ID corresponding to the customer VPC 12 and the tunnel quintuple information. The source IP address in the tunnel quintuple information is the IP address of TR 10, the source port number is the port number of TR 10, the destination IP address is the IP address corresponding to the VPC connection component 12a, which can be the IP address of the VPC connection component 12a itself or the IP address of the virtual network card device carrying the VPC connection component 12a, and the destination port number is randomly assigned. In order to achieve cross-VPC intercommunication, TR 10 has the functions of tunnel decapsulation and recapsulation in addition to the cross-VPC routing function.

Step 4: The VPC connection component 12a parses the second tunnel message to obtain the original message, and sends the original message to the server in AZ4 in the customer's VPC 12, so that the server provides the target service to the client.

After the server provides the target service to the client, it returns the service result to the client using the process shown in steps 5-8. Steps 5-8 are the reverse process of steps 1-4, and the processing operations are the same or similar, so they will not be described in detail here.

During the above-mentioned service access process, security risks may be brought to customer VPC 11 and customer VPC 12. In order to ensure the security of customer VPCs visiting each other, a security control VPC 13 is introduced in the cloud networking system 100 of the embodiment of the present application. The security control VPC 13 is also a VPC with common properties and characteristics of VPC, which will not be repeated. Among them, the security control VPC 13 can be provided by a third-party service provider, or by the cloud vendor of the cloud networking system 100, or by the customer to which the customer VPC belongs, without limitation. The security control VPC 13 includes multiple security service nodes for providing security services to the outside world, specifically providing security services during the service visits of customer VPCs to ensure the security of customer VPCs. Through these security services, it can be configured which traffic can be released and which traffic cannot be released, that is, it needs to be filtered or discarded, thereby ensuring the security of customer VPCs visiting each other.

In this embodiment, the form of security services provided by the security control VPC 13 to the outside is not limited, and accordingly, the implementation form of the security service node is not limited. For example, the security service node can be but is not limited to: a firewall, an intrusion detection and prevention system, a deep data packet inspection system, etc. In this embodiment, the security control VPC 13 can only include the same type of security service node, for example, all security service nodes are firewalls, thereby providing a security service to the outside; of course, the security control VPC 13 can also include a variety of different security service nodes at the same time, for example, the security control VPC 13 includes both firewalls and deep data packet inspection systems, thereby providing different security services to the outside, and this is not limited. In Figure 1a, the security control VPC 13 includes two availability zones, namely availability zones AZ5 and AZ6, and the security service node is a firewall as an example for illustration, but it is not limited to this. It should be noted that in Figure 1a, the availability zones included in each VPC can be the same availability zone or different availability zones. For example, availability zone AZ1 and availability zone AZ3 are the same availability zone, and availability zone AZ2 and availability zone AZ4 are the same availability zone; of course, availability zone AZ1 and availability zone AZ3 may be different availability zones, and availability zone AZ2 and availability zone AZ4 may be different availability zones.

In this embodiment, the security control VPC 13 provides security services to each customer VPC in the cloud networking system 100. In order to ensure the high availability and scalability of the security control VPC 13, a gateway load balancing device (GWLB) is used in the security control VPC 13. The security service node responsible for providing security services in the security control VPC 13 is mounted after the GWLB. The service object exposed to the outside by the security control VPC 13 is the GWLB, thereby providing security services based on load balancing to the outside. Based on the GWLB, the deployment, expansion and management of the availability of security service nodes in the security control VPC 13 become simple and cost-effective. However, because the GWLB and the TR are not on the same plane, they cannot be directly interconnected. For example, in order to realize the communication between the client and the server, the TR uses the tunnel technology, while the GWLB does not use the tunnel technology, so the two cannot be directly interconnected. Therefore, a new product object, namely the GWLB connection component (GWLB Attachment) 14, is added to the cloud networking system 100 of this embodiment as a routing medium between the TR and the GWLB to realize the interconnection between the TR and the GWLB.

The GWLB connection component of this embodiment is a network element instance with traffic forwarding function, which is a logical product object and can be considered as a special type of private link terminal endpoint. Compared with the traditional private link endpoint, this special type of endpoint has richer functions. Among them, the GWLB connection component has at least the following functions: on the one hand, the GWLB connection component 14 can be associated with the specified GWLB and can be directly connected to its associated GWLB. It can be understood that the GWLB connection component has load balancing capability, and the traffic aggregated to the GWLB connection component can be loaded to each security service node through the GWLB for security processing; on the other hand, the GWLB connection component 14 is similar to the VPC connection component, which can be interconnected with TR 10 and can be used as the next hop of TR 10 in the routing information. When making routing configuration on TR 10, the GWLB connection component can be configured as the next hop. It can be understood that the GWLB connection component has gateway capability and has a convergence effect on the boundary traffic from the gateway TR 10 in the TR networking. In short, the GWLB connection component 14 of this embodiment integrates both gateway and load balancing capabilities. On the one hand, it can aggregate the traffic from the gateway boundary in the TR network, and on the other hand, with the help of the load balancing capability of GWLB, it can load balance the aggregated traffic to each security service node. Furthermore, the GWLB connection component also integrates tunnel encapsulation and decapsulation functions to adapt to the tunnel function of TR 10.

Based on the above, it is also possible to configure the default secure routing information pointing to the GWLB connection component on TR 10. The secure routing information refers to the routing information that needs to use the security management VPC to provide security services. Each secure routing information involves two customer VPCs, indicating that the traffic between the two customer VPCs needs to be securely processed. Optionally, the traffic between the two customer VPCs can be configured to support unidirectional security processing or bidirectional security processing. For the secure routing information, its next hop is the GWLB connection component 14, which is used to introduce the traffic that needs to be securely processed between the two customer VPCs into the security management VPC for security processing through the GWLB connection component 14.

In this embodiment, the security routing information involves traffic between two customer VPCs, and the security routing information includes the network segment information of the two customer VPCs involved. If it is unidirectional security processing, the security routing information indicates that all traffic sent from one customer VPC to another customer VPC needs to pass through the security service node in the security control VPC 13 for security processing; if it is bidirectional security processing, the security routing information indicates that all traffic between the two customer VPCs needs to pass through the security service node in the security control VPC 13 for security processing. Taking customer VPC 11 and customer VPC 12 as an example, a security routing information that supports unidirectional security processing can be configured: customer VPC 11->customer VPC 12 needs to be securely processed, and its next hop is the GWLB connection component. The network segment information of customer VPC 11 and the network segment information of customer VPC 12 are included in the security routing information. Continuing with customer VPC 11 and customer VPC 12 as an example, a secure routing information that supports bidirectional security processing can be configured: customer VPC 11->customer VPC 12 requires security processing, and customer VPC 12->customer VPC 11 requires security processing. The next hop is the GWLB connection component. The network segment information of customer VPC 11 and the network segment information of customer VPC 12 are included in the secure routing information.

Based on the above security routing information, TR 10 can introduce the traffic that needs to be securely processed between the two customer VPCs corresponding to the security routing information into the security management and control VPC 13 for security processing through the GWLB connection component and GWLB. That is to say, during the service access process between the two customer VPCs corresponding to the security routing information, the GWLB connection component and GWLB can use the security service node in the security management and control VPC to provide security services for the service access process, realize secure mutual access, and solve the security problems faced when customer VPCs visit each other in the TR networking scenario.

It is noted that in addition to configuring secure routing information on TR 10, conventional routing information can also be configured. Conventional routing information also involves two customer VPCs, but the traffic between the two customer VPCs does not need to be securely processed. For this type of routing information, the service access process between the two customer VPCs can be processed according to the process described in steps 1-8 above, which will not be described in detail in the embodiments of this application.

Further, on the basis of adding the security control VPC and GWLB connection components, combined with the pre-configured security routing information and conventional routing information on TR 10, any client in any customer VPC in the cloud networking system 100 can initiate service access to another customer VPC; the VPC connection component in any customer VPC can receive the original message initiated by the client in its customer VPC, encapsulate the original message into a first tunnel message, and send the first tunnel message to TR 10 based on the routing information pointing to TR 10. For TR 10, it can receive the first tunnel message from any customer VPC and identify whether the routing information corresponding to the first tunnel message is secure routing information; if the routing information corresponding to the first tunnel message is secure routing information, the first tunnel message is sent to the GWLB connection component 14, so as to perform security authentication on the original message using the security service node in the security control VPC 13 through GWLB.

Specifically, when TR 10 identifies whether the routing information corresponding to the first tunnel message is secure routing information, it can parse the original message from the first tunnel message, and determine the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message; if the source IP address in the original message is the IP address of the client, then the network segment information of the customer VPC to which the client belongs can be determined according to the IP address of the client, and the customer VPC is also the source customer VPC; accordingly, if the destination IP address in the original message is the IP address of the target service or server, then the network segment information of the customer VPC to which the target service or server belongs can be determined according to the IP address of the target service or server, and the customer VPC is also the destination customer VPC; match the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if a certain secure routing information is matched, it is determined that the routing information corresponding to the first tunnel message is secure routing information, and the matched secure routing information is the routing information corresponding to the first tunnel message.

For the GWLB connection component 14, it can receive the first tunnel message sent by the security control VPC 13, parse the original message from the first tunnel message, and send the original message to the GWLB, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication. Further optionally, the GWLB connection component 14 can also perform session management on the first tunnel message, record the session information corresponding to the first tunnel message, and the session information includes the first tunnel encapsulation information corresponding to the first tunnel message, and the five-tuple information in the original message, so as to return the first tunnel message to TR 10 through the session information when the original message passes the security authentication.

Continuing from the above, GWLB receives the original message sent by the GWLB connection component 14. On the one hand, it performs session management on the original message, maintains the session connection to which the original message belongs, and records the session information of the original message, which may include the five-tuple information of the original message, etc.; on the other hand, it load balances the original message to the target security service node in the security management VPC, so that the target security service node performs security authentication on the original message based on the local security policy; if the original message passes the security authentication, the target security service node generates a security message based on the original message, and returns the security message to GWLB. Optionally, if the original message fails the security authentication, the target security service node may discard the original message. Optionally, the security message has the same payload information as the original message and contains the five-tuple information in the original message. The difference lies in the different message formats. Optionally, GWLB can adopt various load balancing algorithms, such as The five-tuple of the original message is hashed to load balance the original message to the target security service node in the security control VPC, and the original messages belonging to the same session can be load balanced to the same security service node as much as possible, but it is not limited to this.

After receiving the security message, the GWLB returns the security message to the GWLB connection component 14; the GWLB connection component 14 is also used to receive the security message returned by the GWLB, regenerate the first tunnel message according to the session information corresponding to the first tunnel message and the security message, and return it to TR 10. Specifically, the GWLB connection component 14 can match the session information corresponding to each tunnel message according to the five-tuple information in the original message carried in the security message, so as to determine that the security message corresponds to the session information corresponding to the first tunnel message; then, according to the first tunnel encapsulation information in the session information corresponding to the first tunnel message, the security message is tunnel encapsulated to obtain the first tunnel message again. For example, the first tunnel encapsulation information can be added to the security message to obtain the first tunnel message. Optionally, the GWLB can determine that the first tunnel message needs to be returned to TR 10 according to the above session information, or it can also maintain routing information pointing to TR 10, and the re-encapsulated first tunnel message can be sent to TR 10 based on the routing information.

Further, TR 10 will also receive the first tunnel message returned by TR. According to the security routing information corresponding to the first tunnel message, the first tunnel message can be encapsulated into a second tunnel message and provided to another customer VPC that provides the target service, so that the other customer VPC provides the target service for any customer VPC that requests the target service. Specifically, according to the security routing information corresponding to the first tunnel message, the second tunnel encapsulation information can be determined, and the first tunnel encapsulation information corresponding to the first tunnel message is replaced with the second tunnel encapsulation information to obtain the second tunnel message. Among them, the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC that requests the target service and the corresponding tunnel quintuple information, the source IP address in the tunnel quintuple information is the IP address corresponding to the VPC connection component in any customer VPC, the source port number is a randomly assigned port number or a default port number, the destination IP address is the IP address of TR 10, and the destination port number is the port number of TR 10. According to the network segment information of another customer VPC in the security routing information corresponding to the first tunnel message, it is possible to determine who the other customer VPC is, and then based on the correspondence between the customer VPC and the tunnel ID, the tunnel ID corresponding to the other customer VPC can be determined; in addition, the IP address corresponding to the VPC connection component in the other customer VPC can also be determined as the destination IP address in the second tunnel encapsulation information, and the IP address points to the target service. In the case where the VPC connection component in the other customer VPC corresponds to multiple IP addresses, and the multiple IP addresses can point to the target service, a hash algorithm or a random selection algorithm can be used to select an IP address from the multiple IP addresses. For example, the tunnel quintuple information in the first tunnel message can be hashed, and the IP address corresponding to the hash result can be determined. Based on this, the second tunnel encapsulation information is determined, and the second tunnel encapsulation information includes the tunnel ID corresponding to the other customer VPC providing the target service and the corresponding tunnel quintuple information, the source IP address in the tunnel quintuple information is the IP address of TR 10, the source port number is the port number of TR 10, the destination IP address is the IP address corresponding to the VPC connection component in the other customer VPC, and the destination port number is a randomly assigned port number or a default port number or a default port number.

It is to be noted that in the above embodiment, when determining the IP address corresponding to the VPC connection component in another customer's VPC as the destination IP address in the second tunnel encapsulation information, there is no limitation on whether the client and the server must be located in the same availability zone. In an optional embodiment, if the application requires that the client and the server be located in the same availability zone, when determining the IP address corresponding to the VPC connection component in another customer's VPC, it can be determined in combination with the availability zone where the client is located. Specifically, an IP address located in the available zone where the client is located can be selected from multiple IP addresses corresponding to the VPC connection component in another customer VPC as the destination IP address in the second tunnel encapsulation information. TR 10 can obtain the available zone information where the client is located according to the user's configuration information, or the available zone information where the client is located can be carried in the message header of the original message. TR 10 obtains the available zone information where the client is located from the message header of the original message by parsing the first tunnel message.

Among them, after the second tunnel message is sent to the VPC connection component in another customer's VPC, the VPC connection component parses the security message from the second tunnel message and provides the security message to the server, which provides the target service. The service result can be sequentially transmitted through the VPC connection component in another customer's VPC, TR 10, and the VPC connection component in any customer VPC that initiates the service access until it reaches the client. In this process, the encapsulation and decapsulation process of the message is also involved, which will not be described in detail.

The above describes the secure access process in which the routing information corresponding to the first tunnel message belongs to the secure routing information. Optionally, the routing information corresponding to the first tunnel message may also be conventional routing information. In this case, when the routing information corresponding to the first tunnel message is conventional routing information, TR 10 can directly determine the second tunnel encapsulation information based on the conventional routing information corresponding to the first tunnel message, replace the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information, obtain the second tunnel message, and send the second tunnel message to the VPC connection component in another customer VPC that provides the target service; the VPC connection component parses the secure message from the second tunnel message, and provides the secure message to the server, which provides the target service. The service result can be sequentially passed through the VPC connection component in another customer VPC, TR 10, and the VPC connection component in any customer VPC that initiates the service access, until it reaches the client. In this process, the encapsulation and decapsulation process of the message is also involved, which will not be described in detail.

In order to more clearly understand the process of secure mutual access between customer VPCs in the cloud networking system 100 provided in the embodiment of the present application, in conjunction with FIG. 1a, taking the process of a client in customer VPC 11 accessing a target service provided by a server in customer VPC 12 through TR 10 as an example, in conjunction with FIG. 1a, the entire service access process is exemplarily described:

In step 2.1, TR 10 receives the first tunnel message sent by the VPC connection component 11a, and sends the first tunnel message to the GWLB connection component 14 when the routing information corresponding to the first tunnel message is secure routing information.

In step 2.2, the GWLB connection component 14 receives the first tunnel message sent by the security control VPC 13, parses the original message from the first tunnel message, and sends the original message to the GWLB.

In step 2.3, the GWLB receives the original message sent by the GWLB connection component 14, and load balances the original message to the target security service node in the security management VPC, so that the target security service node performs security authentication on the original message based on the local security policy.

Step 2.4: When the original message passes the security authentication, the target security service node generates a security message based on the original message and returns the security message to the GWLB.

Step 2.5, after receiving the security message, the GWLB returns the security message to the GWLB connection component 14.

Step 2.6, after receiving the security message, the GWLB connection component 14 regenerates the first tunnel message and returns it to TR 10.

Step 3, TR 10 encapsulates the first tunnel message into a second tunnel message based on the pre-configured security routing information between customer VPC 11 and customer VPC 12, and sends the second tunnel message to the VPC connection component 12a in customer VPC 12.

Step 4: The VPC connection component 12a parses the second tunnel message to obtain a secure message, and sends the secure message to the server in AZ4 in the customer's VPC 12, so that the server provides the target service to the client.

Step 5: The server returns the service result to the VPC connection component 12a.

Step 6: VPC connection component 12a encapsulates the service result into a third tunnel message and sends it to TR 10.

The third tunnel encapsulation information corresponding to the third tunnel message includes the tunnel ID corresponding to the customer VPC 12 and the tunnel quintuple information. The source IP address in the tunnel quintuple information is the IP address corresponding to the VPC connection component 12a, the source port number is a randomly assigned port number, the destination IP address is the IP address of TR 10, and the destination port number is the port number of TR 10.

Step 7, TR 10 encapsulates the third tunnel message into the fourth tunnel message and sends it to the VPC connection component 11a.

Further optionally, in step 7, if the pre-configured security routing information between customer VPC 11 and customer VPC 12 requires one-way security processing, then after receiving the third tunnel message sent by VPC connection component 12a, TR 10 directly encapsulates the third tunnel message into a fourth tunnel message and sends it to VPC connection component 11a.

Further optionally, in step 7, if the pre-configured security routing information between customer VPC 11 and customer VPC 12 requires bidirectional security processing, then before executing step 7, TR 10 may process the third tunnel message with reference to the process of steps 2.1-2.6, and when receiving the third tunnel message returned by GWLB connection component 14, execute the operation of encapsulating the third tunnel message into a fourth tunnel message and sending it to VPC connection component 11a in step 7. The process of processing the third tunnel message with reference to steps 2.1-2.6 is the same or similar to the process of processing the first tunnel message, and will not be repeated here.

Specifically, the third tunnel encapsulation information corresponding to the third tunnel message is replaced with the fourth tunnel encapsulation information to obtain the fourth tunnel message. The fourth tunnel encapsulation information includes the tunnel ID corresponding to the customer VPC 11 and the tunnel quintuple information, wherein the source IP address in the tunnel quintuple information is the IP address of TR 10, the source port number is the port number of TR 10, the destination IP address is the IP address corresponding to the VPC connection component 11a, and the destination port number is a randomly assigned port number.

Step 8: The VPC connection component 11a parses the fourth tunnel message, obtains a service result, and sends the service result to the client.

Further optionally, when the routing information corresponding to the first tunnel message is conventional routing information, steps 2.1-2.6 may be skipped and steps 3-8 may be directly performed.

In the above embodiment of the present application, in the cloud networking system based on TR, a security control VPC is introduced, GWLB is used in the security control VPC, and GWLB is used as an exposed object for providing security services to the outside world; since GWLB and TR are no longer on the same plane, a new product object, namely the GWLB connection component, is further added to the networking system as The routing medium between TR and GWLB realizes the interconnection between TR and GWLB, and by configuring the default secure routing information pointing to the GWLB connection component on TR, it is possible to provide security services during the service access between the two customer VPCs corresponding to the secure routing information, realize secure mutual access, and solve the security problems faced by mutual access between customer VPCs in the TR networking scenario.

In addition, it should be noted that, in addition to directly adding a GWLB connection component between TR and GWLB in this embodiment to realize the interconnection between TR and GWLB, an intermediate VPC can also be added between TR and GWLB in the manner shown in FIG. 1b, and the VPC connection component and the terminal node corresponding to GWLB (Gateway Load Balancer endpoint, GWLBe) are deployed in the intermediate VPC, GWLBe is interconnected with GWLB, GWLBe is interconnected with the VPC connection component, and the VPC connection component is interconnected with TR 10. In FIG. 1b, the intermediate VPC includes two availability zones AZ7 and AZ8 as an example, but it is not limited to this. In the system shown in FIG. 1b, the secure access process between TR and the firewall includes steps 3.1 to 3.8, and it is necessary to pass through the VPC connection component, GWLBe, and GWLB in the intermediate VPC in sequence to reach the firewall. The traffic forwarding path is relatively long and the transmission delay is relatively large, but it can also realize the access of security services in the TR networking scenario and solve the security problem of cross-VPC service mutual access in the TR networking scenario. Compared with the method of interconnecting TR and GWLB through an intermediate VPC, a VPC connection component and GWLBe, in an embodiment of the present application, a GWLB connection component is directly added between TR and GWLB, and the GWLB connection component is used to interconnect TR and GWLB, which is beneficial to simplify the access implementation of security services in the TR networking scenario; and the mutual access traffic between customer VPCs only needs to flow into GWLB through TR and GWLB connection components to use security services. The traffic forwarding path is shorter, which is beneficial to reduce the transmission delay on the path.

A brief description of steps 3.1 to 3.8 is as follows: Step 3.1, TR sends the first tunnel message to the VPC connection component in the intermediate VPC; Step 3.2, the VPC connection component in the intermediate VPC parses the original message from the first tunnel message and sends the original message to GWLBe; Step 3.3, GWLBe sends the original message to GWLB; Step 3.4, GWLB load balances the original message to the security service node (such as a firewall) for security authentication; Step 3.5, if the original message passes the security authentication, the security service node generates a security message based on the original message and sends the security message to GWLB; Step 3.6, GWLB sends the security message to GWLBe; Step 3.7, GWLBe sends the security message to the VPC connection component in the intermediate VPC; Step 3.8, the VPC connection component in the intermediate VPC re-encapsulates the security message into the first tunnel message and returns it to TR. Steps 1-8 in Figure 1b are the same or similar to steps 1-8 in Figure 1a, and are not repeated here.

In the embodiment of the present application, the GWLB connection component is a network element instance with traffic forwarding function, which is a logical product object. Its traffic forwarding function can be carried by a virtual network card device. Accordingly, the security routing information and the conventional routing information are configured on the virtual network card device, and the virtual network card device is interconnected with the TR. However, it should be noted that the GWLB connection component does not belong to the customer VPC or the security control VPC, but to the system VPC. The GWLB connection component is invisible to the customer, so it does not need to consume the virtual network card resources in each customer VPC and the security control VPC, which is conducive to saving the network card resources of the customer VPC.

Similarly, the VPC connection component in the customer VPC also has a traffic forwarding function, which can be carried by the virtual network card device. Correspondingly, the routing information pointing to the TR is also configured on the virtual network card device. The card device is interconnected with TR. Further, in the case where the customer VPC includes at least one availability zone, the VPC connection component in the customer VPC may include a virtual network card device corresponding to each availability zone, that is, at least one virtual network card device may be configured for each availability zone. Preferably, one availability zone corresponds to one virtual network card device. Each virtual network card device is responsible for receiving the original message initiated by the client in its corresponding availability zone requesting access to the target service, encapsulating the original message into a first tunnel message, and sending the first tunnel message to TR based on the routing information pointing to TR. Specifically, for the virtual network card device, it also has the tunnel encapsulation and decapsulation function, and can add the first tunnel encapsulation information to the original message to generate a first tunnel message. The first tunnel encapsulation information includes the tunnel identification ID corresponding to the customer VPC to which the virtual network card device belongs, the source IP address is the IP address of the virtual network card device, and the destination IP address is the IP address of TR.

In an optional embodiment, the virtual network card device can use an elastic network interface (ENI). ENI is a virtual network card bound to various VPCs (such as customer VPCs and system VPCs). For example, ENI will provide a private IP address for the VPC connection component or GWLB connection component bound to it. The private IP address can be an IP address in the VPC where the ENI is located, that is, the IP address of the VPC connection component or GWLB connection component it carries. In this embodiment, the main function of ENI is to interconnect with TR and forward traffic with TR.

In an optional embodiment, the cloud networking system of this embodiment also includes: a management and control node. The management and control node belongs to a control plane node, which is used to provide a human-computer interaction interface for customers, receive various requests from customers, and respond to customer requests. Specifically, the management and control node can respond to the creation request of the forwarding router to create a TR in the system VPC; and respond to the routing configuration operation to configure at least one security routing information on the created TR; in addition, VPC connection components are deployed in the two customer VPCs corresponding to each security routing information, and the identifier of the deployed VPC connection component is added to the TR to establish an association relationship between the VPC connection component and the TR. In addition, in a TR-based cloud networking scenario, when a customer needs to introduce a GWLB-based service, a GWLB connection component can also be created for the GWLB service through the management and control node. Specifically, the control node can also respond to the creation request of the GWLB connection component, deploy the GWLB connection component in the system VPC, and specify the GWLB associated with the GWLB connection component. In this embodiment, the GWLB points to the security control service; further, it is necessary to add the identifier of the GWLB connection component on the TR to establish a corresponding relationship between the TR and the GWLB connection component, so that the GWLB connection component can be used as the next hop in the security routing information. It should be noted that the creation process of the GWLB connection component and the TR are relatively independent, and customers can flexibly create them according to application requirements.

It should be noted that in a cloud networking system, there can be one or more TRs. In Figure 1a, one TR is used as an example. In the case of multiple TRs, each TR has its own corresponding GWLB connection component, and the GWLB connection components corresponding to multiple TRs can be associated with the same GWLB, that is, multiple TRs can use the services provided by the VPC where the same GWLB is located.

It should be noted that the cloud networking system provided in the embodiment of the present application is not only applicable to the scenario of introducing a security control VPC, but can also be extended to the scenario of introducing any intermediate service VPC based on GWLB. The intermediate service VPC refers to a VPC that can provide some intermediate services during the service exchange process between customer VPCs through TR, such as data cleaning services, data computing services, or security services. Based on this, the embodiment of the present application also provides another A cloud networking system, the cloud networking system includes a TR, and multiple customer VPCs interconnected with the TR; multiple customer VPCs perform service mutual access through the TR; further, the cloud networking system also includes: an intermediate service VPC, the intermediate service VPC includes a GWLB and multiple intermediate service nodes interconnected with the GWLB, which are used to provide intermediate services to the outside. Furthermore, a GWLB connection component is also deployed in the cloud networking system, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively. Based on this, at least one security routing information pointing to the GWLB connection component is configured on the TR by default. The TR can use the intermediate service nodes in the intermediate service VPC to provide intermediate services for the service access process through the GWLB connection component and the GWLB during the service access process between the two customer VPCs corresponding to each security routing information. Detailed descriptions of the definitions, descriptions, and related actions of the relevant components or objects in the cloud networking system can be found in the aforementioned embodiments, which will not be repeated here.

In addition to the above-mentioned cloud networking system, the embodiments of the present application also provide the following security access methods, which are described from the perspectives of TR, GWLB connection components and VPC connection components, respectively. For details, please refer to the method embodiments shown in Figures 2a-2c.

FIG2a is a flow chart of a secure access method provided by an exemplary embodiment of the present application. The method is described from the perspective of a forwarding router TR. As shown in FIG2a, the method includes:

21a. Receive a first tunnel message from any customer VPC in the cloud networking system, where the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC;

22a. If the routing information corresponding to the first tunnel message is secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system, so that the original message is securely authenticated by the GWLB in the security control VPC using the security service node in the security control VPC.

In this embodiment, a new product object, namely, a GWLB connection component, is added in the cloud networking system; the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively. In the security management VPC, GWLB is interconnected with the security service node.

In this embodiment, at least one security routing information pointing to the GWLB connection component by default is pre-configured on the TR. Each security routing information involves two customer VPCs, indicating that the traffic between the two customer VPCs needs to be securely processed. Optionally, the traffic between the two customer VPCs can be configured to support unidirectional security processing or bidirectional security processing.

Further optionally, the security routing information involves traffic between two customer VPCs, and the security routing information includes the network segment information of the two customer VPCs involved. If it is a one-way security processing, the security routing information indicates that all traffic sent from one customer VPC to another customer VPC needs to be securely processed by the security service node in the security control VPC; if it is a two-way security processing, the security routing information indicates that all traffic between the two customer VPCs needs to be securely processed by the security service node in the security control VPC 13. Based on this, TR can provide security services for the service access process through the GWLB connection component and the GWLB using the security service node in the security control VPC during the service access process between the two customer VPCs corresponding to each security routing information.

Specifically, the TR may receive a first tunnel message from any customer VPC in the cloud networking system, wherein the first tunnel message is tunnel blocked according to an original message from any customer VPC requesting a target service from another customer VPC. if the routing information corresponding to the first tunnel message belongs to secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system, so as to perform security authentication on the original message through the GWLB in the security control VPC using the security service node in the security control VPC.

Further optionally, the method also includes: a step of identifying whether the routing information corresponding to the first tunnel message belongs to secure routing information. This step specifically includes: parsing the original message from the first tunnel message, determining the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message; matching the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if there is a match, determining that the routing information corresponding to the first tunnel message is secure routing information.

Further optionally, the method also includes: receiving a first tunnel message returned by the GWLB connection component, the first tunnel message being regenerated by the GWLB connection component based on a security message returned by the GWLB when the original message passes security authentication, and the security message being generated by a security service node in a security control VPC based on the original message when the original message passes security authentication; encapsulating the first tunnel message into a second tunnel message, and providing it to another customer VPC, so that the other customer VPC provides the target service for any customer VPC.

Further optionally, the above-mentioned encapsulation of the first tunnel message into the second tunnel message includes: according to the security routing information corresponding to the first tunnel message, replacing the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information to obtain the second tunnel message; the second tunnel encapsulation information includes the tunnel identification ID corresponding to another customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of TR, and the destination IP address is the IP address corresponding to the VPC connection component in another customer VPC; the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any customer VPC, and the destination IP address is the IP address of TR.

In this embodiment, a new product object, namely, the GWLB connection component, is added to the cloud networking system as a routing medium between TR and GWLB to realize the interconnection between TR and GWLB, and by configuring the security routing information pointing to the GWLB connection component by default on TR, it is possible to provide security services during the service access process of the two customer VPCs corresponding to the security routing information, realize secure mutual access, and solve the security problems faced when customer VPCs visit each other in the TR networking scenario.

FIG2b is a flow chart of another secure access method provided by an exemplary embodiment of the present application; the method is described from the perspective of the GWLB connection component, as shown in FIG2b , the method includes:

21b. Receive a first tunnel message sent by a forwarding router TR in the cloud networking system, where the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC in the cloud networking system requesting a target service from another customer VPC;

22b. Parse the original message from the first tunnel message, and send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication.

In this embodiment, TR can receive a first tunnel message from any customer VPC in the cloud networking system, where the first tunnel message is obtained by tunnel encapsulating the original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message is secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system.

In this embodiment, in addition to being interconnected with TR and GWLB respectively, the GWLB connection component can also receive the first tunnel message sent by TR in the cloud networking system, parse the original message from the first tunnel message, and send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication. The GWLB connection component also has the functions of sending and receiving messages and decapsulating (or parsing).

Further optionally, the method also includes: before sending the original message to the GWLB, recording the session information corresponding to the first tunnel message; and after sending the original message to the GWLB, receiving the security message returned by the GWLB, the security message is generated by the security service node in the security control VPC according to the original message and provided to the GWLB when the original message passes the security authentication; further, regenerating the first tunnel message according to the session information and the security message corresponding to the first tunnel message, and returning it to the TR, so that the TR encapsulates the first tunnel message into the second tunnel message and provides it to another customer VPC, thereby enabling the other customer VPC to provide the target service for any of the customer VPCs. It can be seen that in the embodiment of the present application, the GWLB connection component also has functions such as message encapsulation and session recording and maintenance.

FIG2c is a flow chart of another secure access method provided by an exemplary embodiment of the present application; the method is described from the perspective of a VPC connection component. As shown in FIG2c, the method includes:

21c. Receive the original message from the client in the customer VPC where the VPC connection component is located, requesting to access the target service;

22c. Encapsulate the original message into a first tunnel message according to the pre-configured routing information pointing to the forwarding router TR;

23c. Send the first tunnel message to the TR, so as to perform service mutual access with another customer VPC providing the target service in the cloud networking system through the TR.

When a client in a customer VPC requests to access a target service, it sends an original message to the VPC connection component. The VPC connection component receives the original message and encapsulates the original message into a first tunnel message based on the pre-configured routing information pointing to the TR. The first tunnel message is sent to the TR. The TR can receive the first tunnel message. If the route corresponding to the first tunnel message is Since the information belongs to secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system. The GWLB connection component receives the first tunnel message sent by the TR, parses the original message from the first tunnel message, and sends the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication.

It should be noted that in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 21a, 22a, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

Fig. 3a is a schematic diagram of the structure of a secure access device provided by an exemplary embodiment of the present application. The device can be implemented in a forwarding router TR in a cloud networking system, as shown in Fig. 3a, the device includes: a storage module 31a, a receiving module 32a and a sending module 33a.

The storage module 31a is used to store at least one piece of security routing information that points to the GWLB connection component in the cloud networking system by default. The receiving module 32a is used to receive a first tunnel message from any customer VPC in the cloud networking system, and the first tunnel message is obtained by tunnel encapsulation based on the original message from any customer VPC requesting the target service from another customer VPC. The sending module 33a is used to send the first tunnel message to the GWLB connection component when the routing information corresponding to the first tunnel message belongs to the security routing information, so as to perform security authentication on the original message through the GWLB in the security control VPC using the security service node in the security control VPC; wherein the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.

In an optional embodiment, the device further includes: a parsing module, used to parse the original message from the first tunnel message, and determine the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message. And a matching module, used to match the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if there is a match, determining that the routing information corresponding to the first tunnel message is secure routing information.

In an optional embodiment, the receiving module 32a is further used to: receive a first tunnel message returned by the GWLB connection component, the first tunnel message is regenerated by the GWLB connection component according to the security message returned by the GWLB when the original message passes the security authentication, and the security message is generated according to the original message. Correspondingly, the sending module 33a is further used to: encapsulate the first tunnel message into a second tunnel message, and provide it to another customer VPC, so that the other customer VPC provides the target service for any customer VPC.

Further optionally, when the sending module 33a encapsulates the first tunnel message into the second tunnel message, it is specifically used to: replace the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information according to the security routing information corresponding to the first tunnel message, so as to obtain the second tunnel message; the second tunnel encapsulation information includes the tunnel identification ID corresponding to another customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of TR, and the destination IP address is the IP address corresponding to the VPC connection component in another customer VPC; the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any customer VPC, and the destination IP address is the IP address of TR.

Fig. 3b is a schematic diagram of the structure of another secure access device provided by an exemplary embodiment of the present application. The device can be implemented in a GWLB connection component in a cloud networking system, as shown in Fig. 3b, the device includes: a decapsulation module 31b, a receiving module 32b and a sending module 33b.

The receiving module 32b is used to receive the first tunnel message sent by the forwarding router TR in the cloud networking system. The first tunnel message is obtained by tunnel encapsulation based on the original message from any customer VPC in the cloud networking system requesting the target service to another customer VPC. The decapsulation module 31b is used to parse the original message from the first tunnel message. The sending module 33b is used to send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication. Among them, the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively, and GWLB is interconnected with the security service node.

In an optional embodiment, the device further includes: an encapsulation module and a session management module. The session management module is used to record the session information corresponding to the first tunnel message before sending the original message to the GWLB. The receiving module 32b is also used to: after sending the original message to the GWLB, receive the security message returned by the GWLB, the security message is generated based on the original message when the original message passes the security authentication. The encapsulation module is used to: regenerate the first tunnel message based on the session information and the security message corresponding to the first tunnel message. The sending module 33b is also used to: return the first tunnel message to the TR, so that the TR encapsulates the first tunnel message into the second tunnel message and provides it to another customer VPC.

Fig. 3c is a schematic diagram of the structure of another secure access device provided by an exemplary embodiment of the present application. The device can be implemented in a VPC connection component in a cloud networking system, as shown in Fig. 3c, the device includes: an encapsulation module 31c, a receiving module 32c and a sending module 33c.

The receiving module 32c is used to receive an original message from a client in the customer VPC where the VPC connection component is located, requesting to access the target service. The encapsulation module 31c is used to encapsulate the original message into a first tunnel message according to the pre-configured routing information pointing to the forwarding router TR. The sending module 33c is used to send the first tunnel message to the TR, so as to perform service mutual access with another customer VPC that provides the target service in the cloud networking system through the TR.

It is to be noted that the detailed functions implemented by each module in the above-mentioned devices can be found in the relevant descriptions in the above-mentioned method or system embodiments, and will not be repeated here.

Fig. 4 is a schematic diagram of the structure of a forwarding router provided by an exemplary embodiment of the present application. The forwarding router can be implemented as a cloud computing device, including: a memory 41, a processor 42 and a communication component 43.

The memory 41 is used to store computer programs and can be configured to store various other data to support operations on the forwarding router. Examples of such data include instructions for any application or method operating on the forwarding router, Messages, pictures, videos, etc. Further, the memory 41 is also used to store at least one piece of security routing information pointing to the GWLB connection component in the cloud networking system by default.

The processor 42 is coupled to the memory 41 and is used to execute the computer program in the memory 41, so as to provide security services for the service access process through the GWLB connection component in the security control VPC and the GWLB using the security service node in the security control VPC during the service access process between the two customer VPCs corresponding to each security routing information. The GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.

Optionally, the processor 42 is specifically used to: receive a first tunnel message from any customer VPC in the cloud networking system through the communication component 43, the first tunnel message being obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message is security routing information, send the first tunnel message to the GWLB connection component in the cloud networking system, so as to perform security authentication on the original message through the GWLB in the security control VPC using the security service node in the security control VPC.

Optionally, the processor 42 is also used to: parse the original message from the first tunnel message, determine the network segment information of the source customer VPC and the destination customer VPC based on the source IP address and the destination IP address in the original message; match at least one secure routing information based on the network segment information of the source customer VPC and the destination customer VPC; if there is a match, determine that the routing information corresponding to the first tunnel message is secure routing information.

Optionally, the processor 42 is also used to: receive a first tunnel message returned by the GWLB connection component through the communication component 43, the first tunnel message is regenerated by the GWLB connection component based on the security message returned by the GWLB when the original message passes security authentication, and the security message is generated based on the original message; encapsulate the first tunnel message into a second tunnel message, and provide it to another customer VPC, so that the other customer VPC provides the target service for any customer VPC.

Optionally, the processor 42 is specifically used to: replace the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information according to the security routing information corresponding to the first tunnel message, to obtain the second tunnel message; the second tunnel encapsulation information includes the tunnel identification ID corresponding to another customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of TR, and the destination IP address is the IP address corresponding to the VPC connection component in another customer VPC; the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any customer VPC, and the destination IP address is the IP address of TR.

Furthermore, as shown in Fig. 4, the forwarding router also includes other components such as a power supply component 44. Fig. 4 only schematically shows some components, which does not mean that the forwarding router only includes the components shown in Fig. 4.

Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement each step that can be executed by the TR in the above method embodiment.

The embodiment of the present application provides a cloud computing device, which has the same or similar structure as the forwarding router shown in FIG4, so it is not shown in the figure. For details, please refer to FIG4. The cloud computing device provided in this embodiment can be implemented as a GWLB connection component in a cloud networking system, including a memory and a processor, the memory is used to store a computer program, the processor is coupled to the memory, and is used to execute the computer program stored in the memory, so as to: receive a first tunnel message sent by a forwarding router TR in the cloud networking system, the first tunnel message is based on any customer VPC in the cloud networking system The original message that requests the target service from another customer VPC is tunnel-encapsulated; the original message is parsed from the first tunnel message, and the original message is sent to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication; the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively, and GWLB is interconnected with the security service node.

Further optionally, the processor is also used to: record the session information corresponding to the first tunnel message before sending the original message to the GWLB; and after sending the original message to the GWLB, receive the security message returned by the GWLB, where the security message is generated based on the original message when the original message passes the security authentication; regenerate the first tunnel message based on the session information corresponding to the first tunnel message and the security message, and return it to the TR, so that the TR encapsulates the first tunnel message into a second tunnel message and provides it to another customer VPC.

Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement each step that can be performed by the GWLB connection component in the above method embodiment.

The embodiment of the present application provides a cloud computing device, which has the same or similar structure as the forwarding router shown in FIG4, so it is not shown in the figure, and the details can be seen in FIG4. The cloud computing device provided in this embodiment can be implemented as a VPC connection component in a cloud networking system, including a memory and a processor, the memory is used to store a computer program, the processor is coupled to the memory, and is used to execute the computer program stored in the memory, so as to: receive an original message from a client in a customer VPC where the VPC connection component is located to request access to a target service; encapsulate the original message into a first tunnel message according to the pre-configured routing information pointing to the forwarding router TR; send the first tunnel message to TR, so as to perform service mutual access with another customer VPC providing the target service in the cloud networking system through TR.

Accordingly, an embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement each step that can be performed by the VPC connection component in the above method embodiment.

The memory in the above embodiments can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The communication component in the above-mentioned embodiment is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G/LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

The power supply assembly in the above embodiments provides power to various components of the device where the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components related to generating, managing and distributing power to the device where the power supply assembly is located. Force-related components.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

The present application is described with reference to the flowchart and/or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

A cloud networking system, characterized in that it comprises: a forwarding router TR, and a plurality of customer virtual private clouds VPCs interconnected with the TR; the plurality of customer VPCs perform service mutual access through the TR;

The cloud networking system further includes: a security control VPC, wherein the security control VPC includes a gateway load balancing device GWLB and a plurality of security service nodes interconnected with the GWLB, for providing security services to the outside world;

A GWLB connection component is also deployed in the cloud networking system. The GWLB connection component serves as a routing medium between the TR and the GWLB and is interconnected with the TR and the GWLB respectively;

The TR is configured with at least one security routing information pointing to the GWLB connection component by default, which is used to provide security services for the service access process through the GWLB connection component and the GWLB using the security service node in the security management VPC during the service access process between the two customer VPCs corresponding to each security routing information.
The system according to claim 1 is characterized in that the TR is specifically used to: receive a first tunnel message from any customer VPC, the first tunnel message being obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message belongs to secure routing information, send the first tunnel message to the GWLB connection component, so as to perform security authentication on the original message through the GWLB using a security service node in the security control VPC;

The GWLB connection component is used to parse the original message from the first tunnel message and send the original message to the GWLB, so that the GWLB load balances the original message to the security service node in the security management and control VPC for security authentication.
The system according to claim 2 is characterized in that the GWLB connection component is also used to: record the session information corresponding to the first tunnel message; and receive the security message returned by the GWLB, regenerate the first tunnel message according to the session information corresponding to the first tunnel message and the security message, and return it to the TR, wherein the security message is generated by the security service node in the security control VPC according to the original message and sent to the GWLB when the original message passes the security authentication;

The TR is also used to: receive the first tunnel message returned by the GWLB connection component, encapsulate the first tunnel message into a second tunnel message and provide it to the other customer VPC, so that the other customer VPC provides the target service for any customer VPC.
The system according to any one of claims 1 to 3 is characterized in that VPC connection components are respectively deployed in the multiple customer VPCs; the VPC connection component is configured with default routing information pointing to the TR, which is used to encapsulate the original message requesting access to the target service in the customer VPC where it is located into a first tunnel message, and send the first tunnel message to the TR, so as to perform service mutual access with another customer VPC that provides the target service through the TR.
The system according to any one of claims 1 to 3, further comprising: a control node, configured to execute:

In response to the forwarding router creation request, a forwarding router TR is created in the system VPC, and in response to the routing configuration operation, at least one piece of secure routing information is configured on the TR, a VPC connection component is deployed in two customer VPCs corresponding to each piece of secure routing information, and an identifier of the VPC connection component is added to the TR;

and / or

In response to a creation request of a GWLB connection component, the GWLB connection component is deployed in the system VPC, and a GWLB associated with the GWLB connection component is specified; and an identifier of the GWLB connection component is added to the TR to establish a corresponding relationship between the TR and the GWLB connection component.
A secure access method, characterized in that it is applied to a forwarding router TR in a cloud networking system, The law includes:

Receiving a first tunnel message from any customer VPC in the cloud networking system, where the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC;

If the routing information corresponding to the first tunnel message is secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system, so that the GWLB in the security control VPC uses the security service node in the security control VPC to perform security authentication on the original message;

The secure routing information points to the GWLB connection component, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with a secure service node.
The method according to claim 6, further comprising:

Parsing the original message from the first tunnel message, and determining the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message;

According to the network segment information of the source customer VPC and the destination customer VPC, the network segment information is matched in at least one secure routing information; if there is a match, it is determined that the routing information corresponding to the first tunnel message is the secure routing information.
The method according to claim 6 or 7, characterized in that it also includes:

receiving a first tunnel message returned by the GWLB connection component, wherein the first tunnel message is regenerated by the GWLB connection component according to the security message returned by the GWLB when the original message passes security authentication, and the security message is generated according to the original message;

The first tunnel message is encapsulated into a second tunnel message, and the second tunnel message is provided to the other customer VPC, so that the other customer VPC provides the target service for any customer VPC.
The method according to claim 8, characterized in that encapsulating the first tunnel message into the second tunnel message comprises:

According to the security routing information corresponding to the first tunnel message, the first tunnel encapsulation information corresponding to the first tunnel message is replaced with the second tunnel encapsulation information to obtain the second tunnel message;

The second tunnel encapsulation information includes a tunnel identification ID corresponding to the other customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of the TR, and the destination IP address is the IP address corresponding to the VPC connection component in the other customer VPC;

The first tunnel encapsulation information includes the tunnel ID corresponding to any one of the customer VPCs, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any one of the customer VPCs, and the destination IP address is the IP address of the TR.
A secure access method, characterized in that it is applied to a gateway load balancing device GWLB connection component in a cloud networking system, and the method comprises:

Receiving a first tunnel message sent by a forwarding router TR in the cloud networking system, where the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC in the cloud networking system requesting a target service from another customer VPC;

Parsing the original message from the first tunnel message, and sending the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication;

The GWLB connection component acts as a routing medium between the TR and the GWLB, and is respectively connected to the TR The GWLB is interconnected with the security service node.
The method according to claim 10, further comprising:

Before sending the original message to the GWLB, recording the session information corresponding to the first tunnel message; and

After sending the original message to the GWLB, receiving a security message returned by the GWLB, wherein the security message is generated according to the original message when the original message passes security authentication;

The first tunnel message is regenerated according to the session information corresponding to the first tunnel message and the security message, and is returned to the TR, so that the TR encapsulates the first tunnel message into a second tunnel message and provides it to the other customer VPC.
A forwarding router can be applied to a cloud networking system, characterized in that it includes: a memory and a processor;

The memory is used to store a computer program and at least one piece of security routing information that defaults to a gateway-type load balancing device GWLB connection component in a cloud networking system; the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method described in any one of claims 6-9.
A cloud computing device can be implemented as a gateway load balancing device GWLB connection component in a cloud networking system, characterized in that it includes: a memory and a processor; the memory is used to store a computer program, and the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method described in any one of claims 10-11.
A computer-readable storage medium storing a computer program, characterized in that when the computer program is executed by a processor, the processor is enabled to implement the steps in the method described in any one of claims 6 to 9 and claims 10 to 11.
A cloud networking system, characterized in that it comprises: a forwarding router TR, and a plurality of customer virtual private clouds VPCs interconnected with the TR; the plurality of customer VPCs perform service mutual access through the TR;

The cloud networking system further includes: an intermediate service VPC, wherein the intermediate service VPC includes a gateway load balancing device GWLB and a plurality of intermediate service nodes interconnected with the GWLB, for providing an intermediate service to the outside;

A GWLB connection component is also deployed in the cloud networking system. The GWLB connection component serves as a routing medium between the TR and the GWLB and is interconnected with the TR and the GWLB respectively;

The TR is configured with at least one piece of security routing information pointing to the GWLB connection component by default, and is used to provide intermediate services for the service access process through the GWLB connection component and the GWLB using the intermediate service node in the intermediate service VPC during the service access process between the two customer VPCs corresponding to each piece of security routing information.