Image file processing method and system

Abstract

The embodiments of the present specification provide an image file processing method and system, wherein the image file processing system includes: a virtual machine, configured to send an image acquisition instruction received from a user to a node management and control module through a trusted communication interface; the node management and control module is configured to send an image acquisition request to a management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an image file identifier to be obtained and user verification information; the management and control service module is configured to verify whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained according to the user verification information, and if the user has the operation authority for the target image file, obtain the target image file and send the target image file to the node computer corresponding to the node management and control module.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of Internet technology, and in particular to a method and system for processing image files. Background Art

[0002] In FPGA (Field Programmable Gate Array) cloud products, cloud service providers rent FPGAs on physical machines to users via virtual machines (VMs), allowing them to deploy their FPGA processing logic. For ease of description, the VMs rented by cloud service providers are referred to as user VMs.

[0003] Currently, users develop FPGAs on physical machines using the Function-as-a-Service (FaaS) platform. When burning FPGA images, they address security concerns about downloading FPGA images on FaaS platforms by setting permissions for their accounts in the Resource Access Management (RAM). This involves determining whether the initiator has permission to download the image and whether the image to be burned belongs to the initiator. While RAM authentication addresses these security concerns, configuring RAM is cumbersome for users. Furthermore, the process of configuring RAM permissions is sensitive and can only be performed by a limited number of users. This creates a poor user experience and hinders the development of FaaS platforms.

[0004] In view of this, how to solve the above problems has become an urgent problem to be solved by technical personnel. Summary of the Invention

[0005] In view of this, embodiments of this specification provide an image file processing system. One or more embodiments of this specification also relate to an image file creation method, an image file acquisition method, an image file creation method, an image file creation device, two image file acquisition methods, two image file acquisition devices, a computing device, and a computer-readable storage medium to address technical deficiencies in the prior art.

[0006] According to a first aspect of an embodiment of this specification, there is provided an image file processing system, comprising:

[0007] A virtual machine configured to send an image acquisition instruction received from a user to a node management and control module through a trusted communication interface, wherein the trusted communication interface is used to establish a communication connection between the virtual machine and the node management and control module;

[0008] The node management and control module is configured to send an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information;

[0009] The management and control service module is configured to verify whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the user verification information. If the user has the operation authority for the target image file, the module obtains the target image file and sends the target image file to the node computer corresponding to the node management and control module.

[0010] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0011] The management and control service module is further configured to query the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, and determine whether the user has the operation permission for the target image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier.

[0012] Optionally, the image acquisition instruction includes a label of the image file to be acquired. In a case where the label of the image file to be acquired is a personal image, the image file processing system further includes:

[0013] The virtual machine is further configured to send the user's access key to an identity authentication module;

[0014] The identity authentication module is configured to perform authentication based on the access key, and if the authentication is successful, obtain a user identifier corresponding to the access key, and send the user identifier to the management and control service module.

[0015] Optionally, the user verification information includes an instance identifier;

[0016] The management and control service module is further configured to, upon receiving the user identifier, query a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the user identifier based on the user identifier, and determine whether the user has operation authority over the target image file corresponding to the image file identifier to be obtained if the image file identifier to be obtained is identical to the standard image file identifier and the instance identifier is identical to the standard instance identifier.

[0017] Optionally, the image file processing system further includes:

[0018] The node computer is further configured to receive the target image file and burn it into a physical board of the node computer.

[0019] Optionally, the image file processing system further includes:

[0020] The trusted communication interface includes: a device interface provided by a physical board or a virtual interface provided by a virtual machine monitor.

[0021] Optionally, the image file processing system further includes:

[0022] The virtual machine is configured to, in response to a received image creation instruction sent by a creating user, send an authentication link corresponding to a to-be-processed file in the image creation instruction and an access key of the creating user to an identity authentication module;

[0023] The identity authentication module is configured to authenticate the access key, obtain a creation user identifier corresponding to the access key if the authentication is successful, and send the authentication link and the creation user identifier to the compilation service module;

[0024] The compilation service module is configured to parse the authentication link, obtain the instance identifier and download information in the authentication link, and when the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, obtain the file to be processed from the storage space module indicated by the download information, and compile the file to be processed to generate a mirror file corresponding to the file to be processed.

[0025] Optionally, the image file processing system further includes:

[0026] The virtual machine is configured to upload a file to be processed that needs to be created as an image file and an instance identifier corresponding to the file to be processed to a storage space module in response to an upload instruction, wherein the instance identifier corresponds to an upload user identifier of an upload user who initiates the upload instruction;

[0027] The storage space module is configured to generate download information according to the file to be processed, generate an authentication link according to the download information and the instance identifier, and send the authentication link to the virtual machine.

[0028] Optionally, the image file processing system further includes:

[0029] The image collection module is configured to save the image file.

[0030] According to a second aspect of the embodiments of this specification, a method for creating an image file is provided, comprising:

[0031] The virtual machine responds to the received image creation instruction sent by the creation user and sends the authentication link corresponding to the to-be-processed file in the image creation instruction and the access key of the creation user to the identity authentication module;

[0032] The identity authentication module authenticates the access key, obtains a creation user identifier corresponding to the access key if the authentication is successful, and sends the authentication link and the creation user identifier to the compilation service module;

[0033] The compilation service module parses the authentication link, obtains the instance identifier and download information in the authentication link, and when the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, obtains the file to be processed from the storage space module indicated by the download information, and compiles the file to be processed to generate a mirror file corresponding to the file to be processed.

[0034] Optionally, the image file creation method further includes:

[0035] The virtual machine uploads the to-be-processed file to be created as an image file and the instance identifier corresponding to the to-be-processed file to the storage space module in response to the upload instruction, wherein the instance identifier corresponds to the upload user identifier of the upload user who initiates the upload instruction;

[0036] The storage space module generates download information according to the file to be processed, generates an authentication link according to the download information and the instance identifier, and sends the authentication link to the virtual machine.

[0037] Optionally, the image file creation method further includes:

[0038] The image collection module saves the image file.

[0039] According to a third aspect of an embodiment of this specification, a method for obtaining an image file is provided, including:

[0040] The virtual machine sends the received image acquisition instruction sent by the user to the node management and control module through the trusted communication interface, wherein the trusted communication interface is used to establish a communication connection between the virtual machine and the node management and control module;

[0041] The node management and control module sends an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information;

[0042] The management and control service module verifies whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the image file identifier to be obtained and the user verification information. If the user has the operation authority for the target image file, the management and control service module obtains the target image file and sends the target image file to the node computer corresponding to the node management and control module.

[0043] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0044] The management and control service module verifies whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained according to the image file identifier to be obtained and the user verification information, including:

[0045] The management and control service module queries a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the virtual machine identifier based on the virtual machine identifier. When the image file identifier to be obtained is identical to the standard image file identifier and the instance identifier is identical to the standard instance identifier, it is determined that the user has operation authority for the target image file corresponding to the image file identifier to be obtained.

[0046] Optionally, the image acquisition instruction includes a tag of the image file to be acquired. When the tag of the image file to be acquired is a personal image, the image file acquisition method further includes:

[0047] The virtual machine sends the user's access key to the identity authentication module;

[0048] The identity authentication module performs authentication based on the access key, and if the authentication is successful, obtains the user identification corresponding to the access key, and sends the user identification to the management and control service module.

[0049] Optionally, the user verification information includes an instance identifier;

[0050] The management and control service module verifies whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained according to the image file identifier to be obtained and the user verification information, including:

[0051] Upon receiving the user identifier, the management and control service module searches a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the user identifier based on the user identifier. If the image file identifier to be obtained is identical to the standard image file identifier and the instance identifier is identical to the standard instance identifier, the management and control service module determines that the user has permission to operate the target image file corresponding to the image file identifier to be obtained.

[0052] Optionally, the image file acquisition method further includes:

[0053] The node computer receives the target image file and burns it into a physical board of the node computer.

[0054] Optionally, the trusted communication interface includes: a device interface provided by a physical board or a virtual interface provided by a virtual machine monitor.

[0055] According to a fourth aspect of an embodiment of this specification, a method for creating an image file is provided, which is applied to a compile service module, including:

[0056] Receive authentication link and create user ID;

[0057] Parsing the authentication link to obtain the instance identifier and download information in the authentication link;

[0058] Parsing the instance identifier to obtain an uploading user identifier corresponding to the instance identifier, and comparing the uploading user identifier with the creating user identifier;

[0059] When the uploading user ID is the same as the creating user ID, obtaining the file to be processed according to the download information;

[0060] Compile the file to be processed to generate an image file corresponding to the file to be processed.

[0061] According to a fifth aspect of the embodiments of this specification, there is provided an image file creation device, configured in a compilation service module, comprising:

[0062] A first receiving submodule is configured to receive an authentication link and create a user identifier;

[0063] a parsing submodule, configured to parse the authentication link to obtain the instance identifier and download information in the authentication link;

[0064] a comparison submodule configured to parse the instance identifier to obtain an uploading user identifier corresponding to the instance identifier, and compare the uploading user identifier with the creating user identifier;

[0065] A first acquisition submodule is configured to acquire a file to be processed according to the download information when the uploading user identifier is the same as the creating user identifier;

[0066] The compiling submodule is configured to compile the file to be processed to generate an image file corresponding to the file to be processed.

[0067] According to a sixth aspect of an embodiment of this specification, a method for obtaining an image file is provided, which is applied to a node management and control module, including:

[0068] Receive an image acquisition instruction sent by the virtual machine through a trusted communication interface;

[0069] generating an image acquisition request in response to the image acquisition instruction;

[0070] The image acquisition request is sent to the management and control service module.

[0071] According to a seventh aspect of an embodiment of this specification, there is provided an image file acquisition device, which is configured in a node management and control module and includes:

[0072] A second receiving submodule is configured to receive an image acquisition instruction sent by the virtual machine through a trusted communication interface;

[0073] a generating submodule, configured to generate an image acquisition request in response to the image acquisition instruction;

[0074] The first sending submodule is configured to send the image acquisition request to the management and control service module.

[0075] According to an eighth aspect of an embodiment of this specification, a method for obtaining an image file is provided, which is applied to a management and control service module, including:

[0076] Receive an image acquisition request, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information;

[0077] Verifying whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained according to the image file identifier to be obtained and the user verification information;

[0078] If the user has permission to operate the target image file, obtaining the target image file;

[0079] The image file to be obtained is sent to the node computer corresponding to the node management and control module.

[0080] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0081] Verifying whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained according to the image file identifier to be obtained and the user verification information includes:

[0082] According to the virtual machine identifier, a standard image file identifier and a standard instance identifier corresponding to the virtual machine identifier are searched in a pre-stored data table;

[0083] When the image file identifier to be obtained is identical to the standard image file identifier and the instance identifier is identical to the standard instance identifier, it is determined that the user has the operation authority to obtain the image file corresponding to the image file identifier to be obtained.

[0084] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0085] The image file acquisition method further includes:

[0086] receiving a user identifier;

[0087] According to the user identifier, a standard image file identifier and a standard instance identifier corresponding to the user identifier are searched in a pre-stored data table;

[0088] When the image file identifier to be obtained is identical to the standard image file identifier and the instance identifier is identical to the standard instance identifier, it is determined that the user has the operation authority to obtain the image file corresponding to the image file identifier to be obtained.

[0089] According to a ninth aspect of the embodiments of this specification, there is provided an image file acquisition device, which is configured in a management and control service module and includes:

[0090] A third receiving submodule is configured to receive an image acquisition request, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information;

[0091] A verification submodule is configured to verify whether the user has the operation authority for the image file to be obtained corresponding to the image file identifier to be obtained according to the user verification information;

[0092] A second acquisition submodule is configured to acquire the target image file if the user has the operation authority for the target image file;

[0093] The second sending submodule is configured to send the image file to be obtained to the node computer corresponding to the node management and control module.

[0094] According to a tenth aspect of the embodiments of this specification, a computing device is provided, including:

[0095] memory and processor;

[0096] The memory is used to store computer-executable instructions, and the processor is used to execute the steps of the image file creation method applied to the compilation service module, the image file acquisition method applied to the node management module, or the image file acquisition method applied to the management service module as described above.

[0097] According to the eleventh aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, which, when executed by a processor, implement the steps of the image file creation method applied to the compilation service module or the image file acquisition method applied to the node management and control module or the image file acquisition method applied to the management and control service module.

[0098] One embodiment of this specification ensures account security through access keys, ensures that the user who uploads the file and the user who creates the image file are the same user through authentication links, and also ensures the security of creating FPGA image files. At the same time, user operation is simple and there is no need to configure a cumbersome resource access control manager. Under the premise of ensuring data permission security, it greatly facilitates user operation and improves user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] Figure 1 This is a processing flow chart of a method for creating an image file provided by an embodiment of this specification;

[0100] Figure 2 This is a processing flow chart of a method for obtaining an image file provided in one embodiment of this specification;

[0101] Figure 3 This is a schematic diagram of the structure of the FPGA hardware device interface provided by one embodiment of this specification;

[0102] Figure 4 This is a schematic diagram of the structure of a virtual trusted communication interface provided by an embodiment of this specification;

[0103] Figure 5 This is a structural diagram of an image file acquisition system for market mirroring provided by an embodiment of this specification;

[0104] Figure 6 This is a schematic diagram of the structure of an image file acquisition system for personal images provided by an embodiment of this specification;

[0105] Figure 7 This is a structural diagram of an image file processing system provided by an embodiment of this specification;

[0106] Figure 8 This is a schematic diagram of an application scenario of an FPGA management and control system applied to cloud services provided by an embodiment of this specification;

[0107] Figure 9 This is a processing flow chart of a method for creating an image file provided by an embodiment of this specification;

[0108] Figure 10This is a schematic diagram of the structure of an image file creation device provided by an embodiment of this specification;

[0109] Figure 11 This is a processing flow chart of a method for obtaining an image file provided in one embodiment of this specification;

[0110] Figure 12 This is a structural diagram of an image file acquisition device provided by an embodiment of this specification;

[0111] Figure 13 This is a processing flow chart of a method for obtaining an image file provided in one embodiment of this specification;

[0112] Figure 14 This is a structural diagram of an image file acquisition device provided by an embodiment of this specification;

[0113] Figure 15 This is a structural block diagram of a computing device provided by one embodiment of this specification. DETAILED DESCRIPTION

[0114] The following description sets forth many specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0115] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0116] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0117] First, the terms involved in one or more embodiments of this specification are explained.

[0118] PF: physical Functions, physical functions.

[0119] FPGA: Field-Programmable Gate Array, field programmable gate array.

[0120] VM: Virtual Machine.

[0121] FaaS platform: Function as a service, function as a service platform, including node control module (FaaSNc control) and function as a service background control (FaaS background control). Function as a service background control includes control service module, compilation service module and image collection module.

[0122] NC: Node Computer, node computer.

[0123] RAM: Resource Access Management, resource access control manager.

[0124] In this specification, an image file processing system is provided. One or more embodiments of this specification also involve an image file creation method, an image file acquisition method, an image file creation method, an image file creation device, two image file acquisition methods, two image file acquisition devices, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0125] Figure 1 A processing flow chart of a method for creating an image file according to an embodiment of the present specification is shown, including steps 102 to 106.

[0126] Step 102: In response to the received image creation instruction sent by the creation user, the virtual machine sends the authentication link corresponding to the to-be-processed file in the image creation instruction and the access key of the creation user to the identity authentication module.

[0127] An image file is a single file that is created by formatting the file to be processed to facilitate downloading and use by users. Users connect to the virtual machine running on the node computer through the network and send an image creation instruction to the virtual machine. The image creation instruction is an instruction to create the file to be processed as an image file. The user who initiates the image creation instruction is the creating user.

[0128] The virtual machine obtains the corresponding authentication link according to the file to be processed in the image creation instruction. The authentication link is a link address with authentication, which is mainly used to protect the user's resources from being downloaded and used by unverified sites. The authentication link can only be downloaded by designated users. In this application, the authentication link is the download link address of the file to be processed.

[0129] Optionally, before step 102, the method further includes: the virtual machine uploads the pending file that needs to be created as a mirror file and the instance identifier corresponding to the pending file to the storage space module in response to the upload instruction, wherein the instance identifier corresponds to the upload user identifier of the uploading user who initiates the upload instruction; the storage space module generates download information based on the pending file, generates an authentication link based on the download information and the instance identifier, and sends it to the virtual machine.

[0130] Before creating an FPGA image file from a file to be processed, the user must first upload the file to the storage space module within the cloud service, allowing node computers within the cloud service to access the file. The user who sends an upload instruction to the virtual machine is called the upload user. The upload instruction is an instruction initiated by the upload user to upload the file to be processed to the storage space module. The upload user creates an instance identifier for the file to be processed and transmits the file to be processed and the instance identifier to the virtual machine via the network. The instance identifier corresponds to the user identifier of the upload user. By sending the upload instruction to the virtual machine, the virtual machine responds to the upload instruction and uploads the file to be processed and the instance identifier to the storage space module within the cloud service.

[0131] The storage space module is a module used to store data in the cloud service. It can be a separate server or in the same server as other services. The location of the storage space module is not limited in this specification.

[0132] The storage space module stores the file to be processed and generates download information based on the location of the file to be processed. The download information records the location information of the file to be processed in the storage space module. An authentication link is generated based on the download information and the instance identifier. The download information in the authentication link is used to identify the storage location of the file to be processed. The instance identifier is used to correspond to the uploading user identifier, and is used to verify whether the user using the authentication link has the right to use it, and the authentication link is returned to the virtual machine.

[0133] Among cloud service authentication methods, AKSK (Access Key Id / Secret Access Key) is a common authentication method. AKSK encryption is used to verify the identity of the sender of a request. The Access Key Id (AK) is used to identify the user, and the Secret Access Key (SK) is the key used by the user to encrypt the authentication string and by the cloud service provider to verify the authentication string. SK must be kept confidential. AKSK works on the principle of symmetric encryption and decryption.

[0134] The user sends an image creation instruction through the virtual machine, and needs to make the file to be processed into an FPGA image file. The virtual machine responds to the image creation instruction and sends the authentication link corresponding to the file to be processed and the AKSK of the creating user to the identity authentication module in the cloud service.

[0135] In the embodiment provided in the present application, the virtual machine responds to the received upload instruction and sends the to-be-processed file A that needs to be created as an FPGA image file and the instance ID "001" corresponding to the to-be-processed file to the storage space module of the cloud service, wherein the instance ID corresponds to the uploading user identifier "User_1" who uploaded the to-be-processed file A.

[0136] The storage space module receives and saves the file A to be processed, generates corresponding download information according to the save location, and generates an authentication link "http: / / XXXXXX / File_name='A' / instanceid='001'" corresponding to the file to be processed according to the download information and the instance ID. The authentication link can only be used by the uploading user "User_1", and the authentication link is sent to the virtual machine.

[0137] The virtual machine receives the image creation instruction sent by the creating user, and in response to the image creation instruction, sends the authentication link "http: / / XXXXXX / File_name='A' / instanceid='001'" and the creating user's AKSK authentication key to the identity authentication module.

[0138] Step 104: The identity authentication module authenticates the access key, and if the authentication is successful, obtains the creation user ID corresponding to the access key, and sends the authentication link and the creation user ID to the compilation service module.

[0139] In order to prevent user identification from being forged and avoid the risk of data leakage, the user's identity needs to be authenticated. Therefore, in order to ensure data security, the identity authentication module is an inaccessible part in cloud services.

[0140] The identity authentication module is used to authenticate the access key. Through the preset authentication mechanism, the same SK corresponding to the AK is used to generate an authentication string and compare it with the authentication string carried in the access key. If the authentication strings are the same, the authentication is successful, otherwise, the authentication fails.

[0141] If the identity authentication is successful, the identity authentication module obtains the corresponding creation user identifier according to the access key, where the creation user identifier is the user who initiated the image creation instruction, and sends the authentication link and the creation user identifier to the compilation service module.

[0142] In the embodiment provided in the present application, following the above example, the identity authentication module authenticates the AKSK authentication key of the created user. If the authentication is successful, the created user identifier "User_1" corresponding to the authentication key is obtained, and the authentication link "http: / / XXXXXX / File_name='A' / instanceid='001'" and the created user identifier "User_1" are sent to the compilation service module.

[0143] Step 106: The compilation service module parses the authentication link to obtain the instance identifier and download information in the authentication link. When the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, the compilation service module obtains the file to be processed from the storage space module indicated by the download information, and compiles the file to be processed to generate a mirror file corresponding to the file to be processed.

[0144] The compilation service module is a server that compiles the file to be processed to generate an FPGA image file. A security check is performed in the compilation service module, and the authentication link is parsed to obtain the download information, instance identifier, and upload user identifier corresponding to the instance identifier of the file to be processed in the authentication link. When the upload user identifier is the same as the creation user identifier, it indicates that the upload user of the file to be processed in the authentication link is the creation user of the image creation instruction. The file to be processed is obtained from the storage space module indicated by the download information through the download information, and the file to be processed is compiled to generate the corresponding FPGA image file.

[0145] Optionally, the method further includes sending the FPGA image file to an image collection module for storage.

[0146] In actual application, the generated image file is saved in the image collection module, and the image file identifier of the image file is stored accordingly.

[0147] In the embodiment provided in this application, the compilation service module parses the authentication link "http: / / XXXXXX / File_name='A' / instanceid='001'" to obtain download information and an instance ID. Based on the instance ID, the upload user ID "User_1" is determined to be the creation user ID. The upload user ID "User_1" is then compared with the creation user ID "User_1." This indicates that the upload user ID is now the creation user ID, meaning that the compilation service module has passed the security check and the creation user is the user who uploaded the file to be processed. The corresponding file to be processed can be downloaded through the authentication link. Based on the download information, the corresponding file to be processed is downloaded from the designated storage space module. The file to be processed is compiled in the compilation service module to generate the corresponding FPGA image file, which is then saved to the image collection module.

[0148] The image file creation method provided in this manual ensures account security through access keys and ensures that the user who uploads the file and creates the image file is the same user through authentication links. This also ensures the security of creating FPGA image files. Furthermore, the method is user-friendly and eliminates the need to configure a complex resource access control manager. This greatly facilitates user operations and improves the user experience while ensuring data permission security.

[0149] Figure 2 A processing flow chart of a method for obtaining an image file according to an embodiment of the present specification is shown, including steps 202 to 208.

[0150] Step 202: The virtual machine sends the received image acquisition instruction sent by the user to the node management and control module through the trusted communication interface, wherein the trusted communication interface is used to establish a communication connection between the virtual machine and the node management and control module.

[0151] The user connects to a virtual machine configured on a node computer via a network and sends an image file acquisition instruction. The image file acquisition instruction carries the identifier of the image file to be acquired and is an instruction to acquire the target image file corresponding to the identifier. The virtual machine sends the image file acquisition instruction to the node management and control module configured on the node computer via a trusted communication interface configured between the virtual machine and the node computer.

[0152] The trusted communication interface can be a hardware device interface provided by a physical board, see Figure 3 , Figure 3The schematic diagram shows the structure of the hardware device interface provided by the FPGA. In the node computer 300, the FPGA uses two PFs to provide services, namely the user PF and the management PF. The user PF is directly connected to the virtual machine to realize data interaction between the user and the FPGA, and the management PF implements the control and management functions of some programmable areas, such as programmable burning and debugging functions.

[0153] The trusted communication interface can also be a virtual interface provided by the virtual machine monitor, see Figure 4 , Figure 4 The diagram shows the structure of the virtual interface provided by the virtual machine monitor. In the node computer 400, the hypervisor is an intermediate layer software running between the physical server and the operating system, used to establish and execute the software, firmware or hardware of the virtual machine. The Virtio Console interface provided by the hypervisor realizes data transmission between the virtual machine and the node management and control module.

[0154] The image file acquisition instruction in the virtual machine is sent directly to the node management and control module in the node computer through the trusted communication interface, ensuring the security of the image file acquisition instruction.

[0155] Optionally, the image acquisition instruction sent by the user includes the image file label to be obtained, and the image file label to be obtained includes a market image and a personal image. The market image can be provided to users who have the right to use it. For example, after the user purchases or rents the market image, the user has the right to use the market image. The personal image is an image for personal use by the image creating user, that is, users other than the image creating user have no right to use it.

[0156] When the image file to be obtained is a market image, the image file to be obtained is for market users. When the image file to be obtained is a personal image, it is necessary to verify whether the user who initiates the image acquisition instruction has the permission to use the image file to be obtained.

[0157] When the image file label to be obtained is a personal image, the image file obtaining method further includes:

[0158] The virtual machine sends the user's access key to the identity authentication module, and the identity authentication module performs authentication based on the access key. If the authentication is successful, the module obtains the user ID corresponding to the access key and sends the user ID to the management and control service module.

[0159] In one embodiment provided in this specification, a user logs into a virtual machine via the network and issues an image acquisition instruction to obtain an FPGA image file. The FPGA image file is a market image. Two PFs are used in the FPGA to provide services: a user PF and a management PF. The user PF directly connects to the virtual machine to enable data interaction between the user and the FPGA, while the management PF implements management and control functions for some programmable areas, such as programmable burning and debugging. The user PF and management PF provided by the FPGA can avoid the security risks caused by the user directly accessing the management PF. The virtual machine sends the image acquisition instruction sent by the user to the node management and control module in the node computer through the user PF.

[0160] In another embodiment provided in this specification, a user logs in to a virtual machine through the network and issues an image acquisition instruction to obtain an FPGA image file. The FPGA image file is a personal image. The virtual machine sends the image acquisition instruction to the node management module in the node computer through the virtual device interface provided by qemu, and at the same time sends the user's AKSK access key and the instance identifier corresponding to the image file to be obtained to the identity authentication module. The identity authentication module parses and authenticates the user's AKSK access key. If the authentication is successful, the user's user ID is obtained, and the user ID and the instance ID are sent to the FaaS background management.

[0161] Step 204: the node management and control module sends an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information.

[0162] The node control module, namely FaaSNc control, is the part of the Function as a Service (FaaS) platform set up on the node computer. In response to the image acquisition instruction sent by the virtual machine, the node control module sends an image acquisition request to the control service module (FaaS background control). The image acquisition request carries the image file identifier to be obtained and user verification information.

[0163] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier. The virtual machine runs in a node computer, and the node computer can directly obtain the virtual machine identifier of the virtual machine.

[0164] In one embodiment provided in the present application, the node management module sends the image file identifier to be obtained and user verification information to the FaaS background management in response to the image acquisition request sent by the virtual machine.

[0165] Step 206: The management and control service module verifies whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the image file identifier to be obtained and the user verification information. If the user has the operation authority for the target image file, the management and control service module obtains the target image file and sends the target image file to the node computer corresponding to the node management and control module.

[0166] Function as a Service backend control, also known as FaaS backend control, is the part of the Function as a Service (FaaS) platform used for background management, including the control service module, the compilation server module and the image collection module. FaaS backend control can be a separate server or share a server with other services. In this specification, the location of FaaS backend control is not limited. The control service module in FaaS backend control receives information sent by each FaaSNc control and performs corresponding processing.

[0167] Optionally, the management and control service module queries the standard image file identifier and standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table based on the received virtual machine identifier. The standard image identifier and standard instance identifier are information corresponding to the virtual machine identifier pre-stored in the data table. The image file identifier and instance identifier to be obtained sent by the node management and control module are cross-verified with the standard image identifier and standard instance identifier, which further ensures the security of the data. When the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, it is determined that the user has operation authority for the target image file corresponding to the image file identifier to be obtained. Otherwise, the user cannot operate the target image file.

[0168] Optionally, when the management and control service module receives the user identifier sent by the identity authentication module, it queries the standard image file identifier and standard instance identifier corresponding to the user identifier in a pre-stored data table based on the user identifier, and when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, it determines that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained.

[0169] In actual applications, it is very common to download the market image through the virtual machine ID and instance ID. Then the image file ID to be obtained is matched with the instance ID to ensure the security of the FPGA image file.

[0170] When verifying whether the user has the operation authority for the target image file, if the management and control service module does not receive the user ID sent by the identity authentication module, it means that the target image file is a market image, and verification is performed based on the virtual machine ID. If the management and control service module receives the user ID sent by the identity authentication module, it means that the target image file is a personal image, and verification is performed based on the user ID.

[0171] When it is determined that the user has the operation authority for the target image file, the target image file is obtained from the image collection module according to the image file identifier to be obtained, and the target image file is sent to the node computer corresponding to the FaaSNc management.

[0172] In the embodiments provided herein, when the FaaS backend control receives a user ID, it performs security authentication using the user ID, instance ID, and the ID of the image file to be retrieved. Otherwise, it performs security authentication using the virtual machine ID, instance ID, and the ID of the image file to be retrieved. During the security authentication process, cross-authentication of different parameters effectively ensures data security. If the FaaS backend control verifies that the user has permission to operate the corresponding target image file, it sends the target image file to the node computer.

[0173] Step 208: The node computer receives the target image file and burns it into a physical card of the node computer.

[0174] After receiving the target image file, the node computer may also respond to an image burning instruction sent by the user to burn the target image file into the corresponding FPGA.

[0175] In actual applications, the image burning instruction sent by the user may include an image obtaining instruction, that is, the user only needs to send the image burning instruction to execute the operations of obtaining the image file and burning the image file.

[0176] The image file acquisition method provided in this specification transmits image file acquisition instructions through a trusted channel between a virtual machine and a node computer. The node management module in the node computer can obtain the image file identifier, instance identifier, and virtual machine identifier to be obtained, and send the above information to the FaaS background management for permission verification, thereby ensuring data security, reducing operational complexity, eliminating the tedious process of users configuring a resource access control manager, and improving the usability of FPGA image file management, thereby improving the user experience.

[0177] Corresponding to the above-mentioned image file acquisition method, this specification also provides an embodiment of an image file acquisition system for market images. Figure 5 The following is a schematic diagram of the structure of an image file acquisition system for market mirroring provided in an embodiment of this specification, specifically including:

[0178] The virtual machine 502 is configured to send the image acquisition instruction received from the user to the node management and control module through the trusted communication interface 500, wherein the trusted communication interface 500 is used to establish a communication connection between the virtual machine and the node management and control module.

[0179] The node management and control module 504 is configured to send an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information.

[0180] The management and control service module 506 is configured to verify whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the user verification information. If the user has the operation authority for the target image file, the target image file is obtained and sent to the node computer corresponding to the node management and control module.

[0181] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0182] The management and control service module 506 is further configured to query the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, and determine whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier.

[0183] Optionally, the method further includes: the node computer 508 is further configured to receive the target image file and burn it into a physical board of the node computer.

[0184] The image file acquisition system provided in this specification is used to obtain market images. The image file acquisition instructions are transmitted through a trusted channel between the virtual machine and the node computer. The FaaSNc control in the node computer can obtain the image file identifier, instance identifier and virtual machine identifier to be obtained, and send the above information to the FaaS background control for permission verification, ensuring data security, reducing operation complexity, eliminating the tedious process of users configuring the resource access control manager, and improving the ease of use of FPGA image file management, thereby improving the user experience.

[0185] Corresponding to the above-mentioned image file acquisition method, this specification also provides an embodiment of an image file acquisition system for personal images. Figure 6 The following is a schematic diagram of a system for obtaining an image file for a personal image provided in an embodiment of the present invention, specifically comprising:

[0186] Virtual machine 602 is configured to send the image acquisition instruction received from the user to the node management and control module through the trusted communication interface 600, and send the user's access key to the identity authentication module, wherein the trusted communication interface 600 is used to establish a communication connection between the virtual machine and the node management and control module.

[0187] The node management and control module 604 is configured to send an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and an instance identifier.

[0188] The identity authentication module 606 is configured to perform authentication based on the access key, and if the authentication is successful, obtain the user identifier corresponding to the access key and send the user identifier to the management and control service module.

[0189] The management and control service module 608 is configured to query the standard image file identifier and standard instance identifier corresponding to the user identifier in a pre-stored data table according to the user identifier, and obtain the target image file when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, and send the target image file to the node computer corresponding to the node management and control module.

[0190] Optionally, also include:

[0191] The node computer 610 is further configured to receive the target image file and burn it into a physical card of the node computer.

[0192] The image file acquisition system provided in this specification is used for personal images. The image file acquisition instruction is transmitted through a trusted channel between the virtual machine and the node computer. The FaaSNc control in the node computer can obtain the image file identifier and instance identifier to be obtained, and send the above information to the FaaS background control. The virtual machine also sends the user's access key to the identity authentication module for authentication. After successful verification, the user identifier is sent to the FaaS background control. The FaaS background control cross-verifies based on the received user identifier, instance identifier and image file identifier to be obtained, ensuring data security, reducing operation complexity, eliminating the tedious process of users configuring the resource access control manager, and improving the usability of FPGA image file management, thereby improving user experience.

[0193] The present application also provides a system for processing image files. Figure 7 , Figure 7The following is a schematic diagram showing the structure of an image file processing system provided by an embodiment of this specification, which specifically includes:

[0194] The virtual machine 702 is configured to send the image acquisition instruction received from the user to the node management and control module 704 through the trusted communication interface, wherein the trusted communication interface is used to establish a communication connection between the virtual machine 702 and the node management and control module 704;

[0195] The node management module 704 is configured to send an image acquisition request to the management service module 706 in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information;

[0196] The management and control service module 706 is configured to verify whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the user verification information. If the user has the operation authority for the target image file, the target image file is obtained and sent to the node computer 708 corresponding to the node management and control module 704.

[0197] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0198] The management and control service module 706 is further configured to query the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, and determine whether the user has the operation permission for the target image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier.

[0199] Optionally, the image acquisition instruction includes a label of the image file to be acquired. In a case where the label of the image file to be acquired is a personal image, the image file processing system further includes:

[0200] The virtual machine 702 is further configured to send the user's access key to the identity authentication module 710;

[0201] The identity authentication module 710 is configured to perform authentication based on the access key, and if the authentication is successful, obtain the user identifier corresponding to the access key and send the user identifier to the management and control service module 706.

[0202] Optionally, the user verification information includes an instance identifier;

[0203] The management and control service module 706 is further configured to, upon receiving the user identifier, query the standard image file identifier and the standard instance identifier corresponding to the user identifier in a pre-stored data table according to the user identifier, and determine whether the user has the operation permission for the target image file corresponding to the image file identifier to be obtained if the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier.

[0204] Optionally, the image file processing system further includes:

[0205] The node computer 702 is further configured to receive the target image file and burn it into a physical card of the node computer.

[0206] Optionally, the image file processing system further includes:

[0207] The trusted communication interface includes: a device interface provided by a physical board or a virtual interface provided by a virtual machine monitor.

[0208] Optionally, the image file processing system further includes:

[0209] The virtual machine 702 is configured to, in response to a received image creation instruction sent by a creating user, send an authentication link corresponding to the to-be-processed file in the image creation instruction and an access key of the creating user to the identity authentication module 710;

[0210] The identity authentication module 710 is configured to authenticate the access key, obtain the creation user ID corresponding to the access key if the authentication is successful, and send the authentication link and the creation user ID to the compilation service module 712;

[0211] The compilation service module 712 is configured to parse the authentication link, obtain the instance identifier and download information in the authentication link, and when the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, obtain the file to be processed from the storage space module 714 indicated by the download information, and compile the file to be processed to generate a mirror file corresponding to the file to be processed.

[0212] Optionally, the image file processing system further includes:

[0213] The virtual machine 702 is configured to upload, in response to an upload instruction, a file to be processed that needs to be created as an image file and an instance identifier corresponding to the file to be processed to a storage space module, wherein the instance identifier corresponds to an upload user identifier of an upload user who initiates the upload instruction;

[0214] The storage space module 714 is configured to generate download information according to the file to be processed, generate an authentication link according to the download information and the instance identifier, and send the authentication link to the virtual machine.

[0215] Optionally, the image file processing system further includes:

[0216] The image collection module 716 is configured to save the image file.

[0217] The image file processing system provided in this manual ensures account security through access keys and ensures that the user who uploads the file is the same user who creates the image file through authentication links. This also ensures the security of FPGA image file creation. At the same time, user operation is simple and there is no need to configure a cumbersome resource access control manager. While ensuring data permission security, it greatly facilitates user operation and improves the user experience. During the image file acquisition phase, the acquisition instruction is directly sent to the corresponding node control module through the virtual machine. The node control module then sends the acquisition instruction to the function-as-a-service background control, ensuring data security, reducing operational complexity, and eliminating the tedious process of user configuration of the resource access control manager. This further improves the usability of FPGA image file management, thereby improving the user experience.

[0218] Figure 8 A schematic diagram of an application scenario of an FPGA management and control system for cloud services provided by an embodiment of this specification is shown, specifically including:

[0219] The user connects to the virtual machine 802 on the node computer 816 through the cloud control platform on the personal computer and sends relevant instructions to the virtual machine 802.

[0220] Virtual machine 802 is configured to upload the pending file that needs to be created as a mirror file and the instance identifier corresponding to the pending file to the storage space module in response to the upload instruction, wherein the instance identifier corresponds to the upload user identifier of the uploading user who initiates the upload instruction.

[0221] The storage space module 804 is configured to generate download information according to the file to be processed, generate an authentication link according to the download information and the instance identifier, and send the authentication link to the virtual machine.

[0222] The virtual machine 802 is further configured to, in response to receiving an image creation instruction sent by a creating user, send an authentication link corresponding to the to-be-processed file in the image creation instruction and an access key of the creating user to the identity authentication module.

[0223] The identity authentication module 806 is configured to authenticate the access key, obtain the creation user identifier corresponding to the access key if the authentication is successful, and send the authentication link and the creation user identifier to the compilation service module.

[0224] The compilation service module 808 is configured to parse the authentication link, obtain the instance identifier and download information in the authentication link, and when the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, obtain the file to be processed from the storage space module indicated by the download information, and compile the file to be processed to generate a mirror file corresponding to the file to be processed.

[0225] The image collection module 810 is configured to save the image file.

[0226] The virtual machine 802 is further configured to send the image acquisition instruction received from the user to send the personal image to the node management and control module through the trusted communication interface, and send the user's access key to the identity authentication module, wherein the trusted communication interface is the user PF and management PF provided by the physical board FPGA.

[0227] The node management and control module 812 is configured to send an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and an instance identifier.

[0228] The identity authentication module 806 is further configured to perform authentication based on the access key, and if the authentication is successful, obtain a user identifier corresponding to the access key, and send the user identifier to the management and control service module.

[0229] The management and control service module 814 is configured to query the standard image file identifier and standard instance identifier corresponding to the user identifier in a pre-stored data table according to the user identifier. When the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, the target image file corresponding to the image file identifier to be obtained is obtained from the image collection module 810, and the target image file is sent to the node computer corresponding to the node management and control module.

[0230] The node computer 816 is further configured to receive the target image file and burn the target image file into a physical board of the node computer.

[0231] Figure 9A processing flow chart of a method for creating an image file according to an embodiment of the present specification is shown. The method for creating an image file is applied to a compilation service module and includes steps 902 to 910.

[0232] Step 902: Receive an authentication link and create a user ID.

[0233] Step 904: Parse the authentication link to obtain the instance identifier and download information in the authentication link.

[0234] Step 906: Parse the instance identifier to obtain the upload user identifier corresponding to the instance identifier, and compare the upload user identifier with the creation user identifier.

[0235] Step 908: When the uploading user ID is the same as the creating user ID, the file to be processed is obtained according to the download information.

[0236] Step 910: Compile the file to be processed to generate an image file corresponding to the file to be processed.

[0237] For detailed explanations of steps 902 to 910 , please refer to the detailed contents of step 106 in the aforementioned image file creation method, which will not be repeated here.

[0238] The image file creation method provided in this specification is applied to a compilation service module. In the compilation service module, an authentication link is parsed to obtain an instance identifier and download information from the authentication link. The corresponding uploading user identifier is obtained based on the instance identifier. If the uploading user identifier is the same as the creating user identifier, the corresponding to-be-processed file is obtained based on the download information, and the to-be-processed file is compiled to generate the corresponding image file. In the compilation service module, the authentication link is parsed and verification is performed to determine whether the user who initiated the image creation instruction is the same as the uploading user, thereby ensuring the security of data information.

[0239] Corresponding to the above-mentioned embodiment of the image file creation method, this specification also provides an embodiment of an image file creation device. Figure 10 FIG1 shows a schematic diagram of a structure of an image file creation device provided by an embodiment of this specification. Figure 10 As shown, the device includes:

[0240] The first receiving submodule 1002 is configured to receive an authentication link and create a user identifier.

[0241] The parsing submodule 1004 is configured to parse the authentication link to obtain the instance identifier and download information in the authentication link.

[0242] The comparison submodule 1006 is configured to parse the instance identifier to obtain an uploading user identifier corresponding to the instance identifier, and compare the uploading user identifier with the creating user identifier.

[0243] The first acquisition submodule 1008 is configured to acquire the to-be-processed file according to the download information when the uploading user ID is the same as the creating user ID.

[0244] The compiling submodule 1010 is configured to compile the file to be processed to generate an image file corresponding to the file to be processed.

[0245] The above is a schematic diagram of an image file creation device according to this embodiment. It should be noted that the technical solution of this image file creation device and the technical solution of the image file creation method applied to the compilation service module are based on the same concept. For details not described in detail in the technical solution of the image file creation device, please refer to the description of the technical solution of the image file creation method applied to the compilation service module.

[0246] The image file creation device provided in this specification is configured in a compilation service module. In the compilation service module, an authentication link is parsed to obtain an instance identifier and download information in the authentication link. The corresponding uploading user identifier is obtained based on the instance identifier. When the uploading user identifier and the creating user identifier are the same, the corresponding to-be-processed file is obtained based on the download information, and the to-be-processed file is compiled to generate the corresponding image file. In the compilation service module, the authentication link is parsed and verification is performed to determine whether the user who initiated the image creation instruction is the same as the uploading user, thereby ensuring the security of data information.

[0247] Figure 11 A processing flow chart of a method for obtaining an image file according to an embodiment of the present specification is shown. The image file creation method is applied to a node management and control module and includes steps 1102 to 1106.

[0248] Step 1102: Receive an image acquisition instruction sent by the virtual machine through the trusted communication interface.

[0249] Step 1104: Generate an image acquisition request in response to the image acquisition instruction.

[0250] Step 1106: Send the image acquisition request to the management and control service module.

[0251] For detailed explanations of steps 1102 to 1106 , please refer to the detailed contents of step 204 in the aforementioned image file acquisition method, which will not be repeated here.

[0252] The image file acquisition method provided in this specification is applied to the node management and control module. The node management and control module implements trusted communication with the virtual machine through the trusted communication interface, and realizes the transmission of FPGA image acquisition instructions from the virtual machine, which simplifies the tedious operation of permission setting while also ensuring data security.

[0253] Corresponding to the above-mentioned image file acquisition method embodiment, this specification also provides an image file acquisition device embodiment, Figure 12 FIG1 shows a schematic diagram of a structure of an image file creation device provided by an embodiment of this specification, wherein the image file acquisition device is configured in a node management module. Figure 12 As shown, the device includes:

[0254] The second receiving submodule 1202 is configured to receive an image acquisition instruction sent by the virtual machine through the trusted communication interface.

[0255] The generating submodule 1204 is configured to generate an image acquisition request in response to the image acquisition instruction.

[0256] The first sending submodule 1206 is configured to send the image acquisition request to the management and control service module.

[0257] The above is a schematic diagram of an image file acquisition device according to this embodiment. It should be noted that the technical solution of this image file acquisition device and the technical solution of the image file acquisition method applied to the node management module are based on the same concept. For details not described in detail in the technical solution of the image file acquisition device, please refer to the description of the technical solution of the image file acquisition method applied to the node management module.

[0258] The image file acquisition device provided in this specification is configured in the node management and control module. The node management and control module realizes trusted communication with the virtual machine through the trusted communication interface, realizes the transmission of FPGA image acquisition instructions by the virtual machine, simplifies the tedious operation of permission setting, and also ensures data security.

[0259] Figure 13 A processing flow chart of a method for obtaining an image file according to an embodiment of the present specification is shown. The image file creation method is applied to a management and control service module and includes steps 1302 to 1308.

[0260] Step 1302: Receive an image acquisition request, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information.

[0261] Step 1304: Verify whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the image file identifier to be obtained and the user verification information.

[0262] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0263] Verifying whether the user has the operation authority for the target image file corresponding to the image file identifier to be obtained based on the image file identifier to be obtained and the user verification information includes: querying a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the virtual machine identifier based on the virtual machine identifier; and determining that the user has the operation authority for obtaining the image file corresponding to the image file identifier to be obtained if the image file identifier to be obtained is identical to the standard image file identifier and the instance identifier is identical to the standard instance identifier.

[0264] Optionally, the image file acquisition method further includes:

[0265] Receive a user identifier; query a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the user identifier based on the user identifier; and determine that the user has the operation authority to obtain the image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier.

[0266] Step 1306: If the user has permission to operate the target image file, obtain the target image file.

[0267] Step 1308: Send the image file to be obtained to the node computer corresponding to the node management and control module.

[0268] For detailed explanations of steps 1302 to 1308 , please refer to the detailed contents of step 206 in the aforementioned image file acquisition method, which will not be repeated here.

[0269] The image file acquisition method provided in this specification is applied to the management and control service module. The management and control service module verifies the identity of the user who initiated the image acquisition instruction based on the received user verification information. If the verification is successful, the FPGA image file is sent to the node computer, ensuring the data security of the FPGA image file while simplifying the tedious operation of permission setting.

[0270] Corresponding to the above-mentioned image file acquisition method embodiment, this specification also provides an image file acquisition device embodiment, Figure 14 A schematic diagram of the structure of an image file creation device provided by an embodiment of this specification is shown. The image file acquisition device is configured in the management and control service module. Figure 14 As shown, the device includes:

[0271] The third receiving submodule 1402 is configured to receive an image acquisition request, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information;

[0272] The verification submodule 1404 is configured to verify, based on the user verification information, whether the user has the operation authority for the image file to be obtained corresponding to the image file identifier to be obtained.

[0273] The second acquisition submodule 1406 is configured to acquire the target image file if the user has the operation authority for the target image file.

[0274] The second sending submodule 1408 is configured to send the image file to be obtained to the node computer corresponding to the node management and control module.

[0275] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0276] The verification submodule 1404 is further configured to query the standard image file identifier and standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier; and when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, determine that the user has the operation authority to obtain the image file corresponding to the image file identifier to be obtained.

[0277] Optionally, the user authentication information includes a virtual machine identifier and an instance identifier;

[0278] The image file acquisition device also includes:

[0279] A fourth receiving submodule is configured to receive a user identification;

[0280] The verification submodule 1404 is further configured to query the standard image file identifier and the standard instance identifier corresponding to the user identifier in a pre-stored data table according to the user identifier; and determine whether the user has the operation permission to obtain the image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier.

[0281] The above is a schematic diagram of an image file acquisition device according to this embodiment. It should be noted that the technical solution of this image file acquisition device and the technical solution of the image file acquisition method applied to the management and control service module are based on the same concept. For details not described in detail in the technical solution of the image file acquisition device, please refer to the description of the technical solution of the image file acquisition method applied to the management and control service module.

[0282] The image file acquisition device provided in this specification is configured in the management and control service module. The management and control service module verifies the identity of the user who initiated the image acquisition instruction based on the received user verification information. If the verification is successful, the FPGA image file is sent to the node computer, ensuring the data security of the FPGA image file while simplifying the tedious operation of permission setting.

[0283] Figure 15 15 shows a block diagram of a computing device 1500 according to one embodiment of the present disclosure. Components of the computing device 1500 include, but are not limited to, a memory 1510 and a processor 1520. The processor 1520 is connected to the memory 1510 via a bus 1530, and a database 1550 is used to store data.

[0284] The computing device 1500 also includes an access device 1540 that enables the computing device 1500 to communicate via one or more networks 1560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 1540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0285] In one embodiment of the present specification, the above components of the computing device 1500 and Figure 15 Other components not shown in the figure may also be connected to each other, for example, via a bus. Figure 15 The computing device structure block diagram shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art may add or replace other components as needed.

[0286] Computing device 1500 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. Computing device 1500 can also be a mobile or stationary server.

[0287] Among them, the memory 1510 is used to store computer executable instructions, and the processor 1520 is used to execute the steps of the image file creation method applied to the compilation service module or the image file acquisition method applied to the node management module or the image file acquisition method applied to the management service module as described above.

[0288] The above is a schematic diagram of a computing device according to this embodiment. It should be noted that the technical solution of this computing device is based on the same concept as the aforementioned method for creating an image file for a compilation service module, the method for obtaining an image file for a node management and control module, or the method for obtaining an image file for a management and control service module. For details not described in detail in the technical solution of the computing device, please refer to the description of the aforementioned method for creating an image file for a compilation service module, the method for obtaining an image file for a node management and control module, or the method for obtaining an image file for a management and control service module.

[0289] An embodiment of the present specification also provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, are used to implement the steps of the image file creation method applied to the compilation service module, the image file acquisition method applied to the node management module, or the image file acquisition method applied to the management service module.

[0290] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of this storage medium and the technical scheme of the aforementioned image file creation method applied to the compilation service module, the image file acquisition method applied to the node management module, or the image file acquisition method applied to the management service module are based on the same concept. For details not described in detail in the technical scheme of the storage medium, please refer to the description of the technical scheme of the aforementioned image file creation method applied to the compilation service module, the image file acquisition method applied to the node management module, or the image file acquisition method applied to the management service module.

[0291] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0292] The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0293] It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0294] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0295] The preferred embodiments disclosed above are intended only to help illustrate this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made based on the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that those skilled in the art can better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. An image file processing system, comprising: A virtual machine configured to send an image acquisition instruction received from a user to a node management and control module through a trusted communication interface, wherein the trusted communication interface is used to establish a communication connection between the virtual machine and the node management and control module; The node management and control module is configured to send an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an image file identifier to be acquired and user verification information, the user verification information includes a virtual machine identifier and an instance identifier, and the instance identifier corresponds to the user; The management and control service module is configured to query the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, and determine that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, and obtain the target image file when the user has the operation authority for the target image file, and send the target image file to the node computer corresponding to the node management and control module, wherein the standard instance identifier corresponds to the upload user identifier, the upload user identifier is the identifier corresponding to the upload user, the upload user is the user who uploads the standard image file, and the standard image file is the image file corresponding to the standard image file identifier.

2. The image file processing system according to claim 1, wherein the image acquisition instruction includes a label of the image file to be acquired, and when the label of the image file to be acquired is a personal image, the system further comprises: The virtual machine is further configured to send the user's access key to an identity authentication module; The identity authentication module is configured to perform authentication according to the access key, and if the authentication is successful, obtain a user identifier corresponding to the access key, and send the user identifier to the management and control service module.

3. The image file processing system according to claim 2, wherein the user authentication information includes an instance identifier; The management and control service module is further configured to query the standard image file identifier and the standard instance identifier corresponding to the user identifier in a pre-stored data table according to the user identifier when the user identifier is received.

4. The image file processing system according to claim 1, further comprising: The node computer is further configured to receive the target image file and burn it into a physical board of the node computer.

5. The image file processing system according to claim 1, wherein the trusted communication interface comprises: A device interface provided by a physical card or a virtual interface provided by a virtual machine monitor.

6. The image file processing system according to claim 1, further comprising: The virtual machine is configured to send, in response to a received image creation instruction sent by a creating user, an authentication link corresponding to the to-be-processed file in the image creation instruction and an access key of the creating user to an identity authentication module; The identity authentication module is configured to authenticate the access key, obtain a creation user identifier corresponding to the access key if the authentication is successful, and send the authentication link and the creation user identifier to the compilation service module; The compilation service module is configured to parse the authentication link, obtain the instance identifier and download information in the authentication link, and when the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, obtain the file to be processed from the storage space module indicated by the download information, and compile the file to be processed to generate a mirror file corresponding to the file to be processed.

7. The image file processing system according to claim 6, further comprising: The virtual machine is configured to upload, in response to an upload instruction, a to-be-processed file that needs to be created as an image file and an instance identifier corresponding to the to-be-processed file to a storage space module, wherein the instance identifier corresponds to an upload user identifier of an upload user who initiates the upload instruction; The storage space module is configured to generate download information according to the file to be processed, generate an authentication link according to the download information and the instance identifier, and send the authentication link to the virtual machine.

8. The image file processing system according to claim 6, further comprising: The image collection module is configured to save the image file.

9. A method for creating an image file, comprising: The virtual machine responds to the received image creation instruction sent by the creation user by sending the authentication link corresponding to the to-be-processed file in the image creation instruction and the access key of the creation user to the identity authentication module; The identity authentication module authenticates the access key, obtains a creation user identifier corresponding to the access key if the authentication is successful, and sends the authentication link and the creation user identifier to the compilation service module; The compilation service module parses the authentication link, obtains the instance identifier and download information in the authentication link, obtains the file to be processed from the storage space module indicated by the download information when the upload user identifier corresponding to the instance identifier is the same as the creation user identifier, and compiles the file to be processed to generate a mirror file corresponding to the file to be processed.

10. The image file creation method according to claim 9, further comprising: The virtual machine uploads the to-be-processed file to be created as an image file and the instance identifier corresponding to the to-be-processed file to the storage space module in response to the upload instruction, wherein the instance identifier corresponds to the upload user identifier of the upload user who initiates the upload instruction; The storage space module generates download information according to the file to be processed, generates an authentication link according to the download information and the instance identifier, and sends the authentication link to the virtual machine.

11. The image file creation method according to claim 9, further comprising: The image collection module saves the image file.

12. A method for obtaining an image file, comprising: The virtual machine sends the received image acquisition instruction sent by the user to the node management and control module through the trusted communication interface, wherein the trusted communication interface is used to establish a communication connection between the virtual machine and the node management and control module, and the user verification information includes a virtual machine identifier and an instance identifier, and the instance identifier corresponds to the user; The node management and control module sends an image acquisition request to the management and control service module in response to the image acquisition instruction, wherein the image acquisition request includes an identifier of the image file to be acquired and user verification information; According to the virtual machine identifier, the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier are queried in a pre-stored data table. When the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, it is determined that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained. When the user has the operation authority for the target image file, the target image file is obtained and sent to the node computer corresponding to the node management and control module, wherein the standard instance identifier corresponds to the upload user identifier, the upload user identifier is the identifier corresponding to the upload user, the upload user is the user who uploads the standard image file, and the standard image file is the image file corresponding to the standard image file identifier.

13. The image file acquisition method according to claim 12, wherein the image acquisition instruction includes a label of the image file to be acquired, and when the label of the image file to be acquired is a personal image, the method further comprises: The virtual machine sends the user's access key to the identity authentication module; The identity authentication module performs authentication according to the access key, and if the authentication is successful, obtains the user identification corresponding to the access key, and sends the user identification to the management and control service module.

14. The image file acquisition method according to claim 13, wherein the method comprises searching a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the virtual machine identifier according to the virtual machine identifier, comprising: When receiving the user identifier, the management and control service module searches a pre-stored data table for a standard image file identifier and a standard instance identifier corresponding to the user identifier according to the user identifier.

15. The image file acquisition method according to claim 12, further comprising: The node computer receives the target image file and burns it into a physical board of the node computer.

16. The image file acquisition method according to claim 12, wherein the trusted communication interface comprises: A device interface provided by a physical card or a virtual interface provided by a virtual machine monitor.

17. A method for creating an image file, applied to a compiling service module, comprising: Receive authentication link and create user ID; Parsing the authentication link to obtain the instance identifier and download information in the authentication link; Parsing the instance identifier to obtain an uploading user identifier corresponding to the instance identifier, and comparing the uploading user identifier with the creating user identifier; When the uploading user ID is the same as the creating user ID, obtaining the file to be processed according to the download information; The file to be processed is compiled to generate an image file corresponding to the file to be processed.

18. An image file creation device, configured in a compilation service module, comprising: A first receiving submodule is configured to receive an authentication link and create a user identifier; A parsing submodule, configured to parse the authentication link to obtain the instance identifier and download information in the authentication link; A comparison submodule is configured to parse the instance identifier to obtain an uploading user identifier corresponding to the instance identifier, and compare the uploading user identifier with the creating user identifier; A first acquisition submodule is configured to acquire a to-be-processed file according to the download information when the uploading user identifier is the same as the creating user identifier; The compiling submodule is configured to compile the file to be processed to generate an image file corresponding to the file to be processed.

19. A method for obtaining an image file, applied to a node management and control module, comprising: Receiving an image acquisition instruction sent by the virtual machine through a trusted communication interface; generating an image acquisition request in response to the image acquisition instruction, wherein the image acquisition request includes an image file identifier to be acquired and user verification information, the user verification information includes a virtual machine identifier and an instance identifier, and the instance identifier corresponds to the image acquisition instruction; The image acquisition request is sent to the management and control service module, so that the management and control service module searches for the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier. When the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, it is determined that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained. When the user has the operation authority for the target image file, the target image file is obtained and sent to the node computer corresponding to the node management and control module.

20. An image file acquisition device, configured in a node management module, comprising: A second receiving submodule is configured to receive an image acquisition instruction sent by the virtual machine through a trusted communication interface; A generating submodule, configured to generate an image acquisition request in response to the image acquisition instruction, wherein the image acquisition request includes an image file identifier to be acquired and user verification information, the user verification information includes a virtual machine identifier and an instance identifier, and the instance identifier corresponds to the image acquisition instruction; The first sending submodule is configured to send the image acquisition request to the management and control service module, so that the management and control service module searches for a standard image file identifier and a standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, and when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, determines that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained, and when the user has the operation authority for the target image file, obtains the target image file and sends the target image file to the node computer corresponding to the node management and control module.

21. A method for obtaining an image file, applied to a management and control service module, comprising: Receive an image acquisition request, wherein the image acquisition request includes an image file identifier to be acquired and user verification information, the user verification information includes a virtual machine identifier and an instance identifier, and the instance identifier corresponds to the user; According to the virtual machine identifier, querying the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table, and determining that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, wherein the standard instance identifier corresponds to the uploading user identifier, the uploading user identifier is the identifier corresponding to the uploading user, the uploading user is the user who uploads the standard image file, and the standard image file is the image file corresponding to the standard image file identifier; If the user has the operation authority for the target image file, obtaining the target image file; The image file to be obtained is sent to the node computer corresponding to the node management and control module.

22. The image file acquisition method according to claim 21, querying the standard image file identifier and the standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, comprising: receiving a user identification; According to the user identifier, a standard image file identifier and a standard instance identifier corresponding to the user identifier are searched in a pre-stored data table.

23. A mirror file acquisition device, configured in a management and control service module, comprising: A third receiving submodule is configured to receive an image acquisition request, wherein the image acquisition request includes an image file identifier to be acquired and user verification information, the user verification information includes a virtual machine identifier and an instance identifier, and the instance identifier corresponds to the user; a verification submodule, configured to query a standard image file identifier and a standard instance identifier corresponding to the virtual machine identifier in a pre-stored data table according to the virtual machine identifier, and determine that the user has the operation authority for the target image file corresponding to the image file identifier to be obtained when the image file identifier to be obtained is the same as the standard image file identifier and the instance identifier is the same as the standard instance identifier, wherein the standard instance identifier corresponds to the uploading user identifier, the uploading user identifier is an identifier corresponding to the uploading user, the uploading user is a user who uploads the standard image file, and the standard image file is an image file corresponding to the standard image file identifier; A second acquisition submodule is configured to acquire the target image file if the user has the operation authority for the target image file; The second sending submodule is configured to send the image file to be obtained to the node computer corresponding to the node management and control module.

24. A computing device comprising a memory, a processor, and computer instructions stored in the memory and executable on the processor, characterized in that: When the processor executes the instructions, the steps of the method described in any one of claims 17 or 19 or 21-22 are implemented.

25. A computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the steps of the method described in any one of claims 17 or 19 or 21-22.

Images