WO2024067338A1 - Système de réseau en nuage, procédé d'accès sécurisé, et dispositif et support de stockage - Google Patents

Système de réseau en nuage, procédé d'accès sécurisé, et dispositif et support de stockage Download PDF

Info

Publication number
WO2024067338A1
WO2024067338A1 PCT/CN2023/120291 CN2023120291W WO2024067338A1 WO 2024067338 A1 WO2024067338 A1 WO 2024067338A1 CN 2023120291 W CN2023120291 W CN 2023120291W WO 2024067338 A1 WO2024067338 A1 WO 2024067338A1
Authority
WO
WIPO (PCT)
Prior art keywords
gwlb
vpc
security
message
tunnel
Prior art date
Application number
PCT/CN2023/120291
Other languages
English (en)
Chinese (zh)
Inventor
穆立超
彭觅
Original Assignee
杭州阿里云飞天信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州阿里云飞天信息技术有限公司 filed Critical 杭州阿里云飞天信息技术有限公司
Publication of WO2024067338A1 publication Critical patent/WO2024067338A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of cloud computing technology, and in particular to a cloud networking system, a secure access method, a device, and a storage medium.
  • VPC virtual private cloud
  • TR transit router
  • Multiple aspects of the present application provide a cloud networking system, a secure access method, a device, and a storage medium to solve the security issues faced by TR networking scenarios when accessing across VPCs.
  • An embodiment of the present application provides a cloud networking system, including: a forwarding router TR, and multiple customer virtual private clouds VPCs interconnected with the TR; the multiple customer VPCs perform service mutual access through the TR; the cloud networking system also includes: a security management and control VPC, the security management and control VPC includes a gateway-type load balancing device GWLB and multiple security service nodes interconnected with the GWLB, which are used to provide security services to the outside world; a GWLB connection component is also deployed in the cloud networking system, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively; the TR is configured with at least one security routing information pointing to the GWLB connection component by default, which is used to provide security services for the service access process through the GWLB connection component and the GWLB using the security service nodes in the security management and control VPC during the service access process between two customer VPCs corresponding to each security routing information.
  • An embodiment of the present application also provides a secure access method, which is applied to a forwarding router TR in a cloud networking system, and the method includes: receiving a first tunnel message from any customer VPC in the cloud networking system, wherein the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message belongs to secure routing information, sending the first tunnel message to a GWLB connection component in the cloud networking system, so as to perform security authentication on the original message through the GWLB in the security control VPC using a security service node in the security control VPC; wherein the secure routing information points to the GWLB connection component, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.
  • An embodiment of the present application also provides a secure access method, which is applied to a gateway load balancing device GWLB connection component in a cloud networking system, the method comprising: receiving a first tunnel message sent by a forwarding router TR in the cloud networking system, the first tunnel message being obtained by tunnel encapsulating an original message in which any customer VPC in the cloud networking system requests a target service from another customer VPC; parsing the original message from the first tunnel message, and sending the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to a security service node in the security control VPC for security authentication; the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.
  • An embodiment of the present application also provides a secure access method, which is applied to a virtual private cloud (VPC) connection component in a cloud networking system.
  • the method includes: receiving an original message from a client in a customer VPC requesting access to a target service; encapsulating the original message into a first tunnel message based on pre-configured routing information pointing to a forwarding router TR; and sending the first tunnel message to the TR to perform service mutual access with another customer VPC that provides the target service through the TR.
  • VPC virtual private cloud
  • An embodiment of the present application provides a secure access device, which can be implemented in a forwarding router TR in a cloud networking system, and the device includes: a storage module, which is used to store at least one secure routing information that defaults to a gateway load balancing device GWLB connection component in the cloud networking system; a receiving module, which is used to receive a first tunnel message from any customer VPC in the cloud networking system, wherein the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; a sending module, which is used to send the first tunnel message to the GWLB connection component when the routing information corresponding to the first tunnel message belongs to secure routing information, so as to perform security authentication on the original message through the GWLB in the security control VPC using a security service node in the security control VPC; wherein the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with
  • An embodiment of the present application provides a forwarding router that can be applied to a cloud networking system, comprising: a memory and a processor; the memory is used to store a computer program and at least one piece of security routing information that defaults to a gateway load balancing device GWLB connection component in the cloud networking system; the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method that can be executed by the forwarding router provided in the embodiment of the present application.
  • the present application embodiment provides a secure access device, which can be located in a gateway of a cloud networking system.
  • the device is implemented in a GWLB connection component of a load balancing device of the type, and the device includes: a receiving module, which is used to receive a first tunnel message sent by a forwarding router TR in a cloud networking system, wherein the first tunnel message is obtained by tunnel encapsulating an original message from any customer VPC in the cloud networking system to request a target service from another customer VPC; a decapsulation module, which is used to parse the original message from the first tunnel message; a sending module, which is used to send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication;
  • the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.
  • An embodiment of the present application provides a cloud computing device, which can be implemented as a gateway-type load balancing device GWLB connection component in a cloud networking system, including: a memory and a processor; the memory is used to store a computer program, and the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method provided in the embodiment of the present application that can be executed by the GWLB connection component.
  • a cloud computing device which can be implemented as a gateway-type load balancing device GWLB connection component in a cloud networking system, including: a memory and a processor; the memory is used to store a computer program, and the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method provided in the embodiment of the present application that can be executed by the GWLB connection component.
  • An embodiment of the present application provides a cloud computing device that can be implemented as a virtual private cloud (VPC) connection component in a cloud networking system, including: a memory and a processor; the memory is used to store a computer program, and the processor, coupled to the memory, is used to execute the computer program to execute the steps in the method that can be executed by the VPC connection component provided in the embodiment of the present application.
  • VPC virtual private cloud
  • An embodiment of the present application provides a computer-readable storage medium storing a computer program.
  • the processor is enabled to implement the steps in each method provided in the embodiment of the present application.
  • a security control VPC is introduced, GWLB is used in the security control VPC, and GWLB is used as an exposed object for providing security services to the outside world; since GWLB and TR are not on the same plane, a new product object, namely the GWLB connection component, is further added to the networking system as a routing medium between TR and GWLB to achieve interconnection between TR and GWLB, and by configuring security routing information pointing to the GWLB connection component by default on TR, it is possible to provide security services during service access between two customer VPCs corresponding to the security routing information, achieve secure mutual access, and solve the security problems faced by mutual access between customer VPCs in the TR networking scenario.
  • the method of directly adding a GWLB connection component between TR and GWLB is conducive to simplifying the access implementation of security services in the TR networking scenario.
  • the mutual access traffic between customer VPCs only needs to flow into GWLB through TR and GWLB connection components to use security services.
  • the traffic forwarding path is shorter, which is conducive to reducing the transmission delay on the path.
  • FIG1a is a schematic diagram of the structure of a cloud networking system provided by an exemplary embodiment of the present application.
  • FIG1b is a schematic diagram of the structure of another cloud network system provided by an exemplary embodiment of the present application.
  • FIG2a is a schematic flow chart of a secure access method provided by an exemplary embodiment of the present application.
  • FIG2b is a flow chart of another secure access method provided by an exemplary embodiment of the present application.
  • FIG2c is a flow chart of another secure access method provided by an exemplary embodiment of the present application.
  • FIG3a is a schematic structural diagram of a secure access device provided by an exemplary embodiment of the present application.
  • FIG3 b is a schematic structural diagram of another secure access device provided by an exemplary embodiment of the present application.
  • FIG3c is a schematic structural diagram of another secure access device provided by an exemplary embodiment of the present application.
  • FIG. 4 is a schematic diagram of the structure of a forwarding router provided in an exemplary embodiment of the present application.
  • a security control VPC is introduced in a TR-based networking system, and GWLB is used in the security control VPC, and GWLB is used as an exposed object for providing security services to the outside world.
  • a new product object namely the GWLB connection component
  • the networking system is further added to the networking system as a routing medium between TR and GWLB to achieve interconnection between TR and GWLB, and by configuring the default security routing information pointing to the GWLB connection component on TR, it is possible to provide security services during the service access between the two customer VPCs corresponding to the security routing information, achieve secure mutual access, and solve the security problems faced by customer VPCs in the TR networking scenario when they visit each other.
  • the method of directly adding a GWLB connection component between TR and GWLB is conducive to simplifying the access implementation of security services in the TR networking scenario.
  • the mutual access traffic between customer VPCs only needs to flow into GWLB through TR and GWLB connection components to use security services.
  • the traffic forwarding path is shorter, which is conducive to reducing the transmission delay on the path.
  • FIG1a is a schematic diagram of the structure of a cloud networking system provided by an exemplary embodiment of the present application.
  • the system 100 includes: a transit router (TR) 10, and a plurality of customer VPCs (Customer VPCs) interconnected with TR 10.
  • TR transit router
  • Customer VPCs customer VPCs
  • FIG1a two customer VPCs are illustrated as an example, namely, customer VPC 11 and customer VPC 12.
  • TR 10 refers to a network element instance with a traffic forwarding function, which can forward traffic between different network instances.
  • the network instance mainly refers to the customer VPC, but is not limited to this.
  • it can also be a border router (Virtual Border Router, VBR) instance, or a Cloud Connect Network (Cloud Connect Network, CCN) instance.
  • VBR Virtual Border Router
  • CCN Cloud Connect Network
  • the customer VPCs interconnected by TR can be located in the same region (Region) or in different regions. In other words, TR can forward traffic within the same region or between different regions.
  • TR can have multiple implementation forms. In addition to being implemented as a router, it can also be implemented as a gateway form.
  • TR 10 can be specifically implemented as a forwarding gateway (Transit Gateway, TGW).
  • TGW forwarding gateway
  • TGW is used
  • TR 10 has at least rich network interconnection and routing management functions such as interconnection with customer VPCs, support for routing tables, and allowing the addition of routing entries or routing policies.
  • the customer VPC is a VPC, which is a logically isolated network environment built on a physical network using virtualization technology.
  • the physical network includes various physical resources, such as physical machines, switches, or gateways.
  • One or more customer VPCs can be deployed on the physical resources in a region, and the same customer VPC is usually deployed in one region.
  • Each customer VPC includes at least one computing node, which can be an Elastic Compute Service (ECS) instance, a bare metal server, a virtual machine, etc.
  • ECS Elastic Compute Service
  • Deploying a customer VPC in a region specifically refers to deploying computing nodes in the customer VPC on physical machines in the region.
  • Various services can be deployed on these computing nodes.
  • one service or multiple services can be deployed in the same VPC, and there is no limitation on this.
  • the same service in the same VPC can be provided by multiple service instances or by one service instance.
  • the service instance that can provide the service can be a container, a virtual machine, or an application deployed on a computing node.
  • customer VPCs can be located in the same region or in different regions; each region includes one or more availability zones (Azone). For customer VPCs located in the same region, they can be located in the same availability zone or distributed in different availability zones. In addition, for the same customer VPC, it can be located in the same availability zone in the same region, or distributed in different availability zones in the same region, that is, implemented across availability zones; or, it can also be implemented across regions, that is, the same customer VPC is distributed in different regions, specifically, it can be distributed in different availability zones in different regions. In this embodiment, for the case where the same customer VPC is distributed in one or more availability zones, it can also be said that the customer VPC includes at least one availability zone.
  • customer VPC 11 includes two availability zones AZ1 and AZ2, that is, customer VPC 11 is distributed in availability zones AZ1 and AZ2; correspondingly, customer VPC 12 includes two availability zones AZ3 and AZ4, that is, customer VPC 12 is distributed in two availability zones AZ3 and AZ4.
  • TR 10 in order to meet a wider range of networking requirements, such as enterprise-level networking requirements, multiple customer VPCs need to be interconnected. Specifically, multiple customer VPCs are interconnected through TR 10, and services can be accessed through TR 10. As shown in Figure 1a, customer VPC 11 and customer VPC 12 are interconnected through TR 10. In this embodiment, TR 10 does not belong to the customer VPC, it belongs to the network element instance at the system level, and can be optionally deployed in the system VPC of the cloud networking system 100. Considering that TR 10 and customer VPC are not on the same plane, one belongs to the system VPC and the other is the customer VPC.
  • VPC connection component (VPCAttachment).
  • the VPC connection component is deployed in the customer VPC and mounted under TR 10 for interconnection with TR 10, thereby realizing the interconnection between the customer VPC and TR 10.
  • a VPC connection component 11a is deployed in customer VPC 11
  • a VPC connection component 12a is deployed in customer VPC 12
  • VPC connection component 11a and VPC connection component 12a are interconnected with TR 10 respectively.
  • Mounting the VPC connection component under TR 10 means adding the identifier of the VPC connection component to TR 10 and establishing a binding relationship between TR 10 and the VPC connection component.
  • the VPC connection component is configured with default routing information pointing to TR 10. Based on the routing information, the customer VPC to TR 10 can be connected to the VPC connection component. All messages reaching the VPC connection component will be sent to TR 10.
  • the message can also be tunnel-encapsulated using the tunnel protocol used by the customer VPC.
  • the message before tunnel encapsulation is called the original message, and the message after tunnel encapsulation is called the tunnel message.
  • the VPC connection component not only has a routing function but also has a tunnel encapsulation and decapsulation function.
  • each customer VPC has its own available IP address network segment, and the service instances in the customer VPC can be allocated IP addresses from the IP address network segment of the customer VPC.
  • the service instances in the customer VPC are divided, and the service instance that initiates the access request is called the client (client), and the service instance that provides the service is called the server (Server).
  • the availability zone AZ1 in the customer VPC 11 includes the client (client), and the availability zone AZ4 in the customer VPC 12 includes the server (Server), and the client in the customer VPC 11 can access the service provided by the server in the customer VPC 12 through TR 10.
  • the service provided by the server in the customer VPC 12 is called the target service.
  • the client in the customer VPC 11 can access the target service provided by the server in the customer VPC 12 through TR 10.
  • the service access process is shown in Figure 1a, including:
  • Step 1 The client in customer VPC 11 initiates an original message to access the target service to VPC connection component 11a in customer VPC 11.
  • the original message can be a service request, but is not limited to this.
  • the original message initiated by the client has five-tuple information, in which the source IP address is the IP address of the client, the source port number is the port number of the client, the destination IP address is the IP address of the target service (or server), the destination port number is the port number of the target service (or server), and the transmission protocol can be TCP or UDP, which is not limited to this embodiment of the present application.
  • Step 2 VPC connection component 11a receives the original message initiated by the client, encapsulates the original message into a first tunnel message based on the locally pre-configured default routing information pointing to TR 10, and sends the first tunnel message to TR 10.
  • the VPC connection component 11a adds the first tunnel encapsulation information to the original message to generate a first tunnel message.
  • the first tunnel encapsulation information includes the tunnel identifier (ID) corresponding to the customer VPC 11 and the tunnel quintuple information.
  • the source IP address in the tunnel quintuple information is the IP address corresponding to the VPC connection component 11a, which can be the IP address of the VPC connection component 11a itself or the IP address of the virtual network card device carrying the VPC connection component 11a.
  • the source port number is a randomly assigned port number or a default port number.
  • the destination IP address is the IP address of TR 10, and the destination port number is the port number of TR10.
  • Step 3 TR 10 encapsulates the first tunnel message into a second tunnel message according to the pre-configured routing information between customer VPC 11 and customer VPC 12, and sends the second tunnel message to the VPC connection component 12a in customer VPC 12.
  • TR 10 replaces the first tunnel encapsulation information in the first tunnel message with the second tunnel encapsulation information to obtain the second tunnel message.
  • the second tunnel encapsulation information includes the tunnel ID corresponding to the customer VPC 12 and the tunnel quintuple information.
  • the source IP address in the tunnel quintuple information is the IP address of TR 10
  • the source port number is the port number of TR 10
  • the destination IP address is the IP address corresponding to the VPC connection component 12a, which can be the IP address of the VPC connection component 12a itself or the IP address of the virtual network card device carrying the VPC connection component 12a, and the destination port number is randomly assigned.
  • TR 10 has the functions of tunnel decapsulation and recapsulation in addition to the cross-VPC routing function.
  • Step 4 The VPC connection component 12a parses the second tunnel message to obtain the original message, and sends the original message to the server in AZ4 in the customer's VPC 12, so that the server provides the target service to the client.
  • Steps 5-8 are the reverse process of steps 1-4, and the processing operations are the same or similar, so they will not be described in detail here.
  • a security control VPC 13 is introduced in the cloud networking system 100 of the embodiment of the present application.
  • the security control VPC 13 is also a VPC with common properties and characteristics of VPC, which will not be repeated.
  • the security control VPC 13 can be provided by a third-party service provider, or by the cloud vendor of the cloud networking system 100, or by the customer to which the customer VPC belongs, without limitation.
  • the security control VPC 13 includes multiple security service nodes for providing security services to the outside world, specifically providing security services during the service visits of customer VPCs to ensure the security of customer VPCs. Through these security services, it can be configured which traffic can be released and which traffic cannot be released, that is, it needs to be filtered or discarded, thereby ensuring the security of customer VPCs visiting each other.
  • the form of security services provided by the security control VPC 13 to the outside is not limited, and accordingly, the implementation form of the security service node is not limited.
  • the security service node can be but is not limited to: a firewall, an intrusion detection and prevention system, a deep data packet inspection system, etc.
  • the security control VPC 13 can only include the same type of security service node, for example, all security service nodes are firewalls, thereby providing a security service to the outside; of course, the security control VPC 13 can also include a variety of different security service nodes at the same time, for example, the security control VPC 13 includes both firewalls and deep data packet inspection systems, thereby providing different security services to the outside, and this is not limited.
  • the security control VPC 13 includes two availability zones, namely availability zones AZ5 and AZ6, and the security service node is a firewall as an example for illustration, but it is not limited to this.
  • the availability zones included in each VPC can be the same availability zone or different availability zones.
  • availability zone AZ1 and availability zone AZ3 are the same availability zone
  • availability zone AZ2 and availability zone AZ4 are the same availability zone; of course, availability zone AZ1 and availability zone AZ3 may be different availability zones, and availability zone AZ2 and availability zone AZ4 may be different availability zones.
  • the security control VPC 13 provides security services to each customer VPC in the cloud networking system 100.
  • a gateway load balancing device (GWLB) is used in the security control VPC 13.
  • the security service node responsible for providing security services in the security control VPC 13 is mounted after the GWLB.
  • the service object exposed to the outside by the security control VPC 13 is the GWLB, thereby providing security services based on load balancing to the outside.
  • the deployment, expansion and management of the availability of security service nodes in the security control VPC 13 become simple and cost-effective.
  • the GWLB and the TR are not on the same plane, they cannot be directly interconnected.
  • the TR uses the tunnel technology, while the GWLB does not use the tunnel technology, so the two cannot be directly interconnected. Therefore, a new product object, namely the GWLB connection component (GWLB Attachment) 14, is added to the cloud networking system 100 of this embodiment as a routing medium between the TR and the GWLB to realize the interconnection between the TR and the GWLB.
  • GWLB connection component GWLB Attachment
  • the GWLB connection component of this embodiment is a network element instance with traffic forwarding function, which is a logical product object and can be considered as a special type of private link terminal endpoint. Compared with the traditional private link endpoint, this special type of endpoint has richer functions. Among them, the GWLB connection component has at least the following functions: on the one hand, the GWLB connection component 14 can be associated with the specified GWLB and can be directly connected to its associated GWLB.
  • the GWLB connection component has load balancing capability, and the traffic aggregated to the GWLB connection component can be loaded to each security service node through the GWLB for security processing; on the other hand, the GWLB connection component 14 is similar to the VPC connection component, which can be interconnected with TR 10 and can be used as the next hop of TR 10 in the routing information. When making routing configuration on TR 10, the GWLB connection component can be configured as the next hop. It can be understood that the GWLB connection component has gateway capability and has a convergence effect on the boundary traffic from the gateway TR 10 in the TR networking. In short, the GWLB connection component 14 of this embodiment integrates both gateway and load balancing capabilities.
  • the GWLB connection component also integrates tunnel encapsulation and decapsulation functions to adapt to the tunnel function of TR 10.
  • the secure routing information refers to the routing information that needs to use the security management VPC to provide security services.
  • Each secure routing information involves two customer VPCs, indicating that the traffic between the two customer VPCs needs to be securely processed.
  • the traffic between the two customer VPCs can be configured to support unidirectional security processing or bidirectional security processing.
  • the GWLB connection component 14 which is used to introduce the traffic that needs to be securely processed between the two customer VPCs into the security management VPC for security processing through the GWLB connection component 14.
  • the security routing information involves traffic between two customer VPCs, and the security routing information includes the network segment information of the two customer VPCs involved. If it is unidirectional security processing, the security routing information indicates that all traffic sent from one customer VPC to another customer VPC needs to pass through the security service node in the security control VPC 13 for security processing; if it is bidirectional security processing, the security routing information indicates that all traffic between the two customer VPCs needs to pass through the security service node in the security control VPC 13 for security processing.
  • a security routing information that supports unidirectional security processing can be configured: customer VPC 11->customer VPC 12 needs to be securely processed, and its next hop is the GWLB connection component.
  • the network segment information of customer VPC 11 and the network segment information of customer VPC 12 are included in the security routing information.
  • a secure routing information that supports bidirectional security processing can be configured: customer VPC 11->customer VPC 12 requires security processing, and customer VPC 12->customer VPC 11 requires security processing.
  • the next hop is the GWLB connection component.
  • the network segment information of customer VPC 11 and the network segment information of customer VPC 12 are included in the secure routing information.
  • TR 10 can introduce the traffic that needs to be securely processed between the two customer VPCs corresponding to the security routing information into the security management and control VPC 13 for security processing through the GWLB connection component and GWLB. That is to say, during the service access process between the two customer VPCs corresponding to the security routing information, the GWLB connection component and GWLB can use the security service node in the security management and control VPC to provide security services for the service access process, realize secure mutual access, and solve the security problems faced when customer VPCs visit each other in the TR networking scenario.
  • conventional routing information can also be configured.
  • Conventional routing information also involves two customer VPCs, but the traffic between the two customer VPCs does not need to be securely processed.
  • the service access process between the two customer VPCs can be processed according to the process described in steps 1-8 above, which will not be described in detail in the embodiments of this application.
  • any client in any customer VPC in the cloud networking system 100 can initiate service access to another customer VPC; the VPC connection component in any customer VPC can receive the original message initiated by the client in its customer VPC, encapsulate the original message into a first tunnel message, and send the first tunnel message to TR 10 based on the routing information pointing to TR 10.
  • TR 10 it can receive the first tunnel message from any customer VPC and identify whether the routing information corresponding to the first tunnel message is secure routing information; if the routing information corresponding to the first tunnel message is secure routing information, the first tunnel message is sent to the GWLB connection component 14, so as to perform security authentication on the original message using the security service node in the security control VPC 13 through GWLB.
  • TR 10 when TR 10 identifies whether the routing information corresponding to the first tunnel message is secure routing information, it can parse the original message from the first tunnel message, and determine the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message; if the source IP address in the original message is the IP address of the client, then the network segment information of the customer VPC to which the client belongs can be determined according to the IP address of the client, and the customer VPC is also the source customer VPC; accordingly, if the destination IP address in the original message is the IP address of the target service or server, then the network segment information of the customer VPC to which the target service or server belongs can be determined according to the IP address of the target service or server, and the customer VPC is also the destination customer VPC; match the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if a certain secure routing information is matched, it is determined that the routing information corresponding to the first tunnel message is secure routing information
  • the GWLB connection component 14 can receive the first tunnel message sent by the security control VPC 13, parse the original message from the first tunnel message, and send the original message to the GWLB, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication. Further optionally, the GWLB connection component 14 can also perform session management on the first tunnel message, record the session information corresponding to the first tunnel message, and the session information includes the first tunnel encapsulation information corresponding to the first tunnel message, and the five-tuple information in the original message, so as to return the first tunnel message to TR 10 through the session information when the original message passes the security authentication.
  • GWLB receives the original message sent by the GWLB connection component 14. On the one hand, it performs session management on the original message, maintains the session connection to which the original message belongs, and records the session information of the original message, which may include the five-tuple information of the original message, etc.; on the other hand, it load balances the original message to the target security service node in the security management VPC, so that the target security service node performs security authentication on the original message based on the local security policy; if the original message passes the security authentication, the target security service node generates a security message based on the original message, and returns the security message to GWLB. Optionally, if the original message fails the security authentication, the target security service node may discard the original message.
  • the security message has the same payload information as the original message and contains the five-tuple information in the original message.
  • the difference lies in the different message formats.
  • GWLB can adopt various load balancing algorithms, such as The five-tuple of the original message is hashed to load balance the original message to the target security service node in the security control VPC, and the original messages belonging to the same session can be load balanced to the same security service node as much as possible, but it is not limited to this.
  • the GWLB After receiving the security message, the GWLB returns the security message to the GWLB connection component 14; the GWLB connection component 14 is also used to receive the security message returned by the GWLB, regenerate the first tunnel message according to the session information corresponding to the first tunnel message and the security message, and return it to TR 10. Specifically, the GWLB connection component 14 can match the session information corresponding to each tunnel message according to the five-tuple information in the original message carried in the security message, so as to determine that the security message corresponds to the session information corresponding to the first tunnel message; then, according to the first tunnel encapsulation information in the session information corresponding to the first tunnel message, the security message is tunnel encapsulated to obtain the first tunnel message again.
  • the first tunnel encapsulation information can be added to the security message to obtain the first tunnel message.
  • the GWLB can determine that the first tunnel message needs to be returned to TR 10 according to the above session information, or it can also maintain routing information pointing to TR 10, and the re-encapsulated first tunnel message can be sent to TR 10 based on the routing information.
  • TR 10 will also receive the first tunnel message returned by TR.
  • the first tunnel message can be encapsulated into a second tunnel message and provided to another customer VPC that provides the target service, so that the other customer VPC provides the target service for any customer VPC that requests the target service.
  • the second tunnel encapsulation information can be determined, and the first tunnel encapsulation information corresponding to the first tunnel message is replaced with the second tunnel encapsulation information to obtain the second tunnel message.
  • the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC that requests the target service and the corresponding tunnel quintuple information
  • the source IP address in the tunnel quintuple information is the IP address corresponding to the VPC connection component in any customer VPC
  • the source port number is a randomly assigned port number or a default port number
  • the destination IP address is the IP address of TR 10
  • the destination port number is the port number of TR 10.
  • the tunnel ID corresponding to the other customer VPC can be determined; in addition, the IP address corresponding to the VPC connection component in the other customer VPC can also be determined as the destination IP address in the second tunnel encapsulation information, and the IP address points to the target service.
  • a hash algorithm or a random selection algorithm can be used to select an IP address from the multiple IP addresses.
  • the tunnel quintuple information in the first tunnel message can be hashed, and the IP address corresponding to the hash result can be determined.
  • the second tunnel encapsulation information is determined, and the second tunnel encapsulation information includes the tunnel ID corresponding to the other customer VPC providing the target service and the corresponding tunnel quintuple information
  • the source IP address in the tunnel quintuple information is the IP address of TR 10
  • the source port number is the port number of TR 10
  • the destination IP address is the IP address corresponding to the VPC connection component in the other customer VPC
  • the destination port number is a randomly assigned port number or a default port number or a default port number.
  • the IP address corresponding to the VPC connection component in another customer's VPC as the destination IP address in the second tunnel encapsulation information
  • the client and the server there is no limitation on whether the client and the server must be located in the same availability zone.
  • the application requires that the client and the server be located in the same availability zone
  • it can be determined in combination with the availability zone where the client is located.
  • an IP address located in the available zone where the client is located can be selected from multiple IP addresses corresponding to the VPC connection component in another customer VPC as the destination IP address in the second tunnel encapsulation information.
  • TR 10 can obtain the available zone information where the client is located according to the user's configuration information, or the available zone information where the client is located can be carried in the message header of the original message. TR 10 obtains the available zone information where the client is located from the message header of the original message by parsing the first tunnel message.
  • the VPC connection component parses the security message from the second tunnel message and provides the security message to the server, which provides the target service.
  • the service result can be sequentially transmitted through the VPC connection component in another customer's VPC, TR 10, and the VPC connection component in any customer VPC that initiates the service access until it reaches the client.
  • the encapsulation and decapsulation process of the message is also involved, which will not be described in detail.
  • the routing information corresponding to the first tunnel message belongs to the secure routing information.
  • the routing information corresponding to the first tunnel message may also be conventional routing information.
  • TR 10 can directly determine the second tunnel encapsulation information based on the conventional routing information corresponding to the first tunnel message, replace the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information, obtain the second tunnel message, and send the second tunnel message to the VPC connection component in another customer VPC that provides the target service; the VPC connection component parses the secure message from the second tunnel message, and provides the secure message to the server, which provides the target service.
  • the service result can be sequentially passed through the VPC connection component in another customer VPC, TR 10, and the VPC connection component in any customer VPC that initiates the service access, until it reaches the client.
  • the encapsulation and decapsulation process of the message is also involved, which will not be described in detail.
  • Step 1 The client in customer VPC 11 initiates an original message to access the target service to VPC connection component 11a in customer VPC 11.
  • the original message can be a service request, but is not limited to this.
  • Step 2 VPC connection component 11a receives the original message initiated by the client, encapsulates the original message into a first tunnel message based on the locally pre-configured default routing information pointing to TR 10, and sends the first tunnel message to TR 10.
  • TR 10 receives the first tunnel message sent by the VPC connection component 11a, and sends the first tunnel message to the GWLB connection component 14 when the routing information corresponding to the first tunnel message is secure routing information.
  • step 2.2 the GWLB connection component 14 receives the first tunnel message sent by the security control VPC 13, parses the original message from the first tunnel message, and sends the original message to the GWLB.
  • the GWLB receives the original message sent by the GWLB connection component 14, and load balances the original message to the target security service node in the security management VPC, so that the target security service node performs security authentication on the original message based on the local security policy.
  • Step 2.4 When the original message passes the security authentication, the target security service node generates a security message based on the original message and returns the security message to the GWLB.
  • Step 2.5 after receiving the security message, the GWLB returns the security message to the GWLB connection component 14.
  • Step 2.6 after receiving the security message, the GWLB connection component 14 regenerates the first tunnel message and returns it to TR 10.
  • Step 3 TR 10 encapsulates the first tunnel message into a second tunnel message based on the pre-configured security routing information between customer VPC 11 and customer VPC 12, and sends the second tunnel message to the VPC connection component 12a in customer VPC 12.
  • Step 4 The VPC connection component 12a parses the second tunnel message to obtain a secure message, and sends the secure message to the server in AZ4 in the customer's VPC 12, so that the server provides the target service to the client.
  • Step 5 The server returns the service result to the VPC connection component 12a.
  • Step 6 VPC connection component 12a encapsulates the service result into a third tunnel message and sends it to TR 10.
  • the third tunnel encapsulation information corresponding to the third tunnel message includes the tunnel ID corresponding to the customer VPC 12 and the tunnel quintuple information.
  • the source IP address in the tunnel quintuple information is the IP address corresponding to the VPC connection component 12a, the source port number is a randomly assigned port number, the destination IP address is the IP address of TR 10, and the destination port number is the port number of TR 10.
  • Step 7 TR 10 encapsulates the third tunnel message into the fourth tunnel message and sends it to the VPC connection component 11a.
  • step 7 if the pre-configured security routing information between customer VPC 11 and customer VPC 12 requires one-way security processing, then after receiving the third tunnel message sent by VPC connection component 12a, TR 10 directly encapsulates the third tunnel message into a fourth tunnel message and sends it to VPC connection component 11a.
  • TR 10 may process the third tunnel message with reference to the process of steps 2.1-2.6, and when receiving the third tunnel message returned by GWLB connection component 14, execute the operation of encapsulating the third tunnel message into a fourth tunnel message and sending it to VPC connection component 11a in step 7.
  • the process of processing the third tunnel message with reference to steps 2.1-2.6 is the same or similar to the process of processing the first tunnel message, and will not be repeated here.
  • the fourth tunnel encapsulation information includes the tunnel ID corresponding to the customer VPC 11 and the tunnel quintuple information, wherein the source IP address in the tunnel quintuple information is the IP address of TR 10, the source port number is the port number of TR 10, the destination IP address is the IP address corresponding to the VPC connection component 11a, and the destination port number is a randomly assigned port number.
  • Step 8 The VPC connection component 11a parses the fourth tunnel message, obtains a service result, and sends the service result to the client.
  • routing information corresponding to the first tunnel message is conventional routing information
  • steps 2.1-2.6 may be skipped and steps 3-8 may be directly performed.
  • a security control VPC is introduced, GWLB is used in the security control VPC, and GWLB is used as an exposed object for providing security services to the outside world; since GWLB and TR are no longer on the same plane, a new product object, namely the GWLB connection component, is further added to the networking system as
  • the routing medium between TR and GWLB realizes the interconnection between TR and GWLB, and by configuring the default secure routing information pointing to the GWLB connection component on TR, it is possible to provide security services during the service access between the two customer VPCs corresponding to the secure routing information, realize secure mutual access, and solve the security problems faced by mutual access between customer VPCs in the TR networking scenario.
  • an intermediate VPC can also be added between TR and GWLB in the manner shown in FIG. 1b, and the VPC connection component and the terminal node corresponding to GWLB (Gateway Load Balancer endpoint, GWLBe) are deployed in the intermediate VPC, GWLBe is interconnected with GWLB, GWLBe is interconnected with the VPC connection component, and the VPC connection component is interconnected with TR 10.
  • the intermediate VPC includes two availability zones AZ7 and AZ8 as an example, but it is not limited to this. In the system shown in FIG.
  • the secure access process between TR and the firewall includes steps 3.1 to 3.8, and it is necessary to pass through the VPC connection component, GWLBe, and GWLB in the intermediate VPC in sequence to reach the firewall.
  • the traffic forwarding path is relatively long and the transmission delay is relatively large, but it can also realize the access of security services in the TR networking scenario and solve the security problem of cross-VPC service mutual access in the TR networking scenario.
  • a VPC connection component and GWLBe Compared with the method of interconnecting TR and GWLB through an intermediate VPC, a VPC connection component and GWLBe, in an embodiment of the present application, a GWLB connection component is directly added between TR and GWLB, and the GWLB connection component is used to interconnect TR and GWLB, which is beneficial to simplify the access implementation of security services in the TR networking scenario; and the mutual access traffic between customer VPCs only needs to flow into GWLB through TR and GWLB connection components to use security services.
  • the traffic forwarding path is shorter, which is beneficial to reduce the transmission delay on the path.
  • Step 3.1 TR sends the first tunnel message to the VPC connection component in the intermediate VPC
  • Step 3.2 the VPC connection component in the intermediate VPC parses the original message from the first tunnel message and sends the original message to GWLBe
  • Step 3.3 GWLBe sends the original message to GWLB
  • Step 3.4 GWLB load balances the original message to the security service node (such as a firewall) for security authentication
  • Step 3.5 if the original message passes the security authentication, the security service node generates a security message based on the original message and sends the security message to GWLB
  • Step 3.6 GWLB sends the security message to GWLBe
  • Step 3.7, GWLBe sends the security message to the VPC connection component in the intermediate VPC
  • Step 3.8 the VPC connection component in the intermediate VPC re-encapsulates the security message into the first tunnel message and returns it to TR.
  • Steps 1-8 in Figure 1b are the same or similar to steps
  • the GWLB connection component is a network element instance with traffic forwarding function, which is a logical product object. Its traffic forwarding function can be carried by a virtual network card device. Accordingly, the security routing information and the conventional routing information are configured on the virtual network card device, and the virtual network card device is interconnected with the TR.
  • the GWLB connection component does not belong to the customer VPC or the security control VPC, but to the system VPC. The GWLB connection component is invisible to the customer, so it does not need to consume the virtual network card resources in each customer VPC and the security control VPC, which is conducive to saving the network card resources of the customer VPC.
  • the VPC connection component in the customer VPC also has a traffic forwarding function, which can be carried by the virtual network card device.
  • the routing information pointing to the TR is also configured on the virtual network card device.
  • the card device is interconnected with TR.
  • the VPC connection component in the customer VPC may include a virtual network card device corresponding to each availability zone, that is, at least one virtual network card device may be configured for each availability zone.
  • one availability zone corresponds to one virtual network card device.
  • Each virtual network card device is responsible for receiving the original message initiated by the client in its corresponding availability zone requesting access to the target service, encapsulating the original message into a first tunnel message, and sending the first tunnel message to TR based on the routing information pointing to TR.
  • the virtual network card device also has the tunnel encapsulation and decapsulation function, and can add the first tunnel encapsulation information to the original message to generate a first tunnel message.
  • the first tunnel encapsulation information includes the tunnel identification ID corresponding to the customer VPC to which the virtual network card device belongs, the source IP address is the IP address of the virtual network card device, and the destination IP address is the IP address of TR.
  • the virtual network card device can use an elastic network interface (ENI).
  • ENI is a virtual network card bound to various VPCs (such as customer VPCs and system VPCs).
  • VPCs such as customer VPCs and system VPCs.
  • ENI will provide a private IP address for the VPC connection component or GWLB connection component bound to it.
  • the private IP address can be an IP address in the VPC where the ENI is located, that is, the IP address of the VPC connection component or GWLB connection component it carries.
  • the main function of ENI is to interconnect with TR and forward traffic with TR.
  • the cloud networking system of this embodiment also includes: a management and control node.
  • the management and control node belongs to a control plane node, which is used to provide a human-computer interaction interface for customers, receive various requests from customers, and respond to customer requests.
  • the management and control node can respond to the creation request of the forwarding router to create a TR in the system VPC; and respond to the routing configuration operation to configure at least one security routing information on the created TR; in addition, VPC connection components are deployed in the two customer VPCs corresponding to each security routing information, and the identifier of the deployed VPC connection component is added to the TR to establish an association relationship between the VPC connection component and the TR.
  • a GWLB connection component can also be created for the GWLB service through the management and control node.
  • the control node can also respond to the creation request of the GWLB connection component, deploy the GWLB connection component in the system VPC, and specify the GWLB associated with the GWLB connection component.
  • the GWLB points to the security control service; further, it is necessary to add the identifier of the GWLB connection component on the TR to establish a corresponding relationship between the TR and the GWLB connection component, so that the GWLB connection component can be used as the next hop in the security routing information.
  • the creation process of the GWLB connection component and the TR are relatively independent, and customers can flexibly create them according to application requirements.
  • each TR has its own corresponding GWLB connection component, and the GWLB connection components corresponding to multiple TRs can be associated with the same GWLB, that is, multiple TRs can use the services provided by the VPC where the same GWLB is located.
  • the cloud networking system provided in the embodiment of the present application is not only applicable to the scenario of introducing a security control VPC, but can also be extended to the scenario of introducing any intermediate service VPC based on GWLB.
  • the intermediate service VPC refers to a VPC that can provide some intermediate services during the service exchange process between customer VPCs through TR, such as data cleaning services, data computing services, or security services.
  • the embodiment of the present application also provides another A cloud networking system
  • the cloud networking system includes a TR, and multiple customer VPCs interconnected with the TR; multiple customer VPCs perform service mutual access through the TR; further, the cloud networking system also includes: an intermediate service VPC, the intermediate service VPC includes a GWLB and multiple intermediate service nodes interconnected with the GWLB, which are used to provide intermediate services to the outside.
  • a GWLB connection component is also deployed in the cloud networking system, and the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively. Based on this, at least one security routing information pointing to the GWLB connection component is configured on the TR by default.
  • the TR can use the intermediate service nodes in the intermediate service VPC to provide intermediate services for the service access process through the GWLB connection component and the GWLB during the service access process between the two customer VPCs corresponding to each security routing information.
  • the TR can use the intermediate service nodes in the intermediate service VPC to provide intermediate services for the service access process through the GWLB connection component and the GWLB during the service access process between the two customer VPCs corresponding to each security routing information.
  • the embodiments of the present application also provide the following security access methods, which are described from the perspectives of TR, GWLB connection components and VPC connection components, respectively.
  • security access methods which are described from the perspectives of TR, GWLB connection components and VPC connection components, respectively.
  • TR GWLB connection components
  • VPC connection components respectively.
  • FIG2a is a flow chart of a secure access method provided by an exemplary embodiment of the present application. The method is described from the perspective of a forwarding router TR. As shown in FIG2a, the method includes:
  • the routing information corresponding to the first tunnel message is secure routing information
  • the first tunnel message is sent to the GWLB connection component in the cloud networking system, so that the original message is securely authenticated by the GWLB in the security control VPC using the security service node in the security control VPC.
  • a new product object namely, a GWLB connection component
  • the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively.
  • GWLB is interconnected with the security service node.
  • At least one security routing information pointing to the GWLB connection component by default is pre-configured on the TR.
  • Each security routing information involves two customer VPCs, indicating that the traffic between the two customer VPCs needs to be securely processed.
  • the traffic between the two customer VPCs can be configured to support unidirectional security processing or bidirectional security processing.
  • the security routing information involves traffic between two customer VPCs, and the security routing information includes the network segment information of the two customer VPCs involved. If it is a one-way security processing, the security routing information indicates that all traffic sent from one customer VPC to another customer VPC needs to be securely processed by the security service node in the security control VPC; if it is a two-way security processing, the security routing information indicates that all traffic between the two customer VPCs needs to be securely processed by the security service node in the security control VPC 13. Based on this, TR can provide security services for the service access process through the GWLB connection component and the GWLB using the security service node in the security control VPC during the service access process between the two customer VPCs corresponding to each security routing information.
  • the TR may receive a first tunnel message from any customer VPC in the cloud networking system, wherein the first tunnel message is tunnel blocked according to an original message from any customer VPC requesting a target service from another customer VPC. if the routing information corresponding to the first tunnel message belongs to secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system, so as to perform security authentication on the original message through the GWLB in the security control VPC using the security service node in the security control VPC.
  • the method also includes: a step of identifying whether the routing information corresponding to the first tunnel message belongs to secure routing information.
  • This step specifically includes: parsing the original message from the first tunnel message, determining the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message; matching the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if there is a match, determining that the routing information corresponding to the first tunnel message is secure routing information.
  • the method also includes: receiving a first tunnel message returned by the GWLB connection component, the first tunnel message being regenerated by the GWLB connection component based on a security message returned by the GWLB when the original message passes security authentication, and the security message being generated by a security service node in a security control VPC based on the original message when the original message passes security authentication; encapsulating the first tunnel message into a second tunnel message, and providing it to another customer VPC, so that the other customer VPC provides the target service for any customer VPC.
  • the above-mentioned encapsulation of the first tunnel message into the second tunnel message includes: according to the security routing information corresponding to the first tunnel message, replacing the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information to obtain the second tunnel message;
  • the second tunnel encapsulation information includes the tunnel identification ID corresponding to another customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of TR, and the destination IP address is the IP address corresponding to the VPC connection component in another customer VPC;
  • the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any customer VPC, and the destination IP address is the IP address of TR.
  • a new product object namely, the GWLB connection component
  • the cloud networking system as a routing medium between TR and GWLB to realize the interconnection between TR and GWLB, and by configuring the security routing information pointing to the GWLB connection component by default on TR, it is possible to provide security services during the service access process of the two customer VPCs corresponding to the security routing information, realize secure mutual access, and solve the security problems faced when customer VPCs visit each other in the TR networking scenario.
  • FIG2b is a flow chart of another secure access method provided by an exemplary embodiment of the present application; the method is described from the perspective of the GWLB connection component, as shown in FIG2b , the method includes:
  • a new product object namely, a GWLB connection component
  • the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively.
  • GWLB is interconnected with the security service node.
  • TR can receive a first tunnel message from any customer VPC in the cloud networking system, where the first tunnel message is obtained by tunnel encapsulating the original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message is secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system.
  • the GWLB connection component in addition to being interconnected with TR and GWLB respectively, can also receive the first tunnel message sent by TR in the cloud networking system, parse the original message from the first tunnel message, and send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication.
  • the GWLB connection component also has the functions of sending and receiving messages and decapsulating (or parsing).
  • the method also includes: before sending the original message to the GWLB, recording the session information corresponding to the first tunnel message; and after sending the original message to the GWLB, receiving the security message returned by the GWLB, the security message is generated by the security service node in the security control VPC according to the original message and provided to the GWLB when the original message passes the security authentication; further, regenerating the first tunnel message according to the session information and the security message corresponding to the first tunnel message, and returning it to the TR, so that the TR encapsulates the first tunnel message into the second tunnel message and provides it to another customer VPC, thereby enabling the other customer VPC to provide the target service for any of the customer VPCs.
  • the GWLB connection component also has functions such as message encapsulation and session recording and maintenance.
  • a new product object namely, the GWLB connection component
  • the cloud networking system as a routing medium between TR and GWLB to realize the interconnection between TR and GWLB, and by configuring the security routing information pointing to the GWLB connection component by default on TR, it is possible to provide security services during the service access process of the two customer VPCs corresponding to the security routing information, realize secure mutual access, and solve the security problems faced when customer VPCs visit each other in the TR networking scenario.
  • FIG2c is a flow chart of another secure access method provided by an exemplary embodiment of the present application; the method is described from the perspective of a VPC connection component. As shown in FIG2c, the method includes:
  • a new product object namely, a GWLB connection component
  • the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively.
  • GWLB is interconnected with the security service node.
  • a client in a customer VPC When a client in a customer VPC requests to access a target service, it sends an original message to the VPC connection component.
  • the VPC connection component receives the original message and encapsulates the original message into a first tunnel message based on the pre-configured routing information pointing to the TR.
  • the first tunnel message is sent to the TR.
  • the TR can receive the first tunnel message. If the route corresponding to the first tunnel message is Since the information belongs to secure routing information, the first tunnel message is sent to the GWLB connection component in the cloud networking system.
  • the GWLB connection component receives the first tunnel message sent by the TR, parses the original message from the first tunnel message, and sends the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication.
  • a new product object namely, the GWLB connection component
  • the cloud networking system as a routing medium between TR and GWLB to realize the interconnection between TR and GWLB, and by configuring the security routing information pointing to the GWLB connection component by default on TR, it is possible to provide security services during the service access process of the two customer VPCs corresponding to the security routing information, realize secure mutual access, and solve the security problems faced when customer VPCs visit each other in the TR networking scenario.
  • Fig. 3a is a schematic diagram of the structure of a secure access device provided by an exemplary embodiment of the present application.
  • the device can be implemented in a forwarding router TR in a cloud networking system, as shown in Fig. 3a, the device includes: a storage module 31a, a receiving module 32a and a sending module 33a.
  • the storage module 31a is used to store at least one piece of security routing information that points to the GWLB connection component in the cloud networking system by default.
  • the receiving module 32a is used to receive a first tunnel message from any customer VPC in the cloud networking system, and the first tunnel message is obtained by tunnel encapsulation based on the original message from any customer VPC requesting the target service from another customer VPC.
  • the sending module 33a is used to send the first tunnel message to the GWLB connection component when the routing information corresponding to the first tunnel message belongs to the security routing information, so as to perform security authentication on the original message through the GWLB in the security control VPC using the security service node in the security control VPC; wherein the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.
  • the device further includes: a parsing module, used to parse the original message from the first tunnel message, and determine the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message. And a matching module, used to match the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if there is a match, determining that the routing information corresponding to the first tunnel message is secure routing information.
  • a parsing module used to parse the original message from the first tunnel message, and determine the network segment information of the source customer VPC and the destination customer VPC according to the source IP address and the destination IP address in the original message.
  • a matching module used to match the network segment information of the source customer VPC and the destination customer VPC in at least one secure routing information; if there is a match, determining that the routing information corresponding to the first tunnel message is secure routing information.
  • the receiving module 32a is further used to: receive a first tunnel message returned by the GWLB connection component, the first tunnel message is regenerated by the GWLB connection component according to the security message returned by the GWLB when the original message passes the security authentication, and the security message is generated according to the original message.
  • the sending module 33a is further used to: encapsulate the first tunnel message into a second tunnel message, and provide it to another customer VPC, so that the other customer VPC provides the target service for any customer VPC.
  • the sending module 33a when the sending module 33a encapsulates the first tunnel message into the second tunnel message, it is specifically used to: replace the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information according to the security routing information corresponding to the first tunnel message, so as to obtain the second tunnel message;
  • the second tunnel encapsulation information includes the tunnel identification ID corresponding to another customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of TR, and the destination IP address is the IP address corresponding to the VPC connection component in another customer VPC;
  • the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any customer VPC, and the destination IP address is the IP address of TR.
  • Fig. 3b is a schematic diagram of the structure of another secure access device provided by an exemplary embodiment of the present application.
  • the device can be implemented in a GWLB connection component in a cloud networking system, as shown in Fig. 3b, the device includes: a decapsulation module 31b, a receiving module 32b and a sending module 33b.
  • the receiving module 32b is used to receive the first tunnel message sent by the forwarding router TR in the cloud networking system.
  • the first tunnel message is obtained by tunnel encapsulation based on the original message from any customer VPC in the cloud networking system requesting the target service to another customer VPC.
  • the decapsulation module 31b is used to parse the original message from the first tunnel message.
  • the sending module 33b is used to send the original message to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication.
  • the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected with TR and GWLB respectively, and GWLB is interconnected with the security service node.
  • the device further includes: an encapsulation module and a session management module.
  • the session management module is used to record the session information corresponding to the first tunnel message before sending the original message to the GWLB.
  • the receiving module 32b is also used to: after sending the original message to the GWLB, receive the security message returned by the GWLB, the security message is generated based on the original message when the original message passes the security authentication.
  • the encapsulation module is used to: regenerate the first tunnel message based on the session information and the security message corresponding to the first tunnel message.
  • the sending module 33b is also used to: return the first tunnel message to the TR, so that the TR encapsulates the first tunnel message into the second tunnel message and provides it to another customer VPC.
  • Fig. 3c is a schematic diagram of the structure of another secure access device provided by an exemplary embodiment of the present application.
  • the device can be implemented in a VPC connection component in a cloud networking system, as shown in Fig. 3c, the device includes: an encapsulation module 31c, a receiving module 32c and a sending module 33c.
  • the receiving module 32c is used to receive an original message from a client in the customer VPC where the VPC connection component is located, requesting to access the target service.
  • the encapsulation module 31c is used to encapsulate the original message into a first tunnel message according to the pre-configured routing information pointing to the forwarding router TR.
  • the sending module 33c is used to send the first tunnel message to the TR, so as to perform service mutual access with another customer VPC that provides the target service in the cloud networking system through the TR.
  • Fig. 4 is a schematic diagram of the structure of a forwarding router provided by an exemplary embodiment of the present application.
  • the forwarding router can be implemented as a cloud computing device, including: a memory 41, a processor 42 and a communication component 43.
  • the memory 41 is used to store computer programs and can be configured to store various other data to support operations on the forwarding router. Examples of such data include instructions for any application or method operating on the forwarding router, Messages, pictures, videos, etc. Further, the memory 41 is also used to store at least one piece of security routing information pointing to the GWLB connection component in the cloud networking system by default.
  • the processor 42 is coupled to the memory 41 and is used to execute the computer program in the memory 41, so as to provide security services for the service access process through the GWLB connection component in the security control VPC and the GWLB using the security service node in the security control VPC during the service access process between the two customer VPCs corresponding to each security routing information.
  • the GWLB connection component serves as a routing medium between the TR and the GWLB, and is interconnected with the TR and the GWLB respectively, and the GWLB is interconnected with the security service node.
  • the processor 42 is specifically used to: receive a first tunnel message from any customer VPC in the cloud networking system through the communication component 43, the first tunnel message being obtained by tunnel encapsulating an original message from any customer VPC requesting a target service from another customer VPC; if the routing information corresponding to the first tunnel message is security routing information, send the first tunnel message to the GWLB connection component in the cloud networking system, so as to perform security authentication on the original message through the GWLB in the security control VPC using the security service node in the security control VPC.
  • the processor 42 is also used to: parse the original message from the first tunnel message, determine the network segment information of the source customer VPC and the destination customer VPC based on the source IP address and the destination IP address in the original message; match at least one secure routing information based on the network segment information of the source customer VPC and the destination customer VPC; if there is a match, determine that the routing information corresponding to the first tunnel message is secure routing information.
  • the processor 42 is also used to: receive a first tunnel message returned by the GWLB connection component through the communication component 43, the first tunnel message is regenerated by the GWLB connection component based on the security message returned by the GWLB when the original message passes security authentication, and the security message is generated based on the original message; encapsulate the first tunnel message into a second tunnel message, and provide it to another customer VPC, so that the other customer VPC provides the target service for any customer VPC.
  • the processor 42 is specifically used to: replace the first tunnel encapsulation information corresponding to the first tunnel message with the second tunnel encapsulation information according to the security routing information corresponding to the first tunnel message, to obtain the second tunnel message;
  • the second tunnel encapsulation information includes the tunnel identification ID corresponding to another customer VPC, and the source IP address in the second tunnel encapsulation information is the IP address of TR, and the destination IP address is the IP address corresponding to the VPC connection component in another customer VPC;
  • the first tunnel encapsulation information includes the tunnel ID corresponding to any customer VPC, and the source IP address of the first tunnel encapsulation information is the IP address corresponding to the VPC connection component in any customer VPC, and the destination IP address is the IP address of TR.
  • the forwarding router also includes other components such as a power supply component 44.
  • Fig. 4 only schematically shows some components, which does not mean that the forwarding router only includes the components shown in Fig. 4.
  • an embodiment of the present application further provides a computer-readable storage medium storing a computer program.
  • the processor is enabled to implement each step that can be executed by the TR in the above method embodiment.
  • the embodiment of the present application provides a cloud computing device, which has the same or similar structure as the forwarding router shown in FIG4, so it is not shown in the figure.
  • the cloud computing device provided in this embodiment can be implemented as a GWLB connection component in a cloud networking system, including a memory and a processor, the memory is used to store a computer program, the processor is coupled to the memory, and is used to execute the computer program stored in the memory, so as to: receive a first tunnel message sent by a forwarding router TR in the cloud networking system, the first tunnel message is based on any customer VPC in the cloud networking system
  • the original message that requests the target service from another customer VPC is tunnel-encapsulated; the original message is parsed from the first tunnel message, and the original message is sent to the GWLB in the security control VPC, so that the GWLB load balances the original message to the security service node in the security control VPC for security authentication;
  • the GWLB connection component serves as a routing medium between TR and GWLB, and is interconnected
  • the processor is also used to: record the session information corresponding to the first tunnel message before sending the original message to the GWLB; and after sending the original message to the GWLB, receive the security message returned by the GWLB, where the security message is generated based on the original message when the original message passes the security authentication; regenerate the first tunnel message based on the session information corresponding to the first tunnel message and the security message, and return it to the TR, so that the TR encapsulates the first tunnel message into a second tunnel message and provides it to another customer VPC.
  • an embodiment of the present application further provides a computer-readable storage medium storing a computer program.
  • the processor When the computer program is executed by a processor, the processor is enabled to implement each step that can be performed by the GWLB connection component in the above method embodiment.
  • the embodiment of the present application provides a cloud computing device, which has the same or similar structure as the forwarding router shown in FIG4, so it is not shown in the figure, and the details can be seen in FIG4.
  • the cloud computing device provided in this embodiment can be implemented as a VPC connection component in a cloud networking system, including a memory and a processor, the memory is used to store a computer program, the processor is coupled to the memory, and is used to execute the computer program stored in the memory, so as to: receive an original message from a client in a customer VPC where the VPC connection component is located to request access to a target service; encapsulate the original message into a first tunnel message according to the pre-configured routing information pointing to the forwarding router TR; send the first tunnel message to TR, so as to perform service mutual access with another customer VPC providing the target service in the cloud networking system through TR.
  • an embodiment of the present application also provides a computer-readable storage medium storing a computer program.
  • the processor When the computer program is executed by a processor, the processor is enabled to implement each step that can be performed by the VPC connection component in the above method embodiment.
  • the memory in the above embodiments can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory magnetic memory
  • flash memory magnetic disk or optical disk.
  • the communication component in the above-mentioned embodiment is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices.
  • the device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G/LTE, 5G and other mobile communication networks, or a combination thereof.
  • the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel.
  • the communication component also includes a near field communication (NFC) module to facilitate short-range communication.
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • the power supply assembly in the above embodiments provides power to various components of the device where the power supply assembly is located.
  • the power supply assembly may include a power management system, one or more power supplies, and other components related to generating, managing and distributing power to the device where the power supply assembly is located. Force-related components.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.
  • a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.
  • processors CPU
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information.
  • Information can be computer readable instructions, data structures, program modules or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

Abstract

Les modes de réalisation de la présente demande concernent un système de bureau en nuage, un procédé d'accès sécurisé, ainsi qu'un dispositif et un support de stockage. Dans les modes de réalisation de la présente demande, un VPC de commande de sécurité est introduit dans un système de réseau à base de TR, un GWLB est utilisé dans le VPC de commande de sécurité, et le GWLB est utilisé comme objet exposé pour fournir un service de sécurité à l'extérieur ; comme le GWLB et un TR ne se situent pas dans le même plan, un nouvel objet de produit, c'est-à-dire un rattachement GWLB, est également ajouté au système de réseau pour servir de support de routage entre le TR et le GWLB, ce qui permet de réaliser l'interconnexion entre le TR et le GWLB ; et le TR est configuré avec des informations de routage de sécurité qui sont dirigées vers le rattachement GWLB par défaut, de sorte qu'un service de sécurité peut être fourni tandis que deux VPC clients correspondant aux informations de routage de sécurité effectuent un accès à un service, ce qui permet de réaliser un accès mutuel sécurisé et de résoudre le problème de sécurité lorsque les VPC clients effectuent un accès mutuel dans un scénario de réseau TR. De plus, la présente demande facilite également la simplification de la mise en œuvre d'accès du service de sécurité dans le scénario de réseau TR, et un trajet de transfert de trafic est relativement court, ce qui contribue à réduire un retard de transmission sur le trajet.
PCT/CN2023/120291 2022-09-26 2023-09-21 Système de réseau en nuage, procédé d'accès sécurisé, et dispositif et support de stockage WO2024067338A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211177346.X 2022-09-26
CN202211177346.XA CN115913617A (zh) 2022-09-26 2022-09-26 云组网系统、安全访问方法、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2024067338A1 true WO2024067338A1 (fr) 2024-04-04

Family

ID=86479504

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/120291 WO2024067338A1 (fr) 2022-09-26 2023-09-21 Système de réseau en nuage, procédé d'accès sécurisé, et dispositif et support de stockage

Country Status (2)

Country Link
CN (1) CN115913617A (fr)
WO (1) WO2024067338A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115913617A (zh) * 2022-09-26 2023-04-04 阿里巴巴（中国）有限公司 云组网系统、安全访问方法、设备及存储介质
CN116545875A (zh) * 2023-04-17 2023-08-04 上海米斯里通讯科技有限公司 基于物联网的安全通信控制系统

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180219951A1 (en) * 2017-02-01 2018-08-02 Amazon Technologies, Inc. Service endpoint interconnect in a virtual private gateway
CN115913617A (zh) * 2022-09-26 2023-04-04 阿里巴巴（中国）有限公司 云组网系统、安全访问方法、设备及存储介质

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180219951A1 (en) * 2017-02-01 2018-08-02 Amazon Technologies, Inc. Service endpoint interconnect in a virtual private gateway
CN115913617A (zh) * 2022-09-26 2023-04-04 阿里巴巴（中国）有限公司 云组网系统、安全访问方法、设备及存储介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
AWS TEAM: "Centralized deep inspection of network traffic using Gateway Load Balancer and Palo Alto Firewall", AMAZON AWS OFFICIAL BLOG, 16 July 2021 (2021-07-16), XP093153905, Retrieved from the Internet <URL:https://aws.amazon.com/cn/blogs/china/centralized-network-traffic-depth-detection-using-gateway-load-balancer-and-palo-alto-firewalls/> *
BOBO5620301HOTM: "使用Gateway Load Balancer和Palo alto防火墙实现集中的网络流量检测", 10 October 2021 (2021-10-10), XP093153904, Retrieved from the Internet <URL:https://blog.51cto.com/bobo5620301/4151964> *

Also Published As

Publication number Publication date
CN115913617A (zh) 2023-04-04

Similar Documents

Publication Publication Date Title
CN112470436B (zh) 用于提供多云连通性的系统、方法、以及计算机可读介质
US11563681B2 (en) Managing communications using alternative packet addressing
US8885649B2 (en) Method, apparatus, and system for implementing private network traversal
US11671365B2 (en) Associating route tables with ingress traffic to logically isolated networks
US20190132251A1 (en) Method and system for supporting multiple qos flows for unstructured pdu sessions
WO2024067338A1 (fr) Système de réseau en nuage, procédé d&#39;accès sécurisé, et dispositif et support de stockage
US20170026417A1 (en) Systems, methods, and devices for smart mapping and vpn policy enforcement
US11757773B2 (en) Layer-2 networking storm control in a virtualized cloud environment
JP2018125837A (ja) ドメイン間のシームレスサービス機能チェーン
US20220116310A1 (en) Scalable routing and forwarding of packets in cloud infrastructure
TW201815131A (zh) 一種資料傳輸的方法及網路設備
CN111492627A (zh) 为不同应用建立不同隧道的基于控制器的服务策略映射
WO2015039617A1 (fr) Procédé, système et dispositif pour traitement de paquet
US11671483B2 (en) In-band protocol-based in-network computation offload framework
US20230041806A1 (en) Location-independent programming data plane for packet processing
WO2023165137A1 (fr) Système et procédé de communication de réseau entre des grappes
US20230024408A1 (en) Efficient flow management utilizing control packets
CN114500176B (zh) 用于vpn的多流负载均衡方法、装置、系统及存储介质
JP2023543831A (ja) マイクロサービスベースのサービスメッシュシステムおよびサービス指向アーキテクチャ管理方法
US20240121186A1 (en) Layer-2 networking using access control lists in a virtualized cloud environment
EP3503484B1 (fr) Procédés et dispositifs de transmission de messages
JP2021510974A (ja) アンカーレス・バックホールのサポートのためのｇｔｐトンネル
CN115150312B (zh) 一种路由方法及设备
US20230370371A1 (en) Layer-2 networking storm control in a virtualized cloud environment
WO2022206667A1 (fr) Procédé de routage et dispositif