Data management method, device and server

Abstract

The present application provides a data management method, device and server, the method comprising: a management server receives a first request, determines whether there is a shadow tenant bucket associated with the first user's identifier according to the first user's identifier in the first request, and if so, stores the acceleration engine image AEI requested to be registered by the first user in the shadow tenant bucket associated with the first user's identifier, wherein the shadow tenant bucket is used to store the AEI of a specified user, and each shadow tenant bucket corresponds to a user one-to-one, thereby improving the security of AEI storage.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a data management method, device and server. Background Art

[0002] Field-programmable gate array (FPGA) accelerated cloud server is an FPGA-based elastic cloud server that can be used to provide tools and environment to allow users to easily develop and deploy FPGA-accelerated services, providing users with easy-to-use, economical, agile and secure FPGA cloud services.

[0003] With the help of FPGA acceleration cloud server, intellectual property (IP) core modules can be developed, deployed and used. IP core modules can be pre-designed, unverified or verified integrated circuits, devices or components with certain functions. After developing the IP core module, the user can store the accelerated engine image (AEI) associated with the IP core module to the cloud server. The user and other users who have obtained the IP core module rights can realize the functions of the IP core module by loading and using the AEI associated with the IP core module.

[0004] However, the current unified storage and management of AEI associated with user-developed IP core modules has security issues. Summary of the invention

[0005] The present application provides a data management method, device and server to solve the technical problem that the current unified storage and management of AEI of users has potential security risks.

[0006] In a first aspect, a data management method is provided. After receiving a first request, it is determined whether there is a shadow tenant bucket associated with the identifier of the first user according to the identifier of the first user in the first request. If so, the AEI requested to be registered by the first user is stored in the shadow tenant bucket associated with the identifier of the first user, wherein the first request is used to request registration of an AEI customized by the first user, the shadow tenant bucket is used to store the AEI of the first user, and each shadow tenant bucket corresponds to a user one-to-one.

[0007] By adopting the above method, the AEI requested to be registered by the first user can be stored in the shadow tenant bucket. Since the shadow tenant bucket stores the AEI of the designated user, the security when storing the AEI can be improved.

[0008] In a possible implementation, when determining whether there is a shadow tenant bucket associated with the identifier of the first user in the first request, the identifier of the shadow tenant bucket associated with the identifier of the first user can be determined according to the first rule, wherein the first rule is used to indicate a generation rule for the identifier of the shadow tenant bucket. After determining the identifier of the shadow tenant bucket, it can be queried whether there is a shadow tenant bucket with the identifier in all currently created shadow tenant buckets. If so, the shadow tenant bucket is a shadow tenant bucket associated with the identifier of the first user. Thus, the currently existing shadow tenant bucket associated with the identifier of the first user can be queried according to the identifier of the first user in the first request.

[0009] In a possible implementation, if it is determined that there is no shadow tenant bucket associated with the first user's identity, a storage space of a preset size may be selected as the shadow tenant bucket associated with the first user's identity, and thereafter, the AEI registered by the first user may be stored in the newly created shadow tenant bucket. Thus, when there is no shadow tenant bucket associated with the first user's identity in all currently created shadow tenant buckets, the shadow tenant bucket associated with the first user's identity may be created, and the AEI registered by the first user may be stored in the shadow tenant bucket.

[0010] In a possible implementation, if the second request is received, it can be determined that the second user has passed the permission verification according to the second user's identifier and the AEI identifier included in the second request, and then the AEI is loaded into the FPGA card according to the information of the FPGA card in the second request, wherein the FPGA card is the FPGA card associated with the first virtual machine associated with the second user. Thus, the AEI can be loaded into the FPGA card associated with the first virtual machine associated with the second user according to the second request, so that the second user can use the AEI in the FPGA card through the first virtual machine.

[0011] In a possible implementation, if the identifier of the second user carried in the second request includes the identifier of the first virtual machine, when determining whether the second user has passed the permission verification, the identifier of the image corresponding to the identifier of the first virtual machine can be determined according to the first correspondence, and then, according to the second correspondence, the identifier of at least one AEI corresponding to the identifier of the image is determined. If the expression of the AEI included in the second request is included in the identifier of the determined at least one AEI, it can be determined that the second user has passed the permission verification, otherwise, it can be determined that the second user has not passed the permission verification, wherein the first correspondence can represent the correspondence between the identifier of the virtual machine and the identifier of the image allowed to be used by the virtual machine, and the second correspondence can represent the correspondence between the identifier of the image and the identifier of the AEI. Thus, the permission verification of the second user can be performed according to the identifier of the second user and the identifier of the AEI.

[0012] In a possible implementation, if a third request is received, the resources occupied by the second virtual machine can be released in response to the third request, and the AEI in the FPGA card associated with the second virtual machine can be asynchronously cleared, wherein the third request is used by a third user to request the deletion of the second virtual machine, and the second virtual machine is a virtual machine associated with the third user. Thus, the resource release step and the FPGA card clearing step in the virtual machine deletion process can be decoupled, avoiding the failure of virtual machine resource release due to a program failure in the FPGA card clearing program.

[0013] In a possible implementation, when clearing the AEI in the FPGA card associated with the second virtual machine, the FPGA card can be set to a pending clearing state, and the AEI clearing interface of the FPGA card can be called to perform the clearing of the AEI. After that, it can be determined whether the AEI in the FPGA card is successfully cleared at a preset time interval. If the clearing is successful, the state of the FPGA card is set to an available state, otherwise, it is determined that the FPGA card is not successfully cleared; if the number of unsuccessful clearing of the FPGA card reaches a threshold, an alarm can be issued. Thus, a method for clearing the AEI in the FPGA card is provided, and the state of the FPGA card that has not been successfully cleared is set to a pending clearing state, so as to avoid the leakage of the uncleared AEI due to its re-allocation to a virtual machine associated with other users, and when the number of unsuccessful clearing of the FPGA card reaches a preset threshold, an alarm can also be issued to avoid the FPGA card being in the pending clearing state for a long time.

[0014] In the second aspect, the present application provides a data management device, the device comprising various modules for executing the fault handling method in the first aspect or any possible implementation of the first aspect. In the third aspect, the present application provides a server, the server comprising a processor, a memory, a communication interface, and a bus, the processor, the memory, and the communication interface are connected through the bus and communicate with each other, the memory is used to store computer-executable instructions, and when the device is running, the processor executes the computer-executable instructions in the memory to use the hardware resources in the device to perform the operation steps of the method in the first aspect or any possible implementation of the first aspect.

[0015] In a fourth aspect, the present application provides an FPGA cloud computing system, the system comprising a business server and a management server, the management server being configured to execute the operating steps of the method described in the first aspect or any possible implementation of the first aspect.

[0016] In a fifth aspect, the present application provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, which, when executed on a computer, enables the computer to execute the method described in the first aspect or any possible implementation of the first aspect.

[0017] In a sixth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect or any possible implementation of the first aspect.

[0018] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of the architecture of an FPGA cloud computing system provided in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of the architecture of another FPGA cloud computing system provided in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of a method for registering AEI provided in an embodiment of the present application;

[0022] Figure 4 A flowchart of another data management method provided in an embodiment of the present application;

[0023] Figure 5 A flowchart of another data management method provided in an embodiment of the present application;

[0024] Figure 6 A flowchart of another data management method provided in an embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structure of a data management device provided in an embodiment of the present application;

[0026] Figure 8 A schematic diagram of the structure of another data management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings.

[0028] The following is an explanation of the terms involved in this application:

[0029] 1. At least one means one, or more than one, including one, two, three or more.

[0030] 2. Multiple refers to two or more than two, including two, three or more.

[0031] 3. Loading can mean copying a file from A to B, so that both A and B have the file; it can also mean cutting a file from A to B, so that only B has the file after cutting.

[0032] 4. Identification, which may be information that uniquely identifies an object, including number, name, description information, etc. For example, the identification of AEI may include one or more of the number of AEI, the name of AEI, and the description information of AEI.

[0033] 5. FPGA accelerated cloud server refers to a virtual machine or server that can provide tools and environments related to business development and can implement FPGA accelerated algorithm functions. FPGA accelerated cloud server can be used to provide hardware development kit (HDK) and application development kit (SDK), where HDK can include essential tools such as accelerator examples, coding environment, simulation platform, automated compilation tools, code encryption and debugging toolkits; SDK can include application examples, hardware abstraction interface, accelerator abstraction interface, accelerator driver and runtime, version management tools and other essential tools. Through FPGA accelerated cloud server, users can implement application development operations. Among them, the developed files can include FPGA-related netlists, compilation reports, timing reports, etc., such as design check point (DCP) files. The developed DCP files can be stored in the user's corresponding background storage bucket.

[0034] 6. Storage bucket, also known as tenant bucket or tenant storage bucket, is the storage space of the FPGA accelerated cloud server associated with the user. The storage bucket is a user-perceivable and operable storage space. The user can access the storage space associated with himself through the cloud server, for example, store files in the storage space. The user can also set the storage bucket associated with himself. For example, allow or prohibit other users from accessing the storage associated with themselves. Storage buckets can be used for storing data and files. For example, they can be used to store DCP files developed by users, and for storing AEI. The storage bucket involved in the embodiments of the present application can be an object storage service (OBS) storage bucket, and can also be implemented using other types of storage services, which is not limited by the embodiments of the present application.

[0035] 7. AEI refers to files (such as DCP files) developed by users through FPGA accelerated cloud servers or laboratory environments, and files associated with IP core modules (including data, logic, algorithms, etc.) obtained after being compiled by FPGA accelerated cloud servers. By loading and running AEI, the corresponding functions of the IP core modules can be realized. Users can register customized AEIs through FPGA accelerated cloud servers, where customized AEIs may include user-defined logic and / or algorithms. Through the implementation of AEI, existing cloud service functions can be realized, or new user-defined cloud service functions can be realized.

[0036] 8. Shadow tenant bucket, also known as shadow bucket or shadow storage bucket, refers to the storage space associated with the user in the FPGA accelerated cloud server. The FPGA accelerated cloud server can store the user's data, files, etc. in the shadow tenant bucket associated with the user, but the user cannot perceive that the data and files are stored in the shadow tenant bucket. During the creation of the shadow tenant bucket, the shadow tenant bucket can be bound to the user's identification and / or authentication information to achieve the association between the user and the shadow tenant bucket. The difference between the shadow tenant bucket and the storage bucket is that the user cannot perceive the existence of the shadow tenant bucket. The cloud server will automatically store the data that meets the conditions in the shadow tenant bucket. When the user calls the data, the cloud server automatically identifies whether the data is stored in the shadow tenant bucket. When the data is stored in the shadow tenant bucket, the cloud server automatically calls the data in the shadow tenant bucket. This process is not perceived by the user; the storage bucket is a storage space that the user can perceive. The user can control the cloud server to store data in the storage bucket and control the cloud server to call the data in the storage bucket.

[0037] 9. FPGA card, also known as FPGA acceleration card or FPGA data acceleration card, can realize the processing of complex logic and algorithm through FPGA, and it is used in some common acceleration application scenarios such as algorithm acceleration, big data analysis, high-performance computing, server hardware acceleration, etc. The algorithm of FPGA acceleration card can be modified according to the actual needs of users. For example, AEI can be loaded into FPGA card through the server or virtual machine (VM) associated with FPGA card, so that the algorithm included in AEI can be loaded into FPGA card, and AEI loaded in FPGA card can be modified or deleted through the server or virtual machine to realize the modification or deletion of acceleration algorithm in FPGA card.

[0038] 10. FPGA virtual machine may refer to a virtual machine associated with at least one FPGA card in an FPGA cloud computing system. The FPGA virtual machine may be used to execute an algorithm loaded in the FPGA card to implement the corresponding function of the algorithm. The FPGA virtual machine may be associated with a user. For example, the FPGA cloud computing system may create an FPGA virtual machine for a user based on a user's request, and configure the FPGA virtual machine and the FPGA card associated with the FPGA virtual machine based on the user's authority, requirements, etc.

[0039] 11. Authentication information refers to information used for user authentication. Authentication refers to the process of verifying the user's authority based on the user's authentication information when the user accesses the FPGA cloud server or uses AEI services (such as creating AEI, running AEI, and deleting AEI). Only when the user passes the authentication can he access the FPGA cloud server or use the AEI service, thereby preventing users who do not have a real identity or whose authentication information is false or invalid from accessing the FPGA cloud server or using the AEI service, thereby improving the security of the FPGA cloud server. The user's authentication information includes but is not limited to the user's access key ID (AK) and secret access key (SK). The authentication here can refer to identity and access management (IAM) authentication.

[0040] The following is a detailed description of the embodiments of the present application in conjunction with the accompanying drawings. First, the cloud computing system provided by the embodiments of the present application is introduced. The data management method provided by the present application can be applied to the system. Then, the data management device provided by the embodiments of the present application is introduced. Finally, the data management method provided by the embodiments of the present application is introduced.

[0041] like Figure 1 As shown, the FPGA cloud computing system 100 provided in the embodiment of the present application can be a virtualized environment composed of multiple servers. The FPGA cloud computing system 100 can include multiple management servers 102 and multiple business servers 101. The multiple management servers 102 can interact with each other through a communication interface, and the multiple business servers 101 can also interact with each other through a communication interface.

[0042] Among them, each business server 101 can be connected to one or more FPGA cards 104, and one or more virtual machines 103 can be run on each business server 101. The virtual machine 103 here can be an FPGA virtual machine or a standard virtual machine. Each FPGA virtual machine can be associated with one or more FPGA cards. The FPGA virtual machine can be used to execute the acceleration algorithm loaded in the FPGA card associated with the FPGA virtual machine (such as calling the AEI loaded in the FPGA card to implement AEI related functions); a standard virtual machine refers to a virtual machine that is not associated with an FPGA card.

[0043] The FPGA cloud computing system 100 can create one or more standard virtual machines or FPGA virtual machines associated with the user, for example Figure 1 As shown, the virtual machine 103 runs in the business server 101, and the user can access the FPGA cloud computing system 100 through a standard virtual machine or an FPGA virtual machine. Specifically, assuming that the virtual machine 103 associated with the first user is an FPGA virtual machine, the first user can call the AEI loaded by the instruction code in the FPGA card associated with the virtual machine 103 through the virtual machine 103, thereby running the AEI.

[0044] The management server 102 can be used to manage the FPGA cloud computing system 100, including but not limited to: compiling, generating AEI, creating, modifying or deleting the virtual machine 103 (FPGA virtual machine or standard virtual machine), and executing the loading and deletion of AEI in the FPGA card associated with the FPGA virtual machine, etc. The management server 102 can provide at least one cloud service through software, hardware, or a combination of software and hardware. For example, the management server 102 can be used to provide FPGA image service (FPGA image service) and AEI management service (AEI management service) for the management of AEI. For example, the FPGA image service can obtain the DCP file uploaded by the user, and is used to store the AEI file, obtain and query the AEI related information, etc. The FPGA management service can be used to compile and generate the AEI file according to the DCP file. In implementation, multiple management servers 102 can jointly implement the management of one or more business servers 101. Among them, multiple management servers can adopt the master-slave working mode. Specifically, one management server 102 is a management server in the active state, and one or more other management servers 102 are management servers in the standby state (the standby management servers interact with the business server 101 in Figure 1(indicated by dotted lines in the figure), at the same time, only the management server in the active state is used for the business server. When the management server in the active state fails, multiple management servers in the standby state can re-select a new management server in the active state, and the new management server in the active state takes over the management task of the business server. Optionally, multiple management servers can also adopt other working modes. For example, a load sharing working mode is adopted between multiple management servers, and each management server jointly manages multiple business servers. The embodiment of the present application does not limit the working mode of multiple management servers. For the convenience of description, the following description of the embodiment of the present application takes the active and standby working mode of multiple management servers as an example.

[0045] It should be understood that Figure 1 The illustrated architecture only shows a possible hardware structure of the FPGA cloud computing system 100. In addition to the illustrated structure, the cloud computing system 100 may also include necessary components. For example, the FPGA cloud computing system 100 may also have a storage device for storing data. The storage device may be composed of a storage node device or a storage node device group. Figure 1 The shown architecture is merely an example, and the data management system provided in this application is not limited thereto, that is, each business server in the data management system can run one virtual machine or multiple virtual machines, wherein each virtual machine can be associated with one FPGA card or multiple FPGA cards.

[0046] Figure 2 A schematic diagram of a logical architecture of an FPGA cloud computing system 100 provided in an embodiment of the present application. As shown in the figure, the management server 102 and / or the business server 101 provide Figure 2 The web page 201, cloud management service 202, FPGA agent 204, FPGA image service 205, cloud storage module 206 and database (metadata) 207 are shown. Figure 2In the architecture shown, a user can request to create an FPGA virtual machine through a network page 201, or a user can access the FPGA cloud computing system 100 through an already created FPGA virtual machine, wherein the function of the network page 201 can be implemented by the software of the FPGA cloud computing system 100. Specifically, the user sends a request to create an FPGA virtual machine to the cloud management service 202 of the FPGA cloud computing system 100 through the network page 201, and the cloud management service 202 can control the business server to create a virtual machine 103 according to the request, wherein the virtual machine 103 is associated with the FPGA card 203, and the cloud management service 202 here can be implemented through the infrastructure as a service (IaaS) layer. The IaaS layer provides storage resources (such as a database 207) and hardware devices to users, so that users can use these storage resources and hardware devices to access the FPGA cloud computing system 100, and the cloud management service 202 here is specifically a virtualization management software, such as FusionSphere. The FPGA card 203 can realize message transmission through the preset module. For example, the FPGA card 203 receives the request for loading AEI sent by the user through the virtual machine 103 through the mailbox during the process of loading AEI, and sends a request to the FPGA agent 204 through the mailbox to request the FPGA agent 204 to load AEI into the FPGA card 203; the FPGA agent 204 can query the storage information (such as storage address) of the AEI to be loaded from the FPGA image service 205 according to the loading request sent by the FPGA card 203. After obtaining the storage information of AEI from the FPGA image service 205, the FPGA agent 204 can download AEI from the cloud storage module 206 according to the storage information of AEI, wherein the cloud storage module 206 is a data storage module of the FPGA cloud computing system 100, and is used to store DCP and / or AEI uploaded by the user. The FPGA card 203 may also include a dynamic loading module (iCAP) for loading the acquired AEI into the FPGA card 203.

[0047] For example, Figure 2 The functions of the business server shown can be performed by Figure 1 The service server 101 shown in FIG. 1 is implemented, and the function of the FPGA card 203 can be implemented by Figure 1 The FPGA card 104 connected to the business server 101 is implemented, the FPGA agent 204 can be implemented by the business server 101 through software, and the functions of the network page 201, the cloud management service 202, the database 207, the FPGA mirror service 205 and the cloud storage module 206 can be implemented by Figure 1 The management server 102 is shown implemented by software.

[0048] The following is combined with Figure 1 and Figure 2 The FPGA cloud computing system 100 shown further introduces the data management method provided in the embodiment of the present application. Figure 3 A schematic diagram of a method for registering AEI provided in an embodiment of the present application. The method can be performed by Figure 1 The method may be implemented by the business server 101 and the management server 102, and may include the following steps:

[0049] S101: A business server sends a first request. The business server runs a virtual machine associated with a first user. The first request is used by the first user to request registration of an AEI customized by the first user. The first request includes an identifier of the first user and an identifier of the AEI.

[0050] S102: The management server receives a first request.

[0051] S103: The management server determines whether there is a shadow tenant bucket associated with the identifier of the first user according to the identifier of the first user, where the shadow tenant bucket is used to store the AEI of the specified user, and the first user is any one of the specified users.

[0052] S104: When there is a shadow tenant bucket associated with the first user identifier, the management server stores the AEI in the shadow tenant bucket associated with the first user identifier.

[0053] By adopting the above method, after creating the AEI, the management server can store the AEI in the shadow tenant bucket associated with the first user identifier. Since the shadow tenant bucket is only used to store the AEI of the specified user, when the cloud server stores the AEI requested to be registered by the first user, it no longer uniformly stores the AEIs of multiple users, thereby improving the security of the AEI.

[0054] As a possible embodiment, each shadow tenant bucket corresponds to a user one-to-one. To improve the security of the shadow tenant bucket, the shadow tenant bucket can be used only to store the custom AEI requested to be registered by the specified user. Specifically, the management server can create a shadow tenant bucket that is one-to-one with the first user, wherein the shadow tenant bucket can be associated with the identifier of the first user, and the shadow tenant bucket is used to store the AEI requested to be registered by the first user.

[0055] As another possible embodiment, the relationship between users and shadow tenant buckets can be many-to-one. The present application does not exclude the creation of a shadow tenant bucket corresponding to multiple designated users (including the first user), wherein the shadow tenant bucket can be associated with the identifiers of multiple designated users, so that the shadow tenant bucket can be shared by the first user and other designated users. Since the user cannot access the shadow tenant bucket or operate the files in the shadow tenant bucket, the security of the shadow tenant bucket can be unaffected when the shadow tenant bucket is shared by multiple designated users. For the same reason, the present application does not exclude the creation of multiple shadow tenant buckets corresponding to multiple designated users (including the first user), wherein multiple shadow tenant buckets can be associated with the identifiers of multiple designated users. It should be understood that the association between the shadow tenant bucket and the user's identifier described here can be reflected as the association between the identifier of the shadow tenant bucket and the identifier of the user.

[0056] In the implementation of the step shown in S101, the first user can trigger the service server to send the first request through the virtual machine 103. The identifier of the first user included in the first request can be the user's number (such as the identifier obtained by the user when registering to obtain the right to use the FPGA cloud computing system 100, such as a user name, nickname), the user's authentication information, the identifier of the user's region (for example, the East China region of my country will correspond to a unique region number), or the identifier of the virtual machine 103 associated with the first user. Since the first user and the virtual machine 103 are associated, the identifier of the virtual machine 103 can be used as the identifier of the first user to identify the first user. It should be understood that in a specific implementation, one or more of the user identifier, the user's authentication information, the ID of the user's region, or the identifier of the virtual machine 103 associated with the first user can be used as the identifier of the first user.

[0057] In addition, the AEI identifier in the first request may be the AEI number, or may be the name and / or description information of the AEI input by the first user. For example, the first user may input one or more of the AEI number, name or description information as the AEI identifier by selection or typing. After obtaining the AEI identifier, the business server 101 generates a first request including the AEI identifier.

[0058] The first user-defined AEI designed in step S101 refers to an AEI compiled and generated based on the developed file (such as a DCP file) uploaded by the first user to the tenant bucket and including the first user-defined logic and algorithm. The AEI can implement existing or newly designed functions by the first user through the first user-defined logic and algorithm. The first user can upload the file used to register the AEI to the tenant bucket associated with the first user through the business server 101. The file here can be a DCP file customized by the first user for generating a customized AEI.

[0059] In the implementation of the step shown in S103, the management server 102 may determine the identifier of the shadow tenant bucket associated with the identifier of the first user according to the first rule, and determine whether there is a shadow tenant bucket with the identifier. If so, the shadow tenant bucket with the identifier is determined to be the shadow tenant bucket associated with the identifier of the first user, wherein the first rule may be a generation rule when the identifier of the shadow tenant bucket is generated according to the identifier of the user, and the first rule may be preconfigured in the management server 102. In implementation, the management server 102 may store the identifiers of the shadow tenant buckets that have been created, wherein the identifiers of these shadow tenant buckets are generated according to the identifier of the user associated with the shadow tenant bucket according to the first rule, and after determining the identifier of the shadow tenant bucket associated with the identifier of the first user according to the first rule, the management server 102 may query from the identifiers of these shadow tenant buckets that have been created to determine whether the identifier of the shadow tenant bucket associated with the identifier of the first user determined according to the first rule is included.

[0060] Specifically, the identifier of the first user carried in the first request may include the identifier of the first user and the identifier of the region where the first user is located, and the first rule may be a string obtained by combining the identifier of the first user, the identifier of the region where the first user is located, and a random number of a set length in the identifier of the first user as the identifier of the shadow tenant bucket.

[0061] If the management server 102 determines that there is no shadow tenant bucket associated with the first user's identifier, the management server 102 may create a shadow tenant bucket associated with the first user's identifier and store the AEI in the shadow tenant bucket associated with the first user's identifier.

[0062] Specifically, if the management server 102 determines that the identifier of the shadow tenant bucket that has been created does not include the identifier of the shadow tenant bucket associated with the identifier of the first user determined according to the first rule, the management server 102 may select a storage space with a preset size and use the storage space as the shadow tenant bucket associated with the first user identifier, and store the AEI in the shadow tenant bucket to achieve the creation of the shadow tenant bucket and the storage of the AEI.

[0063] As a possible embodiment, if the identifier of the first user includes the authentication information of the first user, the management server 102 may encrypt and store the AEI in the shadow tenant bucket according to the authentication information of the first user, so as to further improve the security of the AEI storage. The authentication information of the first user may be the AK and SK of the first user, or other authentication information. Specifically, during the data storage process, a key pair may be generated according to the authentication information of the user, the key pair may be used to encrypt the AEI to generate a ciphertext, the ciphertext may be stored, and when the AEI is obtained, the ciphertext may be decrypted according to the key pair to obtain the plaintext, i.e., the AEI.

[0064] Next, combine Figure 4 The following is a flow chart of a data management method provided by an embodiment of the present application. As shown in the figure, the method includes:

[0065] S201: The first user uploads the DCP file corresponding to the AEI that the first user needs to register to the tenant bucket associated with the first user through the business server.

[0066] In implementation, the first user uploads the DCP file corresponding to the AEI that the first user needs to register to the storage bucket associated with the first user through the virtual machine associated with the first user in the business server.

[0067] S202: The first user sends a first request to the management server through the business server to request registration of the AEI. The first request carries the identifier of the first user, the identifier of the area where the first user is located, the authentication information of the first user, and the name and description information of the AEI to be registered.

[0068] S203: The management server receives the first request.

[0069] S204: The management server authenticates the first user according to the authentication information of the first user.

[0070] S205: The management server obtains the DCP file from the tenant bucket associated with the first user.

[0071] If the management server determines that the DCP file does not exist in the tenant bucket associated with the first user, the management server may notify the management server to execute an error, prompting the user that the DCP file has not been uploaded or has been uploaded incorrectly.

[0072] S206: The management server compiles the acquired DCP file into AEI.

[0073] The management server may also generate an identifier (e.g., a number, a name) of the AEI, and send the generated identifier of the AEI to the business server;

[0074] S207: The management server determines whether there is an identifier of a shadow tenant bucket associated with the identifier of the first user. If so, execute step S208; otherwise, execute step S209;

[0075] S208: The management server encrypts and stores the AEI in a shadow tenant bucket associated with the identifier of the first user;

[0076] S209: The management server creates a shadow tenant bucket associated with the identifier of the first user;

[0077] S210: The management server encrypts and stores the AEI in a newly created shadow tenant bucket associated with the identifier of the first user.

[0078] By adopting the above method, the management server can register the AEI according to the first request sent by the business server, and encrypt and store the AEI in the shadow tenant bucket associated with the user's identity, thereby improving the security of AEI storage.

[0079] In the implementation of the above steps S208 and S210, the management server may also associate the identifier of the AEI with the shadow tenant bucket, for example, storing the correspondence between the identifier of the AEI and the identifier of the shadow tenant bucket (such as number, name), for querying the storage location of the AEI according to the identifier of the AEI.

[0080] As a possible implementation, after completing the above-mentioned AEI registration process, the management server continues to execute the AEI loading process. Specifically, the management server receives a second request, which is used for the second user to request to load the AEI. Among them, the second request can carry the second user's identifier, the AEI identifier, and the FPGA card information. After receiving the second request, if the management server 102 determines that the second user has passed the authority verification according to the identifier in the second request and the identifier of the AEI, the management server 102 can load the AEI associated with the AEI identifier into the FPGA card associated with the first virtual machine associated with the second user according to the FPGA card information in the second request, so as to realize the loading of the AEI. In implementation, the second user can be the same as the first user. In this case, the second user can load the AEI previously registered through the steps shown in S101-S104 into the first virtual machine. Optionally, the second user can be different from the first user. In this case, it is necessary to judge the access rights of the second user. When the second user meets the authority requirements, the AEI registered by the first user is loaded into the first virtual machine associated with the second user. Among them, the access rights of the second user refer to the second user having the authority to use the AEI registered by the first user, and the authority can be set through the network interface.

[0081] In a specific implementation, the method for the management server to determine whether the second user has passed the permission verification is as follows: the management server 102 can determine the identifier of the image corresponding to the identifier of the second user based on the first correspondence, wherein the first correspondence represents the correspondence between the identifier of the second user and the identifier of the image allowed to be used by the virtual machine. Thereafter, the management server 102 can determine the identifier of at least one AEI corresponding to the identifier of the image based on the second correspondence, wherein the second correspondence is the correspondence between the identifier of the image and the identifier of the AEI. If the management server 102 determines that the identifier of the AEI carried in the second request is included in the identifier of at least one AEI determined based on the second correspondence, then the management server 102 can determine that the second user has passed the permission verification. The image involved here may be associated with one or more AEIs, and the association relationship between the image and one or more AEIs may be reflected as the above-mentioned second correspondence relationship. The image may represent one or a series of cloud services, and each AEI associated with the image may specifically be a specific algorithm involved in the cloud service. After the user obtains authorization for the image, the management server 102 may associate the user with the image, such as storing the user's identifier and the identifier of the image that the user is allowed to use after obtaining authorization as a first correspondence relationship. It should be understood that the user may obtain image authorization by registering an image, purchasing, and the like.

[0082] After receiving the second request, if the management server 102 determines that the second user has passed the authority verification, it can query the storage information of the AEI based on the identifier of the AEI. For example, based on the correspondence between the identifier of the AEI stored in the process of registering the AEI and the identifier of the shadow tenant bucket, it can determine the identifier of the shadow tenant bucket storing the AEI, thereby obtaining the AEI from the shadow tenant bucket.

[0083] The FPGA card information in the second request may be used to indicate the slot information of the FPGA card, and the management server 102 may load the AEI into the FPGA card associated with the slot information according to the slot information of the FPGA card. For example, the slot numbers of the FPGA card associated with the first virtual machine are 0, 1, 2, and 3, respectively, and the FPGA card information may be the slot number "0", which is used to indicate that the AEI is loaded into the FPGA card with the slot number 0.

[0084] As a possible implementation, the management server 102 may load the AEI only to the FPGA card in the available state among all the FPGA cards associated with the first virtual machine. The available state refers to a working state of the FPGA card. The management server 102 may set the working state of the FPGA card. For example, the management server 102 may set the working state of the FPGA card to a pending clearing state, indicating that the FPGA card currently has data band clearing and cannot be used to load a new AEI. Alternatively, the management server 102 may set the working state of the FPGA card to an available state, indicating that the FPGA card can be used to load a new AEI.

[0085] The second request may be sent by the service server running the first virtual machine. For example, if the second user is the same as the first user, the second request may be as follows: Figure 1 The business server 101 shown in FIG. 1 is sent, wherein the business server 101 runs a virtual machine 103 associated with the first user; if the second user is different from the first user, the second request may be as follows: Figure 1 The service server 101 shown is sent, and the service server 101 runs a virtual machine 103 associated with the second user.

[0086] Here are some examples of how to send the second request:

[0087] Method 1: The second user triggers the second request.

[0088] Specifically, the second request may be sent by the second user through the virtual machine. For example, the second user manually inputs a command to load the AEI through the first virtual machine, and the command triggers the service server running the first virtual machine to send the second request to the management server 102.

[0089] Method 2: The first virtual machine sends the second request during startup.

[0090] The second request may be sent to the management server 102 by the business server running the first virtual machine during the startup process of the first virtual machine. The first virtual machine may obtain the authentication information of the second user, the identifier of the AEI, and the information of the FPGA card during the startup process. Specifically, taking the second request sent by the business server 101 (the business server 101 is associated with the second user) as an example, the second user may input the identifier of the AEI and the information of the FPGA card during the process of requesting the management server 102 to register the virtual machine 103 (i.e., the virtual machine associated with the second user), and the management server 102 may obtain the authentication information of the second user during the process of the second user requesting to register the virtual machine 103. Thereafter, the management server 102 may store the authentication information of the second user, the identifier of the AEI, and the information of the FPGA card. During the startup process after the virtual machine 103 is created, the business server 101 running the virtual machine 103 associated with the second user may obtain the authentication information of the second user, the identifier of the AEI, and the information of the FPGA card previously stored, and the business server 101 may generate the second request and send the second request to the management server 102, so that the loading of the AEI may be automatically realized during the startup process of the virtual machine 103. The startup process of the virtual machine 103 described above may be the first startup process after the virtual machine 103 is created.

[0091] Next, assume that the second request is as follows Figure 1 The virtual machine 103 associated with the second user shown triggers the service server 101 to send a message during the startup process, combined with Figure 5 The flowchart of the method for loading AEI in the virtual machine shown in the figure illustrates the method for loading AEI shown in the above method 2:

[0092] S301: The service server obtains authentication information of a second user, an identifier of an AEI, and information of an FPGA card during startup of the virtual machine, wherein the second user is associated with the virtual machine;

[0093] S302: During the startup of the virtual machine, the business server sends a second request to the management server, where the second request is used by a second user to request to load the AEI, and the second request includes authentication information of the second user, an identifier of the AEI, and information of the FPGA card;

[0094] S303: The management server receives the second request;

[0095] S304: The management server determines that the second user has passed the authority verification according to the authentication information in the second request and the identifier of the AEI; in implementation, the management server may also determine that the second user has passed the authentication according to the authentication information in the second request.

[0096] S305: The management server loads the AEI associated with the AEI identifier into the FPGA card associated with the virtual machine according to the information of the FPGA card in the second request. In implementation, if the AEI loading fails during the execution of step S305, the management server may also prompt the user through the business server, such as prompting the user to manually input the AEI loading command, so that the business server may further send the second request through the above method 1.

[0097] By adopting the method shown in the above steps S301 to S305, the AEI loading process can be automatically initiated during the virtual machine startup process, thereby eliminating the need for the user to manually input the AEI loading command after the virtual machine is started, making the AEI loading process simpler and faster, and also avoiding the risk of errors when the user manually inputs the command.

[0098] For example, according to Figure 2 In the logical architecture shown in the above steps S301 to S305, the user can input the identifier of the AEI that the user needs to load and the information of the FPGA card in the process of requesting to register the virtual machine 103 through the network page 201. The network page 201 can also obtain the user's authentication information in the process of registering the virtual machine. Thereafter, the network page 201 can send the user's authentication information, the identifier of the AEI that the user needs to load, and the information of the FPGA card to the cloud management service 202 of the IaaS layer, and the cloud management service 202 stores the above information in the database (metadata) 207 of the IaaS layer. During the first startup process after the virtual machine 103 is created, the virtual machine 103 can obtain the identifier of the AEI that the user needs to load and the information of the FPGA card from the database 207 through the startup script, thereby executing the above step S301, and triggering the above step S302 accordingly, so as to realize the loading of the AEI through the above steps S301 to S305; or, in the case of failure to obtain the identifier of the AEI that the user needs to load and the information of the FPGA card through the startup script, the virtual machine 103 can report an error to the user, such as prompting the user to manually enter the identifier of the AEI that the user needs to load and the information of the FPGA card.

[0099] As another possible embodiment, when deleting a virtual machine associated with a user, the shadow tenant bucket associated with the user also needs to be deleted. Specifically, the management server may also receive a third request, where the third request is for a third user to request deletion of a second virtual machine associated with the third user. Thereafter, the management server 102 may respond to the third request, release the resources occupied by the second virtual machine, and asynchronously clear the AEI in the FPGA card associated with the second virtual machine. The third user here may be the same as the first user, the same as the second user, or the same as the third user. Figure 1The first user and the second user are different. If the third user is the same as the first user, the third request can be as follows Figure 1 The VM 103 associated with the first user triggers the service server 101 to send a request to the management server 102 to delete the VM 103 associated with the first user. If the third user is the same as the second user, the third request may be as follows Figure 1 The VM 103 associated with the second user shown triggers the service server 101 to send a request to the management server 102 to delete the VM 103 associated with the second user.

[0100] By adopting the above method, the management server 102 no longer needs to wait for the AEI loaded in the FPGA card to be cleared before executing the release of the resources occupied by the second virtual machine, thereby avoiding the failure of the AEI process loaded in the FPGA card to cause the release of the resources occupied by the second virtual machine to fail, avoiding the risk of user data leakage caused by the failure to clear the resources occupied by the second virtual machine, and improving the security of the FPGA cloud service.

[0101] Specifically, when clearing the AEI in the FPGA card associated with the second virtual machine, the management server 102 can set each FPGA card to a pending clearing state, and poll every preset time period (e.g., 10 seconds or 60 seconds) to determine whether the AEI loaded in each FPGA card has been cleared. If it is determined that the FPGA card is successfully cleared, the FPGA card is set to an available state. Otherwise, it is determined that the FPGA card clearing has failed, and it is confirmed again at a preset time interval whether the AEI loaded in the FPGA card has been cleared. The management server 102 can issue an alarm after determining that the number of FPGA card clearing failures reaches a threshold (the threshold can be set to a constant, such as 1 or 3). For example, the management server 102 notifies the second virtual machine to prompt the third user that the FPGA card clearing has failed, and thereafter the third user can clear the AEI in the FPGA card through other methods.

[0102] In the above process, since the state of the FPGA card is no longer available before the AEI is cleared, it can prevent the AEI in the FPGA card from loading new AEI based on other users' requests before the AEI is cleared, avoid the leakage of AEI that has not been cleared, and improve the security of the FPGA cloud service.

[0103] Next, take the third user as Figure 1 Taking the first user in the FPGA cloud computing system 100 as an example, Figure 6 The flowchart shown illustrates the process of the first user requesting to delete the virtual machine 103:

[0104] S401: The business server sends a third request to the management server, where the third request is used for a first user to request to delete a virtual machine associated with a first user, and the third request includes authentication information of the first user;

[0105] S402: The management server receives the third request;

[0106] S403: The management server determines that the first user has passed the authentication according to the authentication information in the third request;

[0107] S404: The management server releases the resources occupied by the virtual machine, and asynchronously clears the AEI in the FPGA card associated with the virtual machine.

[0108] By adopting the method shown in the above steps S401 to S404, the clearing result of AEI in the FPGA card will not affect the release of resources occupied by the virtual machine 103. Therefore, even if the clearing of AEI in the FPGA card fails, the resources occupied by the virtual machine 103 can still be released normally, avoiding the leakage of user usage data due to the failure to release virtual machine resources normally.

[0109] Combined with the above Figures 1 to 6 , describes in detail the data management method provided by the embodiment of the present application, and will be combined with Figures 7 and 8 , describing a data processing device and server provided according to an embodiment of the present application.

[0110] Figure 7 FIG. 7 is a schematic diagram of a data management device 700 provided in an embodiment of the present application. The data management device 700 may be applied to Figure 1 The system is used to perform the functions of the management server in the above method embodiment. The data management device 700 includes a first request receiving module 701, a shadow tenant bucket determining module 702, a shadow tenant bucket storing module 703, a shadow tenant bucket creating module 704, a second request receiving module 705, a permission verification module 706, a loading module 707, a third request receiving module 708 and a deletion module 709.

[0111] The first request receiving module 701 is used to receive a first request, where the first request is used by a first user to request to register an acceleration engine image AEI customized by the first user, and the first request includes an identifier of the first user and an identifier of the AEI.

[0112] The shadow tenant bucket determination module 702 is used to determine whether there is a shadow tenant bucket associated with the identifier of the first user according to the identifier of the first user, and the shadow tenant bucket is used to store the AEI of the first user, and the shadow tenant bucket corresponds to the user one by one.

[0113] The shadow tenant bucket storage module 703 is configured to store the AEI in the shadow tenant bucket associated with the identifier of the first user when there is a shadow tenant bucket associated with the identifier of the first user.

[0114] Optionally, when the shadow tenant bucket determination module 702 determines whether there is a shadow tenant bucket associated with the identifier of the first user based on the identifier of the first user, it is specifically used to: determine the identifier of the shadow tenant bucket associated with the identifier of the first user based on a first rule, wherein the first rule is used to indicate a generation rule for generating the identifier of the shadow tenant bucket; determine whether there is a shadow tenant bucket with the identifier; and when there is a shadow tenant bucket with the identifier, determine that the shadow tenant bucket with the identifier is the shadow tenant bucket associated with the identifier of the first user.

[0115] Optionally, the shadow tenant bucket creation module 704 is used to select a storage space with a preset size when there is no shadow tenant bucket associated with the first user identifier, use the storage space as the shadow tenant bucket associated with the first user identifier, and store the AEI in the shadow tenant bucket associated with the first user identifier.

[0116] Optionally, a second request receiving module 705 is configured to receive a second request, where the second request is used by a second user to request to load the AEI, and the second request includes an identifier of the second user, an identifier of the AEI, and information of a field programmable gate array FPGA card;

[0117] An authority verification module 706, configured to verify the authority of the second user according to the identifier of the second user and the identifier of the AEI;

[0118] The loading module 707 is used to load the AEI into the FPGA card associated with the first virtual machine according to the information of the FPGA card when the second user authority verification succeeds, and the first virtual machine is the virtual machine associated with the second user.

[0119] Optionally, if the identifier of the second user includes the identifier of the first virtual machine, the permission verification module 706, when performing permission verification on the second user based on the identifier of the second user and the identifier of the AEI, is specifically used to: determine, based on a first correspondence, the identifier of the image corresponding to the identifier of the first virtual machine, wherein the first correspondence represents the correspondence between the identifier of the virtual machine and the identifier of the image allowed to be used by the virtual machine; determine, based on a second correspondence, the identifier of at least one AEI corresponding to the identifier of the image, wherein the second correspondence is the correspondence between the identifier of the image and the identifier of the AEI; and determine that the identifier of the at least one AEI includes the identifier of the AEI.

[0120] Optionally, a third request receiving module 708 is configured to receive a third request, where the third request is used by a third user to request to delete a second virtual machine, where the second virtual machine is a virtual machine associated with the third user;

[0121] The deletion module 709 is used to release the resources occupied by the second virtual machine and clear the AEI in the FPGA card associated with the second virtual machine.

[0122] Optionally, when releasing the resources occupied by the second virtual machine and clearing the AEI in the FPGA card associated with the second virtual machine, the deletion module 709 is specifically used to: set the state of the FPGA card to a to-be-cleared state, and call the AEI clearing interface of the FPGA card associated with the second virtual machine to clear the AEI loaded in the FPGA card associated with the second virtual machine; when a preset time is met, determine whether the AEI in each FPGA card in the FPGA card associated with the second virtual machine is cleared successfully; if so, set the FPGA card to an available state; otherwise, determine that the FPGA card is not cleared successfully, and after determining that the number of times the FPGA card is not cleared successfully reaches a threshold, execute an alarm.

[0123] It should be understood that Figure 7 Only one module division method of the data management device 700 is shown. The present application does not limit the data management device 700 to have other module division methods. For example, the data management device 700 can be modularized into FPGA mirror service, tenant authentication service, and AEI management service, wherein the FPGA mirror service module can have the functions of the first request receiving module 701, the shadow tenant bucket determination module 702, and the shadow tenant bucket storage module 703. The tenant authentication service module can be used to cooperate with the FPGA mirror service to authenticate the user, and the AEI management service can be used to cooperate with the FPGA mirror service 401 to perform AEI compilation. Optionally, the FPGA mirror service module can also have the functions of the shadow tenant bucket creation module 704, the second request receiving module 705, the permission verification module 706, the loading module 707, the third request receiving module 708, and the deletion module 709.

[0124] It should be understood that the device 700 of the embodiment of the present application can be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), and the PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. Figures 3 to 6 When the data processing method is shown, the device 700 and its various modules may also be software modules.

[0125] It should be understood that the device 700 may only correspond to the management server 102 involved in the embodiment of the present application, that is, the device 700 is only used to execute the following Figures 3 to 6 The corresponding steps of the management server 102 shown; the server 800 can also correspond to the business server 101 involved in the embodiment of the present application, that is, the device 700 can also be used to execute the corresponding steps of the business server 101 provided in the embodiment of the present application. At this time, the device 700 can be connected to an FPGA card.

[0126] The device 700 according to the embodiment of the present application may correspond to executing the method described in the embodiment of the present application, and the above and other operations and / or functions of each unit in the device 700 are respectively to implement Figures 3 to 6 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0127] Figure 8 A schematic diagram of the structure of a server 800 provided in an embodiment of the application is given. As shown in the figure, the server 800 includes a processor 801, a memory 802, a communication interface 803, a bus 804, and an FPGA card 805. The processor 801, the memory 802, the communication interface 803, and the FPGA card 805 communicate through the bus 804, and can also communicate through other means such as wireless transmission. The memory 802 is used to store program code 8021, and the processor 801 can call the program code 8021 stored in the memory 802 to perform the following operations:

[0128] According to the identifier of the first user in the first request received by the communication interface 803, it is determined whether there is a shadow tenant bucket associated with the identifier of the first user, and the shadow tenant bucket is used to store the AEI of the first user, and each shadow tenant bucket corresponds to a user one-to-one; when there is a shadow tenant bucket associated with the identifier of the first user, the AEI is stored in the shadow tenant bucket associated with the identifier of the first user.

[0129] Optionally, the processor 801 may also execute: determining the identifier of the shadow tenant bucket associated with the identifier of the first user according to a first rule, wherein the first rule is used to indicate a generation rule for generating the identifier of the shadow tenant bucket; judging whether there is a shadow tenant bucket with the identifier; and when there is a shadow tenant bucket with the identifier, determining that the shadow tenant bucket with the identifier is the shadow tenant bucket associated with the identifier of the first user.

[0130] Optionally, the processor 801 may also execute: when there is no shadow tenant bucket associated with the first user identifier, selecting a storage space with a preset size; using the storage space as the shadow tenant bucket associated with the first user identifier; and storing the AEI in the shadow tenant bucket associated with the first user identifier.

[0131] Optionally, the processor 801 may also execute: verifying the authority of the second user according to the identifier of the second user and the identifier of the AEI in the second request received by the communication interface 803; when the authority verification of the second user is successful, loading the AEI into the FPGA card associated with the first virtual machine according to the information of the FPGA card, and the first virtual machine is the virtual machine associated with the second user.

[0132] Optionally, the identifier of the second user includes the identifier of the first virtual machine, and the processor 801 may further execute: determining, according to a first correspondence, an identifier of an image corresponding to the identifier of the first virtual machine, wherein the first correspondence represents a correspondence between an identifier of a virtual machine and an identifier of an image allowed to be used by the virtual machine; determining, according to a second correspondence, an identifier of at least one AEI corresponding to the identifier of the image, wherein the second correspondence is a correspondence between an identifier of an image and an identifier of an AEI; and determining that the identifier of the at least one AEI includes the identifier of the AEI.

[0133] Optionally, the processor 801 may further execute: in response to a third request received by the communication interface 803, releasing resources occupied by the second virtual machine, and clearing AEI in the FPGA card associated with the second virtual machine.

[0134] Optionally, the processor 801 may also execute: setting the state of the FPGA card to a to-be-cleared state, and calling the AEI clearing interface of the FPGA card associated with the second virtual machine to clear the AEI file loaded in the FPGA card associated with the second virtual machine; when a preset time is met, determining whether the AEI file in each FPGA card in the FPGA card associated with the second virtual machine is cleared successfully; if so, setting the FPGA card to an available state; otherwise, determining that the FPGA card is not cleared successfully, and after determining that the number of times the FPGA card is not cleared successfully reaches a threshold, executing an alarm.

[0135] It should be understood that in the embodiment of the present application, the processor 801 may be a central processing unit (CPU), and the processor 801 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0136] The memory 802 may include a read-only memory and a random access memory, and provide instructions and data to the processor 801. The memory 802 may also include a non-volatile random access memory. For example, the memory 802 may also store information about the device type.

[0137] The memory 802 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM).

[0138] The bus 804 may include, in addition to the data bus, a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are labeled as bus 804 in the figure.

[0139] It should be understood that the server 800 according to the embodiment of the present application may correspond to the management server 102 provided in the embodiment of the present application, and the server 800 may be used to implement Figures 3 to 6 The corresponding steps of the method shown in the figure are executed by the management server 102, and for the sake of brevity, they are not repeated here.

[0140] It should be understood that the server 800 according to the embodiment of the present application may correspond to the data management device 700 in the embodiment of the present application, and may correspond to executing the data management device 700 according to the embodiment of the present application. Figure 3 The execution subject of the method shown in the figure, and the above and other operations and / or functions of each component in the server 800 are respectively to implement Figures 3 to 6 The corresponding process of each method in .

[0141] Exemplarily, the communication interface 803 may be used to perform the function of the first request receiving module 701 in the apparatus 700 for executing data management; the processor 801 may be used to execute the program code stored in the memory 802 to implement the function of the shadow tenant bucket determination module 702 .

[0142] Optionally, the communication interface 803 can also be used to execute the functions of the second request receiving module 705 and the third request receiving module 708, and the processor 801 can also be used to execute the functions of the shadow tenant bucket creation module 704, the permission verification module 706, the loading module 707 and the deletion module 709.

[0143] Optionally, the server 800 may further include an FPGA card 805 , in which case the server 800 may also have the function of the business server 101 in the embodiment of the present application.

[0144] It should be understood that if the server 800 corresponds to the management server 102 involved in the embodiment of the present application, that is, the server 800 is used to execute the following Figures 3 to 6 Optionally, the server 800 further includes an FPGA card 805. If the server 800 corresponds to the business server 101 involved in the embodiment of the present application, that is, the server 800 is also used to execute the corresponding steps of the business server 101 provided in the embodiment of the present application, then the server 800 includes the FPGA card 805.

[0145] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid state drive (SSD).

[0146] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0148] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0149] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Claims

1. A data management method, characterized in that: include: receiving a first request, where the first request is for a first user to request registration of an acceleration engine image AEI customized by the first user, and the first request includes an identifier of the first user and an identifier of the AEI; Determine, according to the identifier of the first user, whether there is a shadow tenant bucket associated with the identifier of the first user, the shadow tenant bucket is used to store the AEI of the first user, and each shadow tenant bucket corresponds to a user one by one; When there is a shadow tenant bucket associated with the identifier of the first user, storing the AEI in the shadow tenant bucket associated with the identifier of the first user; After storing the AEI in the shadow tenant bucket associated with the first user identifier, the method further includes: receiving a second request, where the second request is for a second user to request to load the AEI, and the second request includes an identifier of the second user, an identifier of the AEI, and information of a field programmable gate array FPGA card; Performing authority verification on the second user according to the identifier of the second user and the identifier of the AEI; When the second user authority verification succeeds, the AEI is loaded into the FPGA card associated with the first virtual machine according to the information of the FPGA card, and the first virtual machine is the virtual machine associated with the second user.

2. The method according to claim 1, characterized in that The determining, according to the identifier of the first user, whether there is a shadow tenant bucket associated with the first user identifier includes: Determine, according to a first rule, an identifier of a shadow tenant bucket associated with the identifier of the first user, wherein the first rule is used to indicate a rule for generating the identifier of the shadow tenant bucket; Determine whether there is a shadow tenant bucket with the identifier; When there is a shadow tenant bucket with the identifier, it is determined that the shadow tenant bucket with the identifier is a shadow tenant bucket associated with the identifier of the first user.

3. The method according to claim 1, characterized in that When there is no shadow tenant bucket associated with the first user identifier, the method further includes: Select a preset storage size; Using the storage space as a shadow tenant bucket associated with the first user identifier; The AEI is stored in a shadow tenant bucket associated with the first user identifier.

4. The method according to claim 1, characterized in that The identifier of the second user includes the identifier of the first virtual machine; and determining, according to the identifier of the second user and the identifier of the AEI, that the second user passes the authority verification includes: Determine, according to a first correspondence, an identifier of an image corresponding to the identifier of the first virtual machine, wherein the first correspondence represents a correspondence between the identifier of the virtual machine and the identifier of the image that the virtual machine is allowed to use; Determine, according to a second correspondence, at least one AEI identifier corresponding to the identifier of the mirror image, wherein the second correspondence is a correspondence between the identifier of the mirror image and the identifier of the AEI; Determining the identity of the at least one AEI comprises the identity of the AEI.

5. The method according to any one of claims 1 to 4, characterized in that: The method further includes: receiving a third request, where the third request is for a third user to request to delete a second virtual machine, where the second virtual machine is a virtual machine associated with the third user; The resources occupied by the second virtual machine are released, and the AEI in the FPGA card associated with the second virtual machine is cleared.

6. The method according to claim 5, characterized in that Clearing the AEI in the FPGA card associated with the second virtual machine includes: Setting the state of the FPGA card to a to-be-cleared state, and calling an AEI clearing interface of the FPGA card associated with the second virtual machine to clear the AEI file loaded in the FPGA card associated with the second virtual machine; When the preset time is met, determining whether the AEI file in each FPGA card in the FPGA card associated with the second virtual machine is successfully cleared; If yes, setting the FPGA card to an available state; Otherwise, it is determined that the FPGA card has not been successfully cleared, and after it is determined that the number of times that the FPGA card has not been successfully cleared reaches a threshold, an alarm is issued.

7. A data management device, characterized in that: include: A first request receiving module, configured to receive a first request, wherein the first request is used by a first user to request registration of an acceleration engine image AEI customized by the first user, and the first request includes an identifier of the first user and an identifier of the AEI; a shadow tenant bucket determination module, configured to determine, according to the identifier of the first user, whether there is a shadow tenant bucket associated with the identifier of the first user, the shadow tenant bucket being used to store the AEI of the first user, and each shadow tenant bucket having a one-to-one correspondence with a user; a shadow tenant bucket storage module, configured to store the AEI in the shadow tenant bucket associated with the identifier of the first user when there is a shadow tenant bucket associated with the identifier of the first user; The device also includes a second request receiving module, a permission verification module and a loading module: The second request receiving module is used to receive a second request, where the second request is used by a second user to request to load the AEI, and the second request includes an identifier of the second user, an identifier of the AEI, and information of a field programmable gate array FPGA card; The authority verification module is used to verify the authority of the second user according to the identifier of the second user and the identifier of the AEI; The loading module is used to load the AEI into the FPGA card associated with the first virtual machine according to the information of the FPGA card when the second user authority verification succeeds, and the first virtual machine is the virtual machine associated with the second user.

8. The device according to claim 7, characterized in that The shadow tenant bucket determination module is also used to determine the identifier of the shadow tenant bucket associated with the identifier of the first user according to a first rule, wherein the first rule is used to indicate the identifier generation rule of the shadow tenant bucket; determine whether there is a shadow tenant bucket with the identifier; when there is a shadow tenant bucket with the identifier, determine that the shadow tenant bucket with the identifier is the shadow tenant bucket associated with the identifier of the first user.

9. The device according to claim 7, characterized in that The device also includes: A shadow tenant bucket creation module is used to select a storage space of a preset size when there is no shadow tenant bucket associated with the first user identifier, use the storage space as the shadow tenant bucket associated with the first user identifier, and store the AEI in the shadow tenant bucket associated with the first user identifier.

10. The device according to claim 7, characterized in that The identifier of the second user includes the identifier of the first virtual machine; The authority verification module is used to determine whether the second user passes the authority verification according to the identifier of the second user and the identifier of the AEI, including: The permission verification module is used to determine, according to a first correspondence, an identifier of an image corresponding to the identifier of the first virtual machine, wherein the first correspondence represents a correspondence between the identifier of the virtual machine and an identifier of an image that the virtual machine is allowed to use; determine, according to a second correspondence, an identifier of at least one AEI corresponding to the identifier of the image, wherein the second correspondence is a correspondence between the identifier of the image and the identifier of the AEI; and determine that the identifier of the at least one AEI includes the identifier of the AEI.

11. The device according to any one of claims 7 to 10, characterized in that The device also includes a third request receiving module and a deletion module: The third request receiving module is used to receive a third request, where the third request is used by a third user to request to delete a second virtual machine, where the second virtual machine is a virtual machine associated with the third user; The deletion module is used to release the resources occupied by the second virtual machine and clear the AEI in the FPGA card associated with the second virtual machine.

12. The device according to claim 11, characterized in that The deleting module clears the AEI in the FPGA card associated with the second virtual machine, including: The deletion module is used to set the state of the FPGA card to a to-be-cleared state, and to call the AEI clearing interface of the FPGA card associated with the second virtual machine to clear the AEI loaded in the FPGA card associated with the second virtual machine; when a preset time is met, determine whether the AEI in each FPGA card in the FPGA card associated with the second virtual machine is cleared successfully; if so, set the FPGA card to an available state; otherwise, determine that the FPGA card is not cleared successfully, and after determining that the number of times the FPGA card is not cleared successfully reaches a threshold, execute an alarm.

13. A server, characterized in that: The server includes a processor and a memory, wherein the memory is used to store computer-executable instructions. When the server is running, the processor executes the computer-executable instructions in the memory to utilize the hardware resources in the server to perform the operating steps of any one of the methods described in claims 1 to 6.

Images