TECHNICAL FIELD

The present invention relates to the field of IT technologies, and in particular, to a method for a virtual machine to access a physical server in a cloud computing system, an apparatus, and a system.

BACKGROUND

In a cloud computing environment, some services such as an Oracle database (DB) need to be directly run on a physical server due to factors such as a configuration or performance. A user logs in to a virtual machine (VM), and accesses, over a network, a physical server on which a service of the foregoing type is deployed.

In the prior art, a VM needs to obtain an IP address of a physical server to access various services on the physical server. When the VM can obtain a real IP address of a physical server or physical server cluster hosting a service, network planning information of the physical server on which the service of a cloud platform is located is exposed. A malicious user may perform a network attack on a network in which the physical server is located and a device in the network, threatening security of the cloud platform.

SUMMARY

Embodiments of the present invention describe a method for a virtual machine to access a physical server, an apparatus, and a system, to prevent the virtual machine from obtaining a real address of the physical server and threatening network security.

According to one aspect, an embodiment of the present invention provides a system for a virtual machine to access a physical server. The system includes a cloud platform, at least one physical server, at least one host, and at least one access network element. The host, the physical server, and the cloud platform communicate with each other, at least one virtual machine runs on the host, the virtual machine accesses the physical server by using the access network element, and a service is deployed on the physical server. The cloud platform allocates, to the service, a publishing IP address and a publishing port that correspond to the service, establish a correspondence between the publishing IP address and the publishing port and an IP address and a port that are of the physical server running the service, and publishes the service, so that the service is visible to the virtual machine. The cloud platform sends, to the access network element, a network address translation (NAT) rule associated with the virtual machine, where the NAT rule includes the correspondence between the publishing IP address and the publishing port and the IP address and port of the physical server running the service. The access network element receives a service access request sent by the virtual machine, replaces, according to the NAT rule, a destination address of the service access request with the IP address and the port that are of the physical server, routes the modified service access request to the physical server, and receives a service response message returned by the physical server. According to the foregoing process, the virtual machine can access the service without knowing the IP address and the port that are of the physical server on which the service is deployed. In addition, because the service may be uniquely identified by using the publishing IP address and the publishing port that correspond to the service, even if the service is deployed on different physical servers or physical server clusters having a plurality of IP addresses, different virtual machines all can access the same service by using the same publishing IP address and publishing port without paying attention to real IP addresses and ports of the physical servers or physical server clusters in which the service is actually located, thereby implementing a unified service access mode.

In a possible embodiment, a source address of the service response message is the IP address and the port that are of the physical server. When receiving the service response message returned by the physical server, the access network element may further replace, according to the NAT rule, the source address of the service response message with the publishing IP address and the publishing port that correspond to the service, and send the modified service response message to the virtual machine, so that the service response message received by the virtual machine still does not include the real address of the physical server. It should be noted that the source address of the service response message sent by the cloud platform may alternatively be directly set to the publishing IP address and the publishing port, and the access network element does not need to modify the source address. When a source address of a service response packet sent by the physical server is the real address of the physical server, the physical server does not need to be modified to be adapted to this embodiment of the present invention, thereby increasing service deployment and publishing efficiency. When the source address of the service response packet sent by the physical server is the publishing IP address and the publishing port that correspond to the service, adaptive modification needs to be performed on the physical server, and a correspondence between the service and the publishing IP address and the publishing port is recorded. When the physical server sends the service response packet, the source address of the service response packet is set to the publishing IP address and the publishing port. In this case, the access network element does not need to perform NAT translation on the source address of the service response packet, thereby increasing efficiency of accessing, by the virtual machine, the service deployed on the physical server. On the other hand, because the physical server needs to be modified to implement the solution in this embodiment of the present invention, the service deployment and publishing efficiency is reduced.

In a possible embodiment, the cloud platform may externally publish the service in a plurality of manners. It should be noted that the cloud platform has a user-oriented service presentation interface and an O&M engineer-oriented management presentation interface. A user may log in to the service presentation interface, to browse various services provided by the cloud platform, and initiate a service application. The cloud platform displays service information on the service presentation interface, and introduces the service to the user. The service information includes an external display address of the service.

In a possible embodiment, the external display address of the service may be the publishing IP address and the publishing port, or may be a domain name corresponding to the service. When the external display address is the publishing IP address and the publishing port, the virtual machine may request to access the service of the physical server by using the publishing IP address and the publishing port as the destination address. When the external display address is the domain name, the virtual machine needs to first obtain a corresponding address of the domain name. Therefore, the virtual machine initiates a domain name parsing operation to a DNS (domain name service) server, and obtains the corresponding address of the domain name from the DNS server. The corresponding address of the domain name is the publishing IP address and the publishing port. The cloud platform may send, to the DNS server by using a registration procedure in advance, a correspondence between the domain name and the publishing IP address and the publishing port that correspond to the service. Specifically, the cloud platform delivers the correspondence between the domain name and the publishing IP address and the publishing port to the domain name system DNS server. The virtual machine is configured to: initiate the domain name parsing operation, and obtain, based on the domain name, the publishing IP address and the publishing port that correspond to the service from the DNS server.

In a possible embodiment, the user logs in to the service presentation page, and applies to the cloud platform for the service. The cloud platform returns a service application response to the virtual machine. The service application response carries the external display address.

In a possible embodiment, for a service application request of the user, after determining service authorization is approved, the cloud platform records authorization information of a user to which the virtual machine belongs. The authorization information of the user includes a user identifier, a virtual machine identifier, and an account and a password that are allocated to the user. The cloud platform may use the recorded authorization information to authenticate the service access request of the user.

In a possible embodiment, the cloud platform may perform service authorization by using the user as granularity. To be specific, when the user has a plurality of virtual machines, the user may access an authorized service by using any one of the virtual machines. When the user creates a new virtual machine, the cloud platform delivers the NAT rule to an access network element to which the new virtual machine connects, so that the user may normally access the service on the physical server by using the new virtual machine. Service authorization performed by using the user as granularity may bring about great convenience to the user, so that the user does not need to apply for service authorization separately for each virtual machine. Still further, when the user deletes any one of the virtual machines belonging to the user, the cloud platform instructs the access network element to delete the NAT rule associated with the virtual machine when deleting the virtual machine.

The user may proactively request to terminate the service authorization or the cloud platform may proactively terminate the service authorization for the user when the user is in debt. When the cloud platform determines that the service authorization for the user needs to be terminated, the cloud platform determines an associated virtual machine, and sends a deletion message to the access network element to which the virtual machine connects, to instruct the access network element to delete the NAT rule of the virtual machine.

The cloud platform may further have a service detection/collection capability. When a new service is deployed on the physical server, the cloud platform may obtain, in a timely manner, service information and information about the physical server on which the service is deployed.

In a possible embodiment, the physical server is a single physical server or a physical server cluster.

According to another aspect, an embodiment of the present invention provides a method for a virtual machine to access a physical server in a cloud computing system, and a cloud platform performs the operations in the foregoing system.

According to still another aspect, an embodiment of the present invention provides another method for a virtual machine to access a physical server in a cloud computing system, and an access network element performs the operations in the foregoing system.

Corresponding to the foregoing system and method, this embodiment of the present invention provides a cloud platform. The cloud platform has a function of implementing the cloud platform defined in the foregoing system. The function may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the foregoing function.

Corresponding to the foregoing system and method, this embodiment of the present invention further provides a host, and a virtual machine and an access network element that are defined in the system run on the host. The access network element may be a virtual machine network element such as openvswitch, or, the access network element may be implemented by hardware, and is specifically a top-of-rack switch on the host. The host has a function of implementing the access network element defined in the system. Further, the host may further have a function of implementing the virtual machine defined in the system. The function may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the foregoing function.

In a possible embodiment, the cloud platform and the host are implemented by a general server or a dedicated server. A structure of the server includes a processor, a memory, a system bus, and an input/output interface. The processor is configured to support a corresponding function of the cloud platform or the host in the system. The input/output interface is configured to communicate with another component in the cloud computing system, and the processor executes an instruction stored in the memory.

According to yet another aspect, an embodiment of the present invention provides a computer storage medium, configured to store a computer software instruction used by the foregoing cloud platform. The computer software instruction includes a program designed for performing the foregoing aspect.

According to yet another aspect, an embodiment of the present invention provides a computer storage medium, configured to store a computer software instruction used by the foregoing host. The computer software instruction includes a program designed for performing the foregoing aspect.

Compared with the prior art, according to the solutions provided in the embodiments of the present invention, the real address of the physical server on which the service is deployed may be shielded from the virtual machine, and a unified access mode is also provided to the virtual machine, thereby both ensuring network security of the cloud platform and improving convenience of accessing the service by the user.

