Access control method and device and computer equipment

Abstract

The invention relates to an access control method and device and computer equipment. The method is applied to a remote network interface card of a server, and comprises the following steps: in response to an access permission acquisition request of a target shared storage device sent by a current computing node, acquiring access permission information of the target shared storage device for the current computing node, and sending the access permission information to the current computing node, and indicating the current computing node to control to access the target shared storage device according to the access permission information. By adopting the method, the virtual machines on the plurality of computing nodes can be controlled to perform coordinated access on the shared storage device, so that data acquired by the plurality of virtual machines on the plurality of computing nodes are prevented from conflicting, the data consistency can be ensured, and the fence reading and writing capability is improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to an access control method, apparatus, and computer equipment. Background Art

[0002] With the development of storage technology, shared storage devices are widely used in various fields. Among them, shared storage devices are mainly used to share data and can provide data reading and writing services for multiple virtual machines.

[0003] In order to achieve load balancing, high availability, scalability and fault tolerance, multiple virtual machines are usually deployed on multiple computing nodes. Therefore, it is particularly important to control the coordinated access of multiple virtual machines on multiple computing nodes to shared storage devices.

[0004] However, the access control methods in related technologies are not applicable to scenarios where virtual machines on multiple computing nodes are controlled to coordinate access to a shared storage device. Summary of the Invention

[0005] Based on this, it is necessary to provide an access control method, device and computer equipment to address the above technical problems, which can control the virtual machines on multiple computing nodes to coordinate access to shared storage devices to prevent data conflicts and ensure data consistency.

[0006] In a first aspect, an embodiment of the present application provides an access control method applied to a remote network interface card of a server, the method comprising:

[0007] In response to a request for obtaining access rights to a target shared storage device sent by the current computing node, obtaining access rights information of the target shared storage device to the current computing node;

[0008] The access permission information is sent to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information.

[0009] In one embodiment, obtaining access permission information of a target shared storage device for a current computing node includes:

[0010] Get the reservation type of the target shared storage device;

[0011] Determine the access permission information based on the reservation type of the target shared storage device and the role of the current computing node.

[0012] In one embodiment, obtaining the reservation type of the target shared storage device includes:

[0013] In response to a registration request sent by the current computing node, determining an identifier of a target shared storage device according to the registration request;

[0014] The identifier is searched in the mapping relationship between different shared storage device identifiers and different reservation types, and the reservation type corresponding to the shared storage device identifier that matches the identifier in the mapping relationship is determined as the reservation type of the target shared storage device.

[0015] In one embodiment, obtaining the reservation type of the target shared storage device includes:

[0016] In response to the reservation application request sent by the current computing node, the original reservation type of the target shared storage device is changed according to the reservation application request to obtain the reservation type corresponding to the target shared storage device.

[0017] In one embodiment, before sending the access permission information to the current computing node, the method further comprises:

[0018] In response to a reservation preemption request sent by the current computing node, adjusting access permission information;

[0019] The access permission information is updated based on the adjusted access permission information.

[0020] In one embodiment, before responding to the reservation application request or reservation preemption request sent by the current computing node, the method further includes:

[0021] In response to the lock preemption command sent by the current computing node, the preemption queue identifier in the distributed lock is sent to the current computing node;

[0022] When the current state identifier in the distributed lock is the same as the preemption queue identifier, it is determined that the allocation of the lock authority to the current computing node is completed; the lock authority represents the ownership authority or preemption authority of the distributed lock.

[0023] In one embodiment, the method further includes:

[0024] In response to the lock release command sent by the current computing node, the current state identifier in the distributed lock is modified to release the lock authority of the current computing node; the lock release command is sent by the current computing node after completing access to the target shared storage device.

[0025] In one embodiment, if the role of the current computing node is a reservation holder, the method further includes:

[0026] When access to the target shared storage device is completed, in response to the reservation release request sent by the current computing node, the reservation information of the target shared storage device for the current computing node is cleared according to the reservation release request.

[0027] In a second aspect, an embodiment of the present application provides an access control device, the device comprising:

[0028] An acquisition module, configured to respond to a request for acquiring access rights to a target shared storage device sent by the current computing node and acquire access rights information of the target shared storage device to the current computing node;

[0029] The sending module is used to send the access permission information to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information.

[0030] In a third aspect, an embodiment of the present application further provides a computer device, comprising a remote network interface card, a memory, and a processor, wherein the memory stores a computer program, and when the remote network interface card executes the computer program, the steps of the method of any embodiment in the first aspect are implemented.

[0031] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a remote network interface card, the steps of the method of any embodiment in the first aspect above are implemented.

[0032] In a fifth aspect, an embodiment of the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a remote network interface card, it implements the steps of the method of any embodiment of the first aspect above.

[0033] An embodiment of the present application provides an access control method, apparatus, and computer equipment, which are applied to a remote network interface card of a server. The method includes: responding to an access permission acquisition request for a target shared storage device sent by a current computing node, obtaining access permission information of the target shared storage device for the current computing node, and sending the access permission information to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information; the above method can be applied to controlling virtual machines on multiple computing nodes to coordinate access to a shared storage device, so as to prevent conflicts in data obtained by multiple virtual machines on multiple computing nodes, ensure data consistency, and improve read and write fence capabilities; at the same time, the above method is direct communication between the computing node and the remote network interface card of the server, that is, using unilateral primitives to realize communication between the computing node and the server, thereby improving the transmission efficiency of the access permission information, reducing the transmission delay of the access permission information, and further reducing the load pressure on the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] FIG1 is a diagram illustrating an application environment of an access control method according to an embodiment;

[0035] FIG2 is a schematic diagram of a flow chart of an access control method in one embodiment;

[0036] FIG3 is a schematic flow chart of an access control method in another embodiment;

[0037] FIG4 is a schematic flow chart of an access control method in another embodiment;

[0038] FIG5 is a schematic flow chart of an access control method in another embodiment;

[0039] FIG6 is a schematic flow chart of an access control method in another embodiment;

[0040] FIG7 is a schematic diagram of the memory structure of a distributed lock in one embodiment;

[0041] FIG8 is a block diagram of an access control device according to an embodiment;

[0042] FIG9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0044] In the storage field, shared storage devices are widely used in various fields. Among them, shared storage devices are mainly used to share data and can provide data reading and writing services for multiple virtual machines. In order to achieve load balancing, high availability, scalability and fault tolerance, multiple virtual machines are usually deployed on multiple computing nodes. Therefore, it becomes particularly important to control the coordinated access of multiple virtual machines on multiple computing nodes to shared storage devices. However, the access control method in the related art cannot be applied to the scenario of controlling the coordinated access of virtual machines on multiple computing nodes to shared storage devices. Based on this, the embodiment of the present application provides an access control method that can control the coordinated access of virtual machines on multiple computing nodes to shared storage devices to prevent data conflicts and ensure data consistency.

[0045] The access control method provided in an embodiment of the present application can be applied to the application environment diagram shown in Figure 1. The application environment includes an access control system. The access control system can be understood as a data cluster application system, a distributed file system, or a high-availability system. In this embodiment of the present application, the access control system can include multiple computing nodes, a storage cluster, and a server, with a remote network interface card (NIC) configured on the server. The computing nodes can be of the same or different types, including virtual machine nodes, container nodes, or bare metal nodes. Both the computing nodes and the server can be electronic devices with data processing capabilities, such as computers and servers. Optionally, the storage cluster can include multiple shared storage devices and processors, each of which can be, but is not limited to, a disk or hard drive. In this embodiment of the present application, the remote network interface card can be a Remote Direct Memory Access (RDMA) network card that communicates with each computing node based on the RDMA protocol. This reduces data transmission latency between the remote network interface card and each computing node and improves throughput. It should be noted that communication between the remote network interface card and each computing node is achieved by the direct memory access (DMA) engine in the remote network interface card performing direct memory operations.

[0046] Figure 1 illustrates an access control system consisting of four compute nodes: two virtual machine nodes (compute node A and compute node B), one container node (compute node C), and one bare metal node (compute node D). The cloud disk client on compute node D is deployed on its own data processing unit (DPU). It should be noted that each compute node has a cloud disk client deployed on it, and the virtual machines on each compute node access the shared storage devices in the storage cluster through their respective cloud disk clients. The cloud disk clients also have a PR client deployed on them, which communicates with the access control system server. The following describes the specific process of the access control method, using the remote network interface card on the server as the execution subject.

[0047] FIG2 is a flow chart of an access control method provided in an embodiment of the present application. The method is applied to a remote network interface card on the server side. The method can be implemented by the following steps:

[0048] S100 : In response to a request for obtaining access rights to a target shared storage device sent by a current computing node, obtain access rights information of the target shared storage device for the current computing node.

[0049] It should be noted here that One-Side Remote Direct Memory Access (One-Side RDMA) can be used between the server and each computing node in the access control system. In the embodiment of the present application, it can be understood that the remote network interface card on the server communicates and transmits data with the processor of each computing node. This can reduce the delay of data transmission and improve the scalability of the computing nodes in the access control system.

[0050] Among them, the above-mentioned current computing node can be any computing node in the access control system. In an embodiment of the present application, concurrent access by different computing nodes to the same shared storage device will interfere with each other, resulting in data inconsistency. Therefore, in an embodiment of the present application, any computing node among all computing nodes in the access control system can apply to become a reservation holder, registrant or non-registrant based on the persistent reservation (PR) mechanism of the non-volatile memory host controller interface specification (Non-Volatile Memory Express, NVMe), so as to allow multiple different computing nodes to coordinate access to each shared storage device in the storage cluster to prevent data conflicts and ensure data consistency, wherein, at the same time, all computing nodes may include one reservation holder, 0 or at least one registrant and 0 or at least one non-registrant. At the same time, in an embodiment of the present application, each shared storage device in the storage cluster can be an NVMe storage device.

[0051] In actual applications, when the current computing node applies to become a reservation holder, the current computing node can send a request to obtain access rights to the target shared storage device to the remote network interface card of the server. Optionally, the target shared storage device can be any shared storage device in the storage cluster.

[0052] Correspondingly, the remote network interface card of the server can receive and respond to the access permission acquisition request of the target shared storage device sent by the current computing node, and obtain the access permission information of the target shared storage device for the current computing node.

[0053] Optionally, the access permission information of the target shared storage device to the current computing node can be understood as the read and write permission information opened by the target shared storage device to the current computing node, such as readable but not writable, readable and writable, neither readable nor writable, or neither readable nor writable.

[0054] S200: Send access permission information to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information.

[0055] Furthermore, the server-side remote network interface card can use the RDMA WRITE primitive to send the access permission information of the target shared storage device to the current computing node, instructing the current computing node to control access to the target shared storage device based on the access permission information. In this embodiment of the present application, communication between the remote network interface card and the current computing node is achieved through the RDMA WRITE primitive.

[0056] It should be noted here that controlling access to the target shared storage device by the current computing node according to the access permission information means that the current computing node controls access to the target shared storage device by each virtual machine deployed on the current computing node according to the access permission information.

[0057] Among them, the current computing node accessing the target shared storage device means that the current computing node sends a read request or a write request to the processor in the storage cluster to instruct the processor to respond to the read request or the write request according to the target shared storage device to complete the read operation or the write operation of the corresponding data.

[0058] In actual applications, if the access permission information of the target shared storage device for the current computing node is readable but not writable, in this case the current computing node can send a read request to the processor in the storage cluster and successfully access the target shared storage device; however, in this case, even if the current computing node sends a write request to the processor in the storage cluster, there will be an access failure problem. If the access permission information is readable and writable, in this case, the current computing node can successfully access the target shared storage device regardless of whether it sends a read request or a write request to the processor in the storage cluster. If the access permission information is not readable and writable, in this case, the current computing node can send a write request to the processor in the storage cluster and successfully access the target shared storage device; however, in this case, even if the current computing node sends a read request to the processor in the storage cluster, there will be an access failure problem. If the access permission information is not readable and writable, in this case, the current computing node can successfully access the target shared storage device regardless of whether it sends a read request or a write request to the processor in the storage cluster.

[0059] In addition, after the current computing node receives the access permission information, it can report the access permission information to each virtual machine deployed by itself through the asynchronous event notification mechanism in the NVMe protocol.

[0060] The technical solution in the embodiment of the present application is applied to the remote network interface card of the server side, and in response to the access permission acquisition request of the target shared storage device sent by the current computing node, obtains the access permission information of the target shared storage device for the current computing node, and sends the access permission information to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information; the above method can be applied to control the virtual machines on multiple computing nodes to coordinate access to the shared storage device, so as to prevent conflicts in data obtained by multiple virtual machines on multiple computing nodes, ensure data consistency, and improve the read and write fence capabilities; at the same time, the above method is direct communication between the computing node and the remote network interface card of the server side, that is, using unilateral primitives to realize communication between the computing node and the server side, thereby improving the transmission efficiency of the access permission information, reducing the transmission delay of the access permission information, and further reducing the load pressure on the server side.

[0061] The following describes the process of obtaining the access permission information of the target shared storage device to the current computing node. In one embodiment, as shown in FIG3 , the step of obtaining the access permission information of the target shared storage device to the current computing node in S100 can be implemented as follows:

[0062] S110: Obtain a reservation type of a target shared storage device.

[0063] Specifically, the remote network interface card of the server can obtain the reservation type pre-configured by the server for each shared storage device in the storage cluster from storage locations such as local, cloud, disk, and hard disk.

[0064] Before executing the step in S100, the server may configure a corresponding reservation type for each shared storage device in the storage cluster. Optionally, the reservation type for each shared storage device may be exclusive write access for the registrant only, exclusive write access for the reservation holder only, exclusive write access for all registrants, exclusive access access for the registrant only, exclusive access access for the reservation holder only, or exclusive access access for all registrants.

[0065] S120: Determine access permission information according to the reservation type of the target shared storage device and the role of the current computing node.

[0066] It should be noted here that the role of each computing node in the access control system is applied for or preempted by each computing node in advance; thereafter, the respective roles can be sent to the remote network interface card.

[0067] In one implementation, the remote network interface card can compare, analyze, and match the reservation type of the target shared storage device and the role of the current computing node, and determine the access permission information of the target shared storage device to the current computing node based on the processing operation results.

[0068] In another implementation, the remote network interface card can train an algorithm model, and then input the reservation type of the target shared storage device and the role of the current computing node into the algorithm model, which outputs the access permission information of the target shared storage device to the current computing node.

[0069] The technical solution in the embodiment of the present application obtains the reservation type of the target shared storage device and determines the access permission information based on the reservation type of the target shared storage device and the role of the current computing node. This processing process does not require the participation of complex algorithms, thereby reducing the amount of data processed in the access permission information determination process, speeding up the determination of the access permission information, and improving the efficiency of determining the access permission information.

[0070] The following describes a process of obtaining the reservation type of a target shared storage device in a scenario. In one embodiment, as shown in FIG4 , the steps in S110 above may include:

[0071] S111 . In response to a registration request sent by the current computing node, determine an identifier of a target shared storage device according to the registration request.

[0072] If the current computing node is a non-registrant, it can send a registration request to the remote network interface card of the server to apply to become a registrant. Correspondingly, the remote network interface card of the server can receive and respond to the registration request sent by the current computing node and determine the identifier of the target shared storage device based on the registration request.

[0073] In one embodiment, the method of determining the identifier of the target shared storage device according to the registration request is to obtain information carried in the registration request and perform keyword extraction on the information to obtain the identifier of the target shared storage device.

[0074] In another embodiment, the method of determining the identifier of the target shared storage device according to the registration request is to obtain information carried in the registration request, perform string matching on the information, and obtain the identifier of the target shared storage device according to the matching result.

[0075] S112: Search for an identifier in a mapping relationship between different shared storage device identifiers and different reservation types, and determine the reservation type corresponding to the shared storage device identifier that matches the identifier in the mapping relationship as the reservation type of the target shared storage device.

[0076] Specifically, the remote network interface card of the server can search for the identifier of the target shared storage device in the pre-built mapping relationship, and determine the reservation type corresponding to the shared storage device identifier that matches the identifier of the target shared storage device in the mapping relationship as the reservation type of the target shared storage device.

[0077] The technical solution in the embodiment of the present application responds to the registration request sent by the current computing node, determines the identifier of the target shared storage device according to the registration request, searches for the identifier in the mapping relationship between different shared storage device identifiers and different reservation types, and determines the reservation type corresponding to the shared storage device identifier that matches the identifier in the mapping relationship as the reservation type of the target shared storage device; the above method can obtain the reservation type of the target shared storage device through a pre-constructed mapping relationship, which can speed up the acquisition speed of the reservation type of the target shared storage device, improve the acquisition efficiency of the reservation type of the target shared storage device, and reduce the complexity of the reservation type acquisition process of the target shared storage device.

[0078] The following describes a process for obtaining the reservation type of a target shared storage device in another scenario. In one embodiment, the step in S110 may include: responding to a reservation request sent by the current computing node, modifying the original reservation type of the target shared storage device according to the reservation request, and obtaining a reservation type corresponding to the target shared storage device.

[0079] If the current computing node is a registrant, the current computing node can generate a reservation request based on its own needs and send the reservation request to the remote network interface card on the server side to apply to become a reservation holder. Correspondingly, the remote network interface card on the server side can receive and respond to the reservation request sent by the current computing node, modify the original reservation type of the target shared storage device based on the reservation request, and obtain the reservation type corresponding to the target shared storage device.

[0080] In actual applications, the reservation application request may carry reservation type update requirement information, and the update requirement information may include reservation type modification parameters of at least one shared storage device in the storage cluster.

[0081] In one embodiment, a remote network interface card on the server side can pre-train a type change model. The type change model then inputs the reservation request and the original reservation type of the target shared storage device into the type change model, which then outputs the reservation type corresponding to the target shared storage device. Optionally, the type change model can be implemented using at least one of a convolutional neural network model, a fully connected neural network model, a long short-term memory neural network model, a residual neural network model, a recurrent neural network model, and the like.

[0082] In another embodiment, the remote network interface card of the server can obtain the information carried in the reservation application request, extract the reservation type field from the information, and then modify the original reservation type of the target shared storage device to the reservation type corresponding to the reservation type field to complete the change of the original reservation type and obtain the reservation type corresponding to the target shared storage device.

[0083] The technical solution in the embodiment of the present application responds to the reservation application request sent by the current computing node, changes the original reservation type of the target shared storage device according to the reservation application request, and obtains the reservation type corresponding to the target shared storage device; the above method can flexibly update the original reservation type of the shared storage device according to the actual needs of the reservation holder to improve the utilization rate of the shared storage device, that is, increase the resource utilization of the storage cluster.

[0084] In one embodiment, before executing the step in S200 above, as shown in FIG5 , the method may further include the following steps:

[0085] S300 : In response to the reservation preemption request sent by the current computing node, adjust the access permission information.

[0086] In actual applications, if any target compute node in the storage cluster is currently a reservation holder and the current compute node is the registrant, the current compute node can preempt the reservation holder role, allowing the target compute node to release the reservation holder role. Optionally, the target compute node and the current compute node are different compute nodes in the storage cluster.

[0087] Specifically, the current computing node can send a reservation preemption request to the remote network interface card of the server. Correspondingly, the remote network interface card can respond to the reservation preemption request sent by the current computing node to make the current computing node a reservation holder and the target computing node a registrant. At this time, the access permission information of the target shared storage device for the current computing node can be adjusted according to the roles of the current computing node and the target computing node.

[0088] S400: Update the access permission information based on the adjusted access permission information.

[0089] The access permission information of the target shared storage device for the current computing node may be replaced with the adjusted access permission information to complete the update.

[0090] The technical solution in the embodiment of the present application adjusts the access permission information in response to the reservation preemption request sent by the current computing node, and updates the access permission information based on the adjusted access permission information; the above method can dynamically adjust the access permission information of the shared storage device for the computing node according to the actual role of the computing node, which can improve the correctness of the access permission information.

[0091] In actual scenarios, before a computing node sends a reservation application request or reservation preemption request to a remote network interface card on the server side, it needs to preempt a distributed lock. This ensures that the remote network interface card successfully responds to the reservation application request or reservation preemption request sent by itself. In one embodiment, before responding to the reservation application request or reservation preemption request sent by the current computing node, as shown in FIG6 , the above method may further include the following steps:

[0092] S500 : In response to a lock preemption command sent by a current computing node, send a preemption queue identifier in the distributed lock to the current computing node.

[0093] In practical applications, the memory structure of the distributed lock is shown in Figure 7. The distributed lock may include multiple bits of data, one portion representing the preemption queue identifier (i.e., the max value) and another portion representing the status identifier (i.e., the cur value). In this embodiment of the present application, the distributed lock is represented by 64 bits of data, with the upper 32 bits representing the preemption queue identifier and the lower 32 bits representing the status identifier.

[0094] Alternatively, the status identifier in the distributed lock can be understood as the order or number in which the distributed locks are assigned to different compute nodes in the storage cluster. It should be noted that after the current compute node acquires the distributed lock, it can use the RDMA Fetch And Add (FAA) primitive to send an atomic command to the remote network interface card, instructing the remote network interface card to increment the preemption queue identifier by 1.

[0095] In an embodiment of the present application, each computing node can use the bakery algorithm to preempt a distributed lock. Specifically, before sending a reservation request or reservation preemption request to a remote network interface card, the current computing node can first preempt the remote network interface card's preconfigured distributed lock to ensure that the remote network interface card can communicate with itself and prioritize processing its own reservation request or reservation preemption request.

[0096] In an embodiment of the present application, the current computing node can send a lock preemption command to the remote network interface card of the server. Correspondingly, the remote network interface card can receive and respond to the lock preemption command sent by the current computing node, and use the RDMAREAD primitive to send the preemption queue identifier in the distributed lock to the current computing node. It should be noted here that at the same time, each computing node as a registrant in the storage cluster can synchronously send a lock preemption command to the remote network interface card, so the remote network interface card needs to configure a preemption queue identifier for each computing node as a registrant; wherein, the above-mentioned preemption queue identifier can be understood as the preemption order or preemption number of the distributed lock configured by the remote network interface card for the current computing node.

[0097] S600: When the current state identifier in the distributed lock is the same as the preemption queue identifier, determine that the allocation of the lock authority to the current computing node is completed. The lock authority represents the ownership authority or preemption authority of the distributed lock.

[0098] The current state identifier of the distributed lock can be periodically obtained. If the current state identifier of the distributed lock is equal to the preemption queue identifier, it can be determined that the current computing node has preempted the distributed lock, that is, the lock permission has been allocated to the current computing node. If the obtained current state identifier is not equal to the preemption queue identifier, it is necessary to wait for the lock. Only when the obtained current state identifier is equal to the preemption queue identifier does it indicate that it is the turn of the current computing node to successfully obtain the distributed lock.

[0099] The technical solution in the embodiment of the present application responds to the lock preemption command sent by the current computing node, sends the preemption queue identifier in the distributed lock to the current computing node, and determines that the allocation of lock permissions to the current computing node is completed when the current state identifier in the distributed lock is the same as the preemption queue identifier; in the above method, when the computing node applies for or preempts to become a reservation holder, it must first preempt the distributed lock to ensure that the remote network interface card of the server can successfully respond to the reservation application request or reservation preemption request sent by the computing node to successfully become the role of the reservation holder, thereby ensuring fairness between different computing nodes, thereby improving the overall performance of the shared storage device, avoiding preemption competition between different computing nodes, and improving the regularity of the distributed lock preemption process; at the same time, the above method can effectively avoid starvation of the shared storage device by designing a distributed lock, and can reduce data transmission delay.

[0100] In some scenarios, after a computing node successfully seizes the role of a reservation holder, it begins requesting read and write operations based on the target shared storage device. After processing the read and write operations, it can release the distributed lock, allowing the remote network interface card to allocate the distributed lock to other computing nodes and provide read and write services to other computing nodes. The process of a computing node releasing a distributed lock is described below. In one embodiment, the above method may include: in response to a lock release command sent by the current computing node, modifying the current state identifier in the distributed lock to release the lock permission of the current computing node. The lock release command is sent by the current computing node after completing access to the target shared storage device.

[0101] In actual applications, when the current computing node requests the processor of the storage cluster to complete the read and write operation (i.e., complete access to the target shared storage device), the current computing node can use the RDMA Compare And Swap (CAS) primitive to send a lock release command to the remote network interface card of the server. Correspondingly, the remote network interface card of the server receives and responds to the lock release command sent by the current computing node, modifies the current status identifier in the distributed lock, and releases the lock permission of the current computing node.

[0102] The current state identifier in the distributed lock may be modified by changing the current state identifier in the distributed lock to a negative identifier. In an embodiment of the present application, the current state identifier in the distributed lock may be modified by adding 1 to the current state identifier in the distributed lock to complete the modification of the current state identifier. It should be noted that the current state identifier may be represented by a numerical value.

[0103] In one embodiment, if the role of the current computing node is a reservation holder, the above method may also include: upon completing access to the target shared storage device, in response to a reservation release request sent by the current computing node, clearing the reservation information of the target shared storage device for the current computing node according to the reservation release request.

[0104] When the current computing node completes access to the target shared storage device, it can send a reservation release request to the remote network interface card on the server side to proactively request the release of the reservation holder role. Correspondingly, the remote network interface card can receive and respond to the reservation release request, clearing the reservation information on the target shared storage device for the current computing node based on the reservation release request. Optionally, the reservation information can include the current computing node's role as the reservation holder, access rights information, and the like.

[0105] The technical solution in the embodiment of the present application modifies the current state identifier in the distributed lock in response to the lock release command sent by the current computing node to release the lock authority of the current computing node; in the above method, the computing node can release the distributed lock after requesting to process the read and write operations, so that other computing nodes in the access control system can also successfully seize the distributed lock, thereby increasing the number of read requests processed by the shared storage device and improving the resource utilization of the shared storage device.

[0106] In one embodiment, the present application also provides an access control method applied to a remote network interface card of a server, the method comprising the following process:

[0107] (1) In response to the lock preemption command sent by the current computing node, the preemption queue identifier in the distributed lock is sent to the current computing node;

[0108] (2) When the current state identifier in the distributed lock is the same as the preemption queue identifier, the allocation of the lock authority to the current computing node is determined to be completed; the lock authority represents the ownership authority or preemption authority of the distributed lock;

[0109] (3) in response to the access permission request for the target shared storage device sent by the current computing node, obtaining the reservation type of the target shared storage device;

[0110] The above step (3) can be implemented by obtaining the reservation type of the target shared storage device in two ways:

[0111] The first method includes:

[0112] (31) responding to the registration request sent by the current computing node, determining the identifier of the target shared storage device according to the registration request;

[0113] (32) searching for an identifier in a mapping relationship between different shared storage device identifiers and different reservation types, and determining the reservation type corresponding to the shared storage device identifier that matches the identifier in the mapping relationship as the reservation type of the target shared storage device;

[0114] The second method includes:

[0115] (33) In response to the reservation application request sent by the current computing node, the original reservation type of the target shared storage device is changed according to the reservation application request to obtain the reservation type corresponding to the target shared storage device;

[0116] (4) Determine access permission information based on the reservation type of the target shared storage device and the role of the current computing node;

[0117] (5) In response to the reservation preemption request sent by the current computing node, adjust the access permission information;

[0118] (6) updating the access rights information based on the adjusted access rights information;

[0119] (7) Sending the access permission information to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information;

[0120] (8) In response to a lock release command sent by the current computing node, the current state identifier in the distributed lock is modified to release the lock permission of the current computing node; the lock release command is sent by the current computing node after completing access to the target shared storage device;

[0121] (9) When access to the target shared storage device is completed, in response to the reservation release request sent by the current computing node, the reservation information of the target shared storage device for the current computing node is cleared according to the reservation release request.

[0122] The execution process of the above (1) to (9) can be specifically referred to the description of the above embodiment. The implementation principles and technical effects are similar and will not be repeated here.

[0123] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0124] Based on the same inventive concept, embodiments of the present application also provide an access control device for implementing the aforementioned access control method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more access control device embodiments provided below can be found in the aforementioned limitations of the access control method and will not be further elaborated here.

[0125] In one embodiment, FIG8 is a schematic diagram of the structure of an access control device in an embodiment of the present application. The access control device provided in the embodiment of the present application can be applied to a remote network interface card of a server. As shown in FIG8 , the access control device in the embodiment of the present application can include: an acquisition module 11 and a sending module 12, wherein:

[0126] An acquisition module 11 is configured to obtain access permission information of the target shared storage device for the current computing node in response to a request for obtaining access permission of the target shared storage device sent by the current computing node;

[0127] The sending module 12 is configured to send the access permission information to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information.

[0128] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0129] In one embodiment, the acquisition module 11 includes: a type acquisition unit and a permission information determination unit, wherein:

[0130] A type acquisition unit, configured to acquire a reservation type of a target shared storage device;

[0131] The permission information determining unit is configured to determine access permission information according to a reservation type of a target shared storage device and a role of a current computing node.

[0132] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0133] In one embodiment, the type acquisition unit includes: an identification determination subunit and a search subunit, wherein:

[0134] an identification determination subunit, configured to respond to a registration request sent by the current computing node and determine an identification of a target shared storage device according to the registration request;

[0135] The search subunit is used to search for an identifier in the mapping relationship between different shared storage device identifiers and different reservation types, and determine the reservation type corresponding to the shared storage device identifier matching the identifier in the mapping relationship as the reservation type of the target shared storage device.

[0136] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0137] In one embodiment, the type acquisition unit includes a type change subunit, wherein:

[0138] The type changing subunit is configured to respond to the reservation application request sent by the current computing node, change the original reservation type of the target shared storage device according to the reservation application request, and obtain the reservation type corresponding to the target shared storage device.

[0139] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0140] In one embodiment, the access control device further comprises:

[0141] An information adjustment module, configured to adjust access permission information in response to a reservation preemption request sent by a current computing node;

[0142] The updating module is configured to update the access permission information based on the adjusted access permission information.

[0143] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0144] In one embodiment, the access control device further includes: an identification sending module and a determination module, wherein:

[0145] An identification sending module, configured to send a preemption queue identification in the distributed lock to the current computing node in response to a lock preemption command sent by the current computing node;

[0146] The determination module is used to determine the completion of the allocation of lock authority to the current computing node when the current state identifier in the distributed lock is the same as the preemption queue identifier; the lock authority represents the ownership authority or preemption authority of the distributed lock.

[0147] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0148] In one embodiment, the access control device further includes: an identification modification module, wherein:

[0149] The identification modification module is used to modify the current state identification in the distributed lock in response to the lock release command sent by the current computing node to release the lock permission of the current computing node; the lock release command is sent by the current computing node after completing access to the target shared storage device.

[0150] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0151] In one embodiment, if the role of the current computing node is a reservation holder, the access control device further includes: an information clearing module, wherein:

[0152] The information clearing module is used to clear the reservation information of the target shared storage device to the current computing node according to the reservation release request sent by the current computing node when the access to the target shared storage device is completed.

[0153] The access control device provided in the embodiment of the present application can be used to execute the technical solution in the above-mentioned access control method embodiment of the present application. Its implementation principle and technical effects are similar and will not be repeated here.

[0154] The specific definition of the access control device can be found in the definition of the access control method above and will not be repeated here. The various modules in the access control device described above may be implemented in whole or in part through software, hardware, or a combination thereof. The modules may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a memory in the computer device in software form, so that the processor can call and execute the corresponding operations of the modules.

[0155] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in Figure 9. The computer device includes a remote network interface card, a processor connected via a system bus, a memory, and a network interface. The processor of the computer device is used to provide processing power. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store access permission information. The network interface of the computer device is used to communicate with an external endpoint via a network connection. When the computer program is executed by the remote network interface card, an access control method is implemented.

[0156] Those skilled in the art will understand that the structure shown in Figure 9 is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0157] In one embodiment, a computer device is also provided, including a remote network interface card, a memory and a processor, wherein a computer program is stored in the memory. When the remote network interface card executes the computer program, the technical solution in the above-mentioned access control method embodiment of the present application is implemented. The implementation principle and technical effect are similar and will not be repeated here.

[0158] In one embodiment, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a remote network interface card, the technical solution of the above-mentioned access control method of the present application is implemented. Its implementation principle and technical effect are similar and will not be repeated here.

[0159] In one embodiment, a computer program product is also provided, including a computer program. When the computer program is executed by a remote network interface card, the technical solution of the access control method described above in the present application is implemented. The implementation principle and technical effect are similar and will not be repeated here.

[0160] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the embodiments provided herein may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0161] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. An access control method, characterized in that: A remote network interface card applied to a server, the method comprising: In response to a request for obtaining access rights of a target shared storage device sent by the current computing node, obtaining access rights information of the target shared storage device for the current computing node; The access permission information is sent to the current computing node, instructing the current computing node to control access to the target shared storage device according to the access permission information.

2. The method according to claim 1, characterized in that The obtaining access permission information of the target shared storage device for the current computing node includes: Obtaining a reservation type of the target shared storage device; The access permission information is determined according to the reservation type of the target shared storage device and the role of the current computing node.

3. The method according to claim 2, characterized in that The obtaining the reservation type of the target shared storage device includes: In response to the registration request sent by the current computing node, determining an identifier of a target shared storage device according to the registration request; The identifier is searched in a mapping relationship between different shared storage device identifiers and different reservation types, and the reservation type corresponding to the shared storage device identifier matching the identifier in the mapping relationship is determined as the reservation type of the target shared storage device.

4. The method according to claim 2, characterized in that: The obtaining the reservation type of the target shared storage device includes: In response to the reservation application request sent by the current computing node, the original reservation type of the target shared storage device is changed according to the reservation application request to obtain the reservation type corresponding to the target shared storage device.

5. The method according to any one of claims 1 to 4, characterized in that Before sending the access permission information to the current computing node, the method further includes: In response to the reservation preemption request sent by the current computing node, adjusting the access permission information; The access permission information is updated based on the adjusted access permission information.

6. The method according to any one of claims 1 to 4, characterized in that Before responding to the reservation application request or reservation preemption request sent by the current computing node, the method further includes: In response to the lock preemption command sent by the current computing node, sending the preemption queue identifier in the distributed lock to the current computing node; When the current state identifier in the distributed lock is the same as the preemption queue identifier, it is determined that the allocation of the lock authority to the current computing node is completed; the lock authority represents the ownership authority or preemption authority of the distributed lock.

7. The method according to any one of claims 1 to 4, characterized in that The method further comprises: In response to a lock release command sent by the current computing node, the current state identifier in the distributed lock is modified to release the lock authority of the current computing node; the lock release command is sent by the current computing node after completing access to the target shared storage device.

8. The method according to any one of claims 1 to 4, characterized in that If the role of the current computing node is a reservation holder; the method further includes: When access to the target shared storage device is completed, in response to a reservation release request sent by the current computing node, the reservation information of the target shared storage device for the current computing node is cleared according to the reservation release request.

9. An access control device, characterized in that: The device comprises: An acquisition module, configured to respond to a request for acquiring access rights of a target shared storage device sent by the current computing node, and acquire access rights information of the target shared storage device for the current computing node; The sending module is used to send the access permission information to the current computing node, and instruct the current computing node to control access to the target shared storage device according to the access permission information.

10. A computer device comprising a remote network interface card, a memory and a processor, wherein the memory stores a computer program, characterized in that: When the remote network interface card executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images