Cluster expansion method and device based on mimicry defense

Abstract

The application provides a swarm expansion method and device based on mimicry defense, and the method comprises the following steps: step 1, an input agent module receives a first URL and distributes the first URL to each execution body module; step 2, each execution body module receives the first URL from the input agent module, generates a corresponding execution result and sends the execution result to a decision module; step 3, the decision module receives the execution results sent by each execution body module respectively, and makes a decision on the received execution results; when the decision is passed, the execution result after the decision is sent to a master node of an original swarm; when the decision is not passed, the swarm expansion operation is terminated; step 4, after receiving the execution result after the decision, the master node of the original swarm performs a swarm expansion operation according to the first URL. The application effectively solves unknown security problems that may exist during the expansion of the swarm, and improves the continuity of the storage swarm service and the defense capability against unknown attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mimicry defense technology, and in particular, relates to a cluster expansion method and device based on mimicry defense. BACKGROUND

[0002] The dynamic redundancy architecture and feedback control mechanism of active perception of unknown threats in mimicry defense technology greatly enhance the endogenous security characteristics in cyberspace. Storage clusters play an irreplaceable role in IT infrastructure. When the capacity of an existing cluster is insufficient, the cluster needs to be expanded. During the cluster expansion, it is also crucial to ensure the security of the cluster and the newly expanded nodes.

[0003] The traditional cluster expansion method usually configures the related configurations of the new expanded nodes in advance for the user, then adds the configurations and network information of the new nodes to the existing cluster, and then sequentially or in batches adds the nodes to be expanded to the existing cluster. However, this method has the following disadvantages: when the number of nodes to be expanded is large, the execution of this method is troublesome, and the security during execution cannot be guaranteed. There are no any abnormal defense measures in the entire execution process, which makes the cluster unable to resist possible threats during the expansion process, and if it is threatened by the network, it may cause serious consequences.

[0004] In order to solve the above problems, people have been seeking an ideal technical solution. SUMMARY

[0005] The present application aims at the deficiencies of the prior art, and provides a cluster expansion method and device based on mimicry defense.

[0006] In order to achieve the above purpose, the technical scheme adopted by the present application is:

[0007] The present application provides a cluster expansion method based on mimicry defense, which comprises the following steps:

[0008] Step 1, the input agent module receives a first URL and copies and distributes it to each execution body module; wherein the first URL includes the new node information to be added to the cluster;

[0009] Step 2, the execution body module receives the first URL from the input agent module, generates the corresponding execution result and sends it to the decision module;

[0010] Step 3, the decision module receives the execution results sent by each execution body module respectively, and makes a decision on the received execution results;

[0011] When the decision passes, the new node is determined as a trusted node, and the execution result after the decision is sent to the master node of the original cluster; when the decision does not pass, the new node is determined as an abnormal node, and an error information is returned to the input agent module through the execution body module to terminate the cluster expansion operation;

[0012] Step 4, after receiving the execution result after the decision, the master node of the original cluster executes the cluster expansion operation according to the first URL.

[0013] The second aspect of the application provides a cluster expansion device based on quasimodo defense, which comprises an input agent module, an execution body module, a decision module and a master node of an original cluster.

[0014] The input agent module is used for receiving a first URL and copying and distributing the first URL to each execution body module; wherein the first URL comprises new node information to be added to the cluster.

[0015] The execution body module is used for receiving the first URL from the input agent module, generating a corresponding execution result and sending the execution result to the decision module.

[0016] The decision module is used for receiving the execution result sent by each execution body module respectively, and making a decision on the received execution result; when the decision passes, the new node is determined as a trusted node, and the execution result after the decision is sent to the master node of the original cluster; when the decision does not pass, the new node is determined as an abnormal node, and an error information is returned to the input agent module through the execution body module to terminate the cluster expansion operation.

[0017] The master node of the original cluster is used for executing the cluster expansion operation according to the first URL after receiving the first URL.

[0018] The application has the following advantages:

[0019] 1) The application provides a cluster expansion method and device based on quasimodo defense, which effectively solves the unknown security problems that may exist during the expansion of the cluster, improves the continuity of the storage cluster service and the defense capability against unknown attacks, and improves the security of the entire storage cluster.

[0020] 2) The application uses the quasimodo defense idea to perform security filtering on the information communicated between clusters, greatly guarantees the security of the cluster during expansion, guarantees the security of the existing cluster, and improves the attack resistance capability and service continuity of the storage cluster system.

[0021] 3) On the basis of the cluster expansion method and device based on mimicry defense of the application, the user ensures that the original cluster and the network to be joined in the cluster are smooth, fills in the IP and mask information of the new node, and then the new node is automatically added to the cluster, the cluster expansion operation is simple, and the cluster expansion efficiency is high. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a timing diagram of the cluster expansion method based on mimicry defense of the application;

[0023] Figure 2 is a structural schematic diagram of the cluster expansion device based on mimicry defense of the application;

[0024] Figure 3 is a partial flowchart of the cluster expansion method based on mimicry defense of the application. DETAILED DESCRIPTION

[0025] The technical solutions of the application will be further described in detail through specific embodiments.

[0026] Cluster, a group of independent computers interconnected through high-speed networks, constitutes a group and is managed in a single system mode. When a client interacts with the cluster, the cluster acts as an independent server;

[0027] The cluster is divided into OSD (Ceph object storage device), MON (abbreviation of Monitor) and client three types of components from the component aspect, wherein the OSD component is responsible for managing a disk, the MON component forms a cluster and is responsible for managing metadata, and the client realizes access to the cluster;

[0028] MDS (abbreviation of Metadata Server) refers to a metadata cluster, and in Ceph, a metadata cluster (MDS) is used to manage file metadata.

[0029] URL (Uniform Resource Locator, Uniform Resource Locator) is the uniform resource locator of www. Simply put, URL is the web address, commonly known as "website".

[0030] Embodiment 1

[0031] Appendix Figure 1 A timing diagram of a cluster expansion method based on mimicry defense is shown, the cluster expansion method comprising the following steps:

[0032] Step 1, the input agent module receives a first URL and copies and distributes it to each execution body module; wherein the first URL includes new node information to be joined in the cluster;

[0033] The execution body module receives the first URL from the input agent module, generates the corresponding execution result, and sends the execution result to the arbitration module. The execution result corresponding to the first URL mainly refers to the new node information other than the data flow transfer information.

[0034] The arbitration module receives the execution result sent by each execution body module, and arbitrates the received execution result.

[0035] When the arbitration passes, the new node is determined to be a trusted node, and the arbitration result is sent to the master node of the original cluster. When the arbitration fails, the new node is determined to be an abnormal node, and the execution body module returns error information to the input agent module to terminate the cluster expansion operation.

[0036] The master node of the original cluster receives the arbitration result, and performs the cluster expansion operation according to the first URL.

[0037] It should be noted that the safety of the first URL is determined according to the arbitration result. If the arbitration passes, the first URL is a safe URL, and the cluster expansion operation is continued. If the arbitration fails, the first URL is an unsafe URL, and the execution body module returns error information to the input agent module, and the cluster expansion operation is terminated. Thus, the information of inter-cluster communication is filtered, and the safety of the cluster during expansion is greatly guaranteed, thereby avoiding unsafe nodes from accessing the original cluster.

[0038] Specifically, the first URL is a URL containing information necessary for cluster expansion, specifically including new node information to be added to the cluster, information required for data flow transfer between the input agent module and the execution body module, and the like. The new node information includes IP and mask information.

[0039] After receiving the first URL, the execution body module parses the URL to determine which computing node the URL is sent to, which parameters need to be carried, and which parameters need to be filtered, and generates the execution result corresponding to the first URL.

[0040] It can be understood that after the arbitration module determines that the new node is an abnormal node and returns error information to the input agent module through the execution body module, the input agent module does not need to arbitrate the error information returned by the execution body module, and transmits any received error information to the client. The client displays the error information on the interface, and then terminates the cluster expansion operation.

[0041] It should be noted that the master node of the original cluster needs to log in the new node by sending a URL, and the receiving end is the new node; the communication between the cluster computing nodes and the new node no longer passes through the executor module, and no longer needs to be arbitrated, which is internal;

[0042] Specifically, the step 4 comprises the following steps:

[0043] Step 401, the master node of the original cluster generates a new URL after receiving the first URL, and sends it to the new node;

[0044] Step 402, the new node generates a response result based on the new URL after receiving the new URL, and returns the response result to the master node of the original cluster;

[0045] Step 403, the master node of the original cluster returns the response result to the input agent module through each executor module;

[0046] Step 404, the input agent module parses the response result,

[0047] If the response result is information of successful cluster expansion, the response result returned by each executor is arbitrated and returned to the client; if the response result is information of the reason for failed cluster expansion, the response result returned by any one of the executor modules is sent to the client to notify the user of the cluster expansion result.

[0048] Further, in the step 402, when the new node generates a response result based on the new URL, the following is performed:

[0049] The new node parses the URL type corresponding to the new URL, wherein the URL type comprises type I, type II and type III, the type I refers to identity verification URL, the type II refers to password-free and cluster configuration URL, and the type III refers to cluster storage expansion URL;

[0050] When the parsed URL type is type I, identity verification is performed based on the new URL, and a login result I is generated according to the identity verification result; wherein the login result I is response information of successful identity verification or response information of the reason for failed verification;

[0051] When the parsed URL type is type II, password-free configuration and process restart, cluster configuration and process restart, cluster synchronization process configuration and process restart, and database synchronization and process restart are performed, and a login result II is generated according to the password-free and cluster configuration execution result; wherein the login result II is response information of successful password-free and cluster configuration, or response information of the reason for failed password-free and cluster configuration;

[0052] When the parsed URL type is type III, OSD expansion, MON expansion, MDS expansion, cluster storage pool expansion, and cluster service balancing are performed, and a login result III is generated according to the execution result of the cluster storage expansion; wherein the login result III is response information of successful cluster storage expansion, or response information of the reason for failed cluster storage expansion.

[0053] It can be understood that when the identity verification is passed, the login result I is response information of successful identity verification (returned to the master node for verification success), and when the identity verification is not passed, the login result I is response information of the reason for failed verification (returned to the master node for the reason for failed verification, and the expansion is terminated).

[0054] When each of the steps of password-free and cluster configuration is successfully executed, the login result II is response information of successful password-free and cluster configuration (if each of the steps of password-free and cluster configuration is successfully executed, the success is returned to the master node), and when the password-free and cluster configuration is failed, the login result II is response information of the reason for failed password-free and cluster configuration (returned to the master node for the reason for failed password-free and cluster, and the cluster expansion operation is terminated).

[0055] When each of the steps of cluster storage expansion is successfully executed, the login result III is response information of successful cluster storage expansion (if each of the steps of cluster storage expansion is successfully executed, the success is returned to the master node), and when the cluster storage expansion is failed, the login result III is response information of the reason for failed cluster storage expansion (returned to the master node for the reason for failed cluster storage expansion, and the cluster expansion operation is terminated).

[0056] As shown in the accompanying drawings, Figure 3 In a specific embodiment, the new node receives and judges the URL type corresponding to the new URL, and when the URL type is:

[0057] ① Identity verification URL: extract information in the URL, such as username, password, and key information, for identity verification, if the verification is successful, the success is returned to the master node; if the verification fails, the reason for the failure is returned to the master node, and the expansion is terminated.

[0058] ② Password-free and cluster configuration URL: extract information in the URL, and perform the following operations in sequence: password-free configuration and process restart; cluster-related configuration and process restart; cluster synchronization process configuration and process restart; database synchronization and process restart, if all the above steps are successfully executed, the success is returned to the master node, otherwise, the reason for the failure is returned to the master node, and the cluster expansion operation is terminated.

[0059] ③Cluster storage expansion URL: extract information in the URL, and perform the following operations in turn: OSD, MON, MDS expansion, cluster storage pool expansion, cluster service balancing, if all the above steps are successfully executed, return success to the master node, otherwise return the failure reason to the master node, and terminate the cluster expansion operation.

[0060] Specifically, the new node performs identity verification based on the IP address, username, password and key information in the parsed URL. For example, for the IP address, the IP address in the new URL is parsed, and it is determined whether the parsed IP address is a legal IP, where the legal IP refers to an IP allowed to join the cluster. It should be noted that the identity verification method is a conventional method in the art, which will not be described here.

[0061] In addition, the embodiment mainly solves the security problem of cluster expansion. For each execution step of performing password-free configuration and process restart, cluster-related configuration and process restart, cluster synchronization process configuration and process restart, database synchronization and process restart, as well as each execution step of OSD, MON, MDS expansion, cluster storage pool expansion and cluster service balancing, no further description is given.

[0062] Embodiment 2

[0063] Based on embodiment 1, the embodiment gives a specific implementation of a cluster expansion device based on quasi-state defense, as shown in FIG. 2. Figure 2

[0064] The cluster expansion device based on quasi-state defense includes an input agent module, an execution body module, a decision module and a master node of an original cluster, wherein,

[0065] The input agent module is configured to receive a first URL and distribute the first URL to each execution body module; wherein the first URL includes new node information to be added to the cluster, specifically, IP and mask information of the new node.

[0066] The execution body module is configured to receive the first URL from the input agent module, generate a corresponding execution result and send the execution result to the decision module.

[0067] The decision module is configured to receive the execution result sent by each execution body module, make a decision on the received execution result, determine that the new node is a trusted node when the decision is passed, and send the decision result to the master node of the original cluster; when the decision is not passed, determine that the new node is an abnormal node, and return an error message to the input agent module through the execution body module to terminate the cluster expansion operation.

[0068] ​The master node of the original cluster is configured to perform a cluster expansion operation according to the first URL after receiving the first URL.

[0069] The number of the execution body modules is N, which is adjusted according to actual conditions; the execution body scheduler is configured to control the on-line and off-line operations of the execution body modules, such as four execution bodies, but only three of them are running at a certain time, and one of them is a backup. The execution body scheduler will regularly put the backup execution body on-line and take one of the original three running execution bodies off-line for cleaning.

[0070] The heterogeneous system is running in each execution body module, and the heterogeneity can be operating system heterogeneity and / or CPU architecture heterogeneity according to system needs.

[0071] Further, the master node of the original cluster performs the following operations when performing the cluster expansion operation according to the IP and mask information in the first URL:

[0072] Step 401: The master node of the original cluster generates a new URL after receiving the first URL and sends it to the new node.

[0073] Step 402: The new node generates a response result based on the new URL after receiving the new URL and returns the response result to the master node of the original cluster.

[0074] Step 403: The master node of the original cluster returns the response result to the input agent module through each execution body module.

[0075] Step 404: The input agent module analyzes the response result,

[0076] If the response result is information of successful cluster expansion, the response result returned by each execution body is returned to the client after arbitration; if the response result is information of the reason for failed cluster expansion, the response result returned by any execution body module is sent to the client to inform the user of the cluster expansion result.

[0077] Further, the new node performs the following operations when generating a response result based on the new URL:

[0078] The new node analyzes the URL type corresponding to the new URL,

[0079] When the analyzed URL type is type I, identity verification is performed based on the new URL, and login result I is generated according to the identity verification result; wherein the login result I is response information of successful identity verification or response information of the reason for failed verification.

[0080] When the parsed URL type is type II, password-free configuration and process restart, cluster configuration and process restart, cluster synchronization process configuration and process restart, database synchronization and process restart are performed, and login result II is generated according to the password-free and cluster configuration execution results; the login result II is response information of successful password-free and cluster configuration, or response information of password-free and cluster configuration failure reasons;

[0081] When the parsed URL type is type III, OSD expansion, MON expansion, MDS expansion, cluster storage pool expansion and cluster service balance are performed, and login result III is generated according to the cluster storage expansion execution results; the login result III is response information of successful cluster storage expansion, or response information of cluster storage expansion failure reasons.

[0082] It should be noted that the user will receive a message of successful cluster expansion or failed cluster expansion through the client, and the internal message does not need to be seen by the user, so that the cluster expansion is quickly and safely realized while the user is not aware.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit them; although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the specific embodiments of the present application can be modified or some technical features can be replaced by equivalent ones; without departing from the spirit of the technical solutions of the present application, they should be covered in the technical solution range of the present application claimed.

Claims

1. A method for cluster expansion based on mimicry defense, characterized in that, The method comprises the following steps: Step 1, the input agent module receives a first URL and distributes the first URL to each execution body module; wherein, the first URL comprises new node information to be added to a cluster; Step 2, the execution body module receives the first URL from the input agent module, generates a corresponding execution result, and sends the execution result to a decision module; Step 3, the decision module receives the execution result sent by each execution body module, and makes a decision on the received execution result; When the decision is passed, the new node is determined to be a trusted node, and the execution result after the decision is sent to a master node of an original cluster; when the decision is not passed, the new node is determined to be an abnormal node, and an error message is returned to the input agent module through the execution body module to terminate the cluster expansion operation; Step 4, after receiving the execution result after the decision, the master node of the original cluster performs the following cluster expansion operation according to the first URL: Step 401, the master node of the original cluster generates a new URL after receiving the first URL, and sends the new URL to the new node; Step 402, the new node generates a response result based on the new URL after receiving the new URL, and returns the response result to the master node of the original cluster; wherein, when the new node generates the response result based on the new URL, the following is performed: The new node parses the URL type corresponding to the new URL, When the parsed URL type is type I, identity verification is performed based on the new URL, and a login result I is generated according to the identity verification result; wherein, the login result I is response information of successful identity verification or response information of reasons for verification failure; When the parsed URL type is type II, password-free configuration and process restart, cluster configuration and process restart, cluster synchronization process configuration and process restart, and database synchronization and process restart are performed, and a login result II is generated according to the password-free and cluster configuration execution result; wherein, the login result II is response information of successful password-free and cluster configuration, or response information of reasons for password-free and cluster configuration failure; When the parsed URL type is type III, OSD expansion, MON expansion, MDS expansion, cluster storage pool expansion, and cluster service balancing are performed, and a login result III is generated according to the cluster storage expansion execution result; wherein, the login result III is response information of successful cluster storage expansion, or response information of reasons for cluster storage expansion failure; Step 403, the master node of the original cluster returns the response result to the input agent module through each execution body module; Step 404, the input agent module analyzes the response result, If the response result is information of successful cluster expansion, the response result returned by each execution body is returned to a client after decision; if the response result is information of reasons for cluster expansion failure, the response result returned by any one execution body module is sent to the client to inform a user of the cluster expansion result.

2. A swarm expansion device based on mimicry defense, characterized in that: The method comprises an input agent module, an execution body module, a decision module, and a master node of an original cluster, wherein, The input agent module is configured to receive a first URL and distribute the first URL to each execution body module; the first URL comprises new node information to be added to a cluster; The execution body module is configured to receive the first URL from the input agent module, generate a corresponding execution result, and send the execution result to the arbitration module; The arbitration module is configured to receive the execution result sent by each execution body module, arbitrate the received execution result, determine that the new node is a trusted node when the arbitration is passed, send the arbitrated execution result to a master node of an original cluster, and determine that the new node is an abnormal node when the arbitration is not passed, and return error information to the input agent module through the execution body module to terminate a cluster expansion operation; The master node of the original cluster is configured to perform the following steps when performing a cluster expansion operation according to the first URL after receiving the first URL: Step 401: The master node of the original cluster generates a new URL after receiving the first URL, and sends the new URL to a new node; Step 402: The new node generates a response result based on the new URL after receiving the new URL, and returns the response result to the master node of the original cluster; when the new node generates the response result based on the new URL, the new node performs the following steps: The new node parses a URL type corresponding to the new URL, When the parsed URL type is type I, identity verification is performed based on the new URL, and a login result I is generated according to the identity verification result; the login result I is response information of successful identity verification or response information of a reason for failed identity verification; When the parsed URL type is type II, password-free configuration and process restart, cluster configuration and process restart, cluster synchronization process configuration and process restart, and database synchronization and process restart are performed, and a login result II is generated according to a password-free and cluster configuration execution result; the login result II is response information of successful password-free and cluster configuration, or response information of a reason for failed password-free and cluster configuration; When the parsed URL type is type III, OSD expansion, MON expansion, MDS expansion, cluster storage pool expansion, and cluster service balancing are performed, and a login result III is generated according to a cluster storage expansion execution result; the login result III is response information of successful cluster storage expansion, or response information of a reason for failed cluster storage expansion; Step 403: The master node of the original cluster returns the response result to the input agent module through each execution body module; Step 404: The input agent module parses the response result, If the response result is information of successful cluster expansion, the response result returned by each execution body is returned to a client after arbitration; if the response result is information of a reason for failed cluster expansion, the response result returned by any one execution body module is sent to the client to notify a user of a cluster expansion result.

Images