Data transmission method, apparatus, device, medium, and product

Abstract

The application discloses a data transmission method, device, equipment, medium and product, and relates to the technical field of big data processing. The data transmission method comprises the following steps: obtaining an authentication configuration file of two computer clusters based on a Kerberos protocol; determining a data transmission mode according to the authentication configuration file; and transmitting data between the two computer clusters according to the data transmission mode. According to the embodiment of the application, the complexity of the data transmission system can be reduced, and the maintainability and availability of the data transmission system can be improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of big data processing, and particularly relates to a data transmission method and device, equipment, medium and product. BACKGROUND

[0002] The unified data collection of various cross-center source data of a big data platform and the exchange and sharing of various types of data between cross-centers and cross-heterogeneous clusters are very important in business and are an important daily work to ensure the daily operation of business.

[0003] In the field of big data authentication, Kerberos is a computer network authorization / authentication protocol that allows an entity to communicate in a non-secure network environment and prove its identity to another entity in a secure manner.

[0004] In related technologies, in the data exchange scene across Kerberos authentication, the data transmission is usually performed in a manner of transfer through middleware or a file storage system.

[0005] However, the data transmission in the manner of transfer through middleware or a file storage system increases the complexity of the data transmission system, and the maintainability and availability of the data transmission system are poor. SUMMARY

[0006] The embodiments of the application provide a data transmission method, device, equipment, medium and product, which can solve the problem of high complexity, poor maintainability and availability of the data transmission system.

[0007] In a first aspect, the embodiments of the application provide a data transmission method, comprising:

[0008] obtaining authentication configuration files of two computer clusters based on a Kerberos protocol;

[0009] determining a data transmission mode according to the authentication configuration files;

[0010] transmitting data between the two computer clusters according to the data transmission mode.

[0011] In a second aspect, the embodiments of the application provide a data transmission device, comprising:

[0012] an obtaining module configured to obtain authentication configuration files of two computer clusters based on a Kerberos protocol;

[0013] a determining module configured to determine a data transmission mode according to the authentication configuration files;

[0014] a transmitting module configured to transmit data between the two computer clusters according to the data transmission mode.

[0015] In a third aspect, an electronic device is provided, and the electronic device includes a processor and a memory storing computer program instructions; and the processor implements the data transmission method of the first aspect when executing the computer program instructions.

[0016] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores computer program instructions, and the computer program instructions are executed by a processor to implement the data transmission method of the first aspect.

[0017] In a fifth aspect, a computer program product is provided, and instructions in the computer program product are executed by a processor of an electronic device to cause the electronic device to perform the data transmission method of the first aspect.

[0018] In the embodiments of the present application, the authentication configuration files of two computer clusters based on the Kerberos protocol are obtained; the data transmission mode is determined according to the authentication configuration files; and the data is transmitted between the two computer clusters according to the data transmission mode. In this way, the data can be transmitted between the two computer clusters in the determined data transmission mode, without the need for middleware and file storage systems, thereby reducing the complexity of the data transmission system and improving the maintainability and availability of the data transmission system. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments of the present application will be briefly introduced. Those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0020] Figure 1 is a flowchart of the data transmission method provided by the embodiments of the present application;

[0021] Figure 2 is a schematic diagram of the comparison logic provided by the embodiments of the present application;

[0022] Figure 3 is a structural schematic diagram of the data transmission device provided by the embodiments of the present application;

[0023] Figure 4 is a structural schematic diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0024] The features and exemplary embodiments of the various aspects of the present application will be described in detail below with reference to the drawings. The following detailed description is merely intended to explain the present application, and is not intended to limit the present application. The present application can be implemented without some of the specific details, which are well known to those skilled in the art. The following description of the embodiments is merely provided to give a better understanding of the present application by showing examples of the present application.

[0025] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one entity or action from another, without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises... " does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0026] The data transmission method, device, equipment, medium and product provided by the embodiments of the present application will be described in detail below with reference to the drawings, through specific embodiments and their application scenarios.

[0027] Figure 1 is a flowchart of the data transmission method provided by the embodiments of the present application. As shown in Figure 1 , the data transmission method can include:

[0028] Step 101: Obtain an authentication configuration file of two computer clusters based on the Kerberos protocol;

[0029] Step 102: Determine the data transmission mode according to the authentication configuration file;

[0030] Step 103: Transmit data between the two computer clusters according to the data transmission mode.

[0031] The specific implementation of each step will be described in detail below.

[0032] In the embodiment of the present application, the authentication configuration file based on the Kerberos protocol is obtained, the data transmission mode is determined according to the authentication configuration file, and the data is transmitted between the two computer clusters according to the data transmission mode. In this way, the data can be transmitted between the two computer clusters in the determined data transmission mode, without the need of middleware and file storage system, thereby reducing the complexity of the data transmission system and improving the maintainability and availability of the data transmission system.

[0033] In some possible implementations of the embodiment of the present application, the authentication configuration file in the embodiment of the present application can be a krb5.conf file.

[0034] In some possible implementations of the embodiment of the present application, the krb5.conf file of the source cluster and the krb5.conf file of the target cluster can be obtained from the current data transmission system, and if the authentication also exists in the running cluster, the krb5.conf file of the running cluster also needs to be obtained.

[0035] In some possible implementations of the embodiment of the present application, the authentication configuration file in the embodiment of the present application can include domain name information, domain network address information and authentication information; and step 102 can include: determining whether the domain name information of the two computer clusters is consistent; in the case that the domain name information of the two computer clusters is consistent, determining whether the domain network address information of the two computer clusters is consistent; in the case that the domain network address information of the two computer clusters is consistent, determining that the data transmission mode is a pipe transmission mode across a Key Distribution Center (KDC); in the case that the domain network address information of the two computer clusters is inconsistent, determining whether the authentication information of the two computer clusters is consistent; in the case that the authentication information of the two computer clusters is consistent, determining that the data transmission mode is a transmission mode without crossing the KDC; and in the case that the authentication information of the two computer clusters is inconsistent, determining that the data transmission mode is a transmission mode of merging the authentication configuration file across the KDC.

[0036] In some possible implementations of the embodiment of the present application, the data transmission method provided by the embodiment of the present application can further include: in the case that the domain name information of the two computer clusters is inconsistent, determining whether the authentication information of the two computer clusters is consistent; in the case that the authentication information of the two computer clusters is consistent, determining that the data transmission mode is a transmission mode without crossing the KDC; and in the case that the authentication information of the two computer clusters is inconsistent, determining that the data transmission mode is a transmission mode of merging the authentication configuration file across the KDC.

[0037] The pipe in the embodiment of the present application includes but is not limited to an unnamed pipe (i.e. an anonymous pipe) and a named pipe.

[0038] It should be noted that the authentication configuration file merging strategy transmission manner in the embodiments of the present application refers to merging different authentication configuration files into one authentication configuration file, and using the merged authentication configuration file for authentication and transmission.

[0039] Specifically, the krb5.conf files of the source cluster and the target cluster can be analyzed to obtain the main information of the source cluster and the target cluster, including realm name information, realm network address information, and authentication information.

[0040] After obtaining the realm name information, the realm network address information, and the authentication information of the source cluster and the target cluster, first, the realm name information of the source cluster and the target cluster is compared to determine whether they are consistent. The comparison of whether the realm name information of the source cluster and the target cluster is consistent is mainly based on the realms field in the krb5.conf file. For example, the realms field is as follows:

[0041]

[0042] Among them, KDC1.LOCAL is the realm name authenticated by this KDC.

[0043] When the realm name information of the source cluster and the target cluster is consistent, the realm network address information of the source cluster and the target cluster is compared to determine whether they are consistent. When the realm network address information of the source cluster and the target cluster is inconsistent, the source cluster and the target cluster use different KDCs. At this time, the pipeline transmission manner is used for cross-KDC data transmission.

[0044] When the realm network address information of the source cluster and the target cluster is consistent, the authentication information of the source cluster and the target cluster is compared to determine whether they are consistent. When the authentication information of the source cluster and the target cluster is consistent, the source cluster and the target cluster use the same KDC. At this time, data transmission across KDCs is not needed. When the authentication information of the source cluster and the target cluster is inconsistent, the source cluster and the target cluster use different KDCs. At this time, the authentication configuration file merging strategy transmission manner is used for cross-KDC data transmission.

[0045] When the realm name information of the source cluster and the target cluster is inconsistent, the authentication information of the source cluster and the target cluster is compared to determine whether they are consistent. When the authentication information of the source cluster and the target cluster is consistent, the source cluster and the target cluster use the same KDC. At this time, data transmission across KDCs is not needed. When the authentication information of the source cluster and the target cluster is inconsistent, the source cluster and the target cluster use different KDCs. At this time, the authentication configuration file merging strategy transmission manner is used for cross-KDC data transmission.

[0046] The embodiments of the present application do not limit the way of comparing whether the authentication information of the source cluster and the target cluster is consistent, and any available way can be applied in the embodiments of the present application. For example, it can be judged whether it is the same user, whether the authentication file of the user is sent to the same KDC, and the file for judging is the keytab file, the principal file and the like used by the user.

[0047] The authentication information of the source cluster and the target cluster mainly includes the realms field and the domain_realm field in the krb5.conf file, and an example of the domain_realm field is as follows:

[0048] [domain_realm]

[0049] .test.com=KDC1.LOCAL

[0050] test.com=KDC1.LOCAL

[0051] 191.0.0.1=KDC1.LOCAL

[0052] The above comparison logic process is as shown in Figure 2 . Figure 2 FIG. 1 is a schematic diagram of the comparison logic provided by the embodiments of the present application.

[0053] In some possible implementations of the embodiments of the present application, when the determined data transmission mode is the cross-KDC authentication configuration file merging strategy transmission mode, the data transmission method provided by the embodiments of the present application can further include: judging whether the authentication configuration files of the two computer clusters can be merged, and in the case that the authentication configuration files of the two computer clusters cannot be merged, updating the data transmission mode to the cross-KDC pipe transmission mode.

[0054] In some possible implementations of the embodiments of the present application, the data transmission method provided by the embodiments of the present application can further include: in the case that the authentication configuration files of the two computer clusters can be merged, merging the authentication configuration files of the two computer clusters into a policy merging configuration file having the function of simultaneously authenticating the two KDCs corresponding to the two computer clusters; and authenticating the two KDCs by using the policy merging configuration file.

[0055] The embodiments of the present application do not limit the way of judging whether the authentication configuration files of the two computer clusters can be merged, and any available way can be applied in the embodiments of the present application.

[0056] In some possible implementations of the embodiments of the present application, the merged policy merging configuration file can adopt the file structure of the authentication configuration file before merging. The file structure of the authentication configuration file is as shown in Table 1.

[0057] Table 1

[0058] [libdefaults] Lib configuration information [realms] Configuration information and related settings for authentication realms [domain_realm] Mapping of server host to authentication center [capaths] Non-hierarchical cross-realm authentication paths [appdefaults] applications configuration [plugins] Plugin-related information

[0059] When it is determined that the authentication configuration files of the two computer clusters can be merged, the authentication configuration files of the two computer clusters are loaded, the authentication configuration files of the two computer clusters are parsed according to a predetermined format, and internal objects are generated. Then, a new krb5.conf file corresponding to the policy merge configuration file is generated according to a preset file merge logic.

[0060] After the policy merge configuration file is generated, a plugin list and loading information of security-related classes can also be generated according to JS object notation (JSON) format data specified when the task is created, and then the information is stored in a task-level configuration file.

[0061] The task-level configuration file can include: a new authentication file (i.e., a policy merge configuration file) address and related information such as a username, task plugin information, a security-related loading class name selected according to the plugin, and additional necessary parameters of the task. The task plugin is a connector for task exchange, which is used to connect with other ends.

[0062] An important part of the task-level configuration file is related data about authentication. When the program generates the data, it parses the fields of the authentication file according to the krb5.conf file metadata structure mentioned above, and generates a new authentication file according to them. The fields involved include: realms (Chinese name domain), domain_realm, libdefaults, and other fields.

[0063] Each subset in the realms part of the file is the name of a Kerberos domain. The value marked by the subset defines the attributes of the specific domain. For each domain, several attribute values can be specified in the domain section.

[0064] The attribute "admin_server" of the realm identifies the host running the administration server, which is the master Kerberos server when the deployment is installed. A value is specified for it so that the JVM process can communicate with the domain's kadmind server. In the newly generated file, this part of the content is copied over.

[0065] The attribute "kdc" of the realm indicates the name or address of the host running the KDC of the realm. An optional port number can be included, separated from the host name by a colon. When an IPv6 address is included, it is enclosed in square brackets to distinguish the colon from the port separator. In order to enable the process to communicate with the KDC of each realm, this value is added when the file is generated, although it is possible to configure the resolution of the KDC in DNS, the process running the data transfer engine is unable to modify the DNS server, so all KDCs are specified here.

[0066] domain_realm provides the conversion from domain or host name to Kerberos realm name. The key here can be a host name or domain name, where the domain name can be indicated by a prefix of a period (.), and the value is the Kerberos realm name of the specific host or domain. The host name relationship implicitly provides the corresponding domain name relationship, unless an explicit domain name relationship is provided. In this part, the data transfer engine will resolve the host name, IP, domain name according to the target library to be connected, analyze the list of all hosts (IP, domain name) corresponding to the Kerberos realm, and put the list into this part.

[0067] The default_realm field running the cluster needs to be extracted from libdefaults, copied to the new file, and the value of the target cluster is discarded. The value of the target cluster can be safely discarded mainly because the corresponding mapping relationship is configured in domain_realm. This value is mainly used for the task itself to authenticate the running cluster.

[0068] For other parts of the two krb5.conf files, the contents of the file running the cluster need to be merged as the basis, that is, when a duplicate key is encountered, the value of the running cluster is the final result, and is written to the new file.

[0069] After the above steps are completed, the data transfer engine will obtain a policy merge configuration file that can authenticate two Kerberos authentication centers (KDCs) at the same time. The address of the policy merge configuration file will also be placed in the task-level configuration file.

[0070] In some possible implementations of the embodiments of the present application, before authenticating the two key distribution centers using the policy merge configuration file, the data transmission method provided by the embodiments of the present application can further include: updating the authentication configuration for authenticating the two KDCs using the policy merge configuration file.

[0071] Specifically, the policy merge configuration file can be used to overwrite the original authentication configuration of JVM, and the modules ZooKeeperModule, HadoopModule and JaasModule are configured.

[0072] Among them, the ZooKeeper related to the bottom layer is responsible for ZooKeeperModule; the Hadoop related, such as the HDFS involved, is responsible for HadoopModule.

[0073] When the program needs to connect components such as HDFS, HBase, Hive, etc., it will involve the use of the UserGroupInformation class in hadoop common to process user / group information, mainly login, authentication, identity information acquisition, etc.

[0074] When the program needs to link Kafka, it needs to select JaasModule to perform authentication coverage, so that the part connecting Kafka can be forwarded to the corresponding authentication center.

[0075] Specifically, the newly generated authentication configuration file can be used to overwrite the original authentication configuration file by setting the environment variable KR5_CONFIG, for example, by using the function System.setProperty(JAVA_SECURITY_KRB5_CONF, krb5FilePath) to overwrite. Then, execute Config.refresh() to refresh the authentication configuration.

[0076] When performing ZooKeeperModule authentication, override ZooKeeperModuleFactory; when performing HadoopModule authentication, override HadoopModuleFactory; when performing JaasModule authentication, override JaasModuleFactory.

[0077] The following will take authentication JaasModule as an example for explanation.

[0078] When the data transmission engine determines that this authentication needs to use Jaas, it will generate the Jaas file content required by the target KDC authentication inside the plug-in connected with the target library according to the characteristics of the jaas authentication method. The content of this file is as follows:

[0079]

[0080] In the above example, it is indicated that this authentication prohibits the use of cache configuration, and each authentication needs to use keytab, and the local storage address of the keytab file is specified as " / path / krb.keytab", and the principal used is "test@HADOOP.COM".

[0081] When authentication is performed with this configuration, the above values ​​will be stored in javax.security.auth.login.Configuration. The data transmission engine will then look for the specified authentication file, which stores the authentication KDC. The current plugin of the data transmission engine will look for the location of the KDC in the merged krb5.conf and perform subsequent authentication actions. After authentication is completed, the data transmission engine will perform subsequent data association operations and exchanges.

[0082] This application also constructs a pipeline management scheme. This pipeline management scheme features data source and data type independence, batch processing integration, and aspect-oriented lifecycle control.

[0083] In this context, data source and data type independence means that pipeline data is highly separated from the data source. Any data source can use this pipeline for data transmission, and it supports any data type.

[0084] Batch and stream integration means that pipes can control the opening and closing of data streams and support unlimited data transmission, enabling high-efficiency, high-throughput data transfer. When using batch data transfer, the pipe file can close naturally after the data stream ends, without occupying extra space. When using streaming data transfer, the pipe's `read()` blocking feature and the Akka-based RPC command interaction mechanism of the data transfer engine ensure the long-term viability of the pipe and real-time write and read operations. Regardless of whether processing batch or streaming data, the pipe file will not grow indefinitely during data transfer; it has a fixed-length buffer, which can be up to 4KB in size.

[0085] Aspect-oriented lifecycle control refers to the data transmission engine pre-setting corresponding functions for the entire pipeline lifecycle, enabling flow control during pipeline preparation, startup, operation, pre-closure, and post-closure stages. Plugins can add custom actions to any lifecycle hook function of the pipeline, including initialization, pre-setting data, cleanup authentication, and connection testing.

[0086] For data transmission, create implementation classes for the Source and Sink interfaces.

[0087] The Source implementation class contains two implementations: Built-in plug-ins and ReadProcessInstance. The Built-in part implements the built-in data flow logic, which transmits data from the outside to the data transmission engine. ReadProcessInstance is a child process processing class that starts a child process to interact with the source cluster. The data transmission engine selects different Handlers to interact with based on the type of source cluster to be connected to.

[0088] Each sub-Handler of ReadProcessInstance inherits the InputHandler interface, which defines the interface of the Input part in the data transmission process, and abstractly defines the reading of data in the sub-process.

[0089] The implementation class of Sink contains two implementations, namely, Bilt-in plug-ins and WriteProcessInstance. The Build-in part implements the built-in data flow logic of Sink data sending, and sends data from the data transmission engine to the external storage. WriteProcessInstance is a sub-process processing class, which starts a data writing sub-process to interact with the target cluster. The data transmission engine selects different Handlers to interact according to the type of the target to be connected.

[0090] Each sub-Handler of WriteProcessInstance inherits the Output interface, which defines the interface of the Output part in the data transmission process, and abstractly defines the writing transmission of data in the sub-process.

[0091] When the program starts, the Kerberos authentication relationship of the source cluster, the target cluster, and the running cluster is compared to determine the running logic that needs to be started.

[0092] When it is determined that the source storage needs a named pipe, the Source initializes the ReadProcessInstance sub-process, the sub-process receives the signal of the Source, creates a named pipe in the working dir directory using mkfifo, and creates a data connection inside the process according to the type of the source cluster. The Source confirms the start of the sub-process, creates a reading unit of the named pipe, reads the data sent by the sub-process to the named pipe, and loads the data into the framework.

[0093] When it is determined that the target storage needs a named pipe, the Sink initializes the WriteProcessInstance sub-process, the sub-process receives the signal of the Sink, creates a named pipe in the working dir directory using mkfifo, and creates a data connection inside the process according to the type of the target cluster. The Sink is responsible for receiving data from the framework and sending the data to the named pipe created by the sub-process. The WriteProcessInstance sub-process reads the data in the pipe and sends it to the target cluster.

[0094] The embodiment of the application also provides a data transmission device, as shown in Figure 3 .Figure 3 is a structural schematic diagram of a data transmission device provided by an embodiment of the present application. The data transmission device 300 can include:

[0095] An acquisition module 301 is configured to acquire an authentication configuration file of two computer clusters based on a Kerberos protocol.

[0096] A determination module 302 is configured to determine a data transmission mode according to the authentication configuration file.

[0097] A transmission module 303 is configured to transmit data between the two computer clusters according to the data transmission mode.

[0098] In the embodiment of the present application, the authentication configuration file of the two computer clusters based on the Kerberos protocol is acquired, the data transmission mode is determined according to the authentication configuration file, and the data is transmitted between the two computer clusters according to the data transmission mode. In this way, the data can be transmitted between the two computer clusters in the determined data transmission mode, without the need for middleware and a file storage system, thereby reducing the complexity of the data transmission system and improving the maintainability and availability of the data transmission system.

[0099] In some possible implementations of the embodiment of the present application, the authentication configuration file includes domain name information, domain network address information and authentication information, and the determination module 302 can be specifically configured to:

[0100] determine whether the domain name information of the two computer clusters is consistent;

[0101] in a case where the domain name information of the two computer clusters is consistent, determine whether the domain network address information of the two computer clusters is consistent;

[0102] in a case where the domain network address information of the two computer clusters is consistent, determine that the data transmission mode is a pipe transmission mode across KDCs;

[0103] in a case where the domain network address information of the two computer clusters is inconsistent, determine whether the authentication information of the two computer clusters is consistent;

[0104] in a case where the authentication information of the two computer clusters is consistent, determine that the data transmission mode is a transmission mode without crossing KDCs;

[0105] in a case where the authentication information of the two computer clusters is inconsistent, determine that the data transmission mode is an authentication configuration file merging strategy transmission mode across KDCs.

[0106] In some possible implementations of the embodiment of the present application, the determination module 302 can also be configured to:

[0107] In a case where the domain name information of the two computer clusters is inconsistent, it is determined whether the authentication information of the two computer clusters is consistent;

[0108] In a case where the authentication information of the two computer clusters is consistent, it is determined that the data transmission manner is a non-cross-KDC transmission manner.

[0109] In a case where the authentication information of the two computer clusters is inconsistent, it is determined that the data transmission manner is a cross-KDC authentication profile merging policy transmission manner.

[0110] In some possible implementations of the embodiments of the present application, the data transmission apparatus 300 provided by the embodiments of the present application can further include:

[0111] The determining module is configured to, in a case where the data transmission manner is determined to be the cross-KDC authentication profile merging policy transmission manner, determine whether the authentication profiles of the two computer clusters can be merged.

[0112] The first updating module is configured to, in a case where the authentication profiles of the two computer clusters cannot be merged, update the data transmission manner to a cross-KDC pipe transmission manner.

[0113] In some possible implementations of the embodiments of the present application, the data transmission apparatus 300 provided by the embodiments of the present application can further include:

[0114] The merging module is configured to, in a case where the authentication profiles of the two computer clusters can be merged, merge the authentication profiles of the two computer clusters into a policy merging profile having a function of simultaneously authenticating two key distribution center functions corresponding to the two computer clusters.

[0115] The authentication module is configured to authenticate the two KDCs by using the policy merging profile.

[0116] In some possible implementations of the embodiments of the present application, the data transmission apparatus 300 provided by the embodiments of the present application can further include:

[0117] The updating module is configured to update the authentication configuration of the authentication of the two KDCs by using the policy merging profile.

[0118] Figure 4 FIG. 1 is a structural schematic diagram of an electronic device provided by an embodiment of the present application.

[0119] The electronic device can include a processor 401 and a memory 402 having stored computer program instructions.

[0120] Specifically, the processor 401 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or can be configured to implement one or more integrated circuits that implement the embodiments of the present application.

[0121] The memory 402 can include a mass storage for data or instructions. By way of example and not limitation, the memory 402 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive or a combination of two or more of these. The memory 402 can include removable or non-removable (or fixed) media, where appropriate. The memory 402 can be internal or external to the electronic device, where appropriate. In some particular embodiments, the memory 402 is non-volatile solid-state memory.

[0122] In some particular embodiments, the memory can include read-only memory (ROM), random access memory (RAM), magnetic disk storage mediums, optical storage mediums, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software that, when executed (e.g., by one or more processors), is operable to perform operations described with reference to the data transmission method according to the present application.

[0123] The processor 401 implements the data transmission method provided by the embodiments of the present application by reading and executing computer program instructions stored in the memory 402.

[0124] In one example, the electronic device can further include a communication interface 403 and a bus 410. Among them, as shown, the processor 401, the memory 402, the communication interface 403 are connected through the bus 410 and complete the communication between each other. Figure 4

[0125] The communication interface 403 is mainly used to realize the communication between each module, device, unit and / or equipment in the embodiments of the present application.

[0126] ​Bus 410 includes a hardware, software, or both that couples components of electronic device to each other. As an example and not by way of limitation, bus can include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand (IB) interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or some other suitable bus or interconnect, or a combination of two or more of these. Where appropriate, bus 410 can include one or more buses. Although this application describes and shows a particular bus, this application contemplates any suitable bus or interconnect.

[0127] The electronic device can execute the data transmission method provided by the embodiments of the present application, thereby achieving the corresponding technical effects of the data transmission method provided by the embodiments of the present application.

[0128] In addition, in combination with the data transmission method in the above embodiments, the embodiments of the present application also provide a computer readable storage medium for implementation. The computer readable storage medium stores computer program instructions; the computer program instructions are executed by the processor to implement the data transmission method provided by the embodiments of the present application. Examples of computer readable storage medium include non-transitory computer readable medium, such as ROM, RAM, magnetic disk or optical disk, etc.

[0129] The embodiments of the present application provide a computer program product, the instructions in the computer program product are executed by the processor of the electronic device, so that the electronic device executes the data transmission method provided by the embodiments of the present application, and can achieve the same technical effects. To avoid repetition, it will not be repeated here.

[0130] It is to be understood that the application is not limited to the particular configurations and processes described hereinabove and shown in the figures. For the sake of brevity, detailed descriptions of known methods and processes are omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method processes of the present application are not limited to the specific steps described and illustrated, and various changes, modifications and additions can be made thereto by one skilled in the art without departing from the spirit of the present application, and the order of the steps can be changed.

[0131] The functional blocks shown in the above described block diagrams of the structure can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASIC), appropriate firmware, plug-ins, functional cards, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. The "machine readable medium" can include any medium that can store or transfer information. Examples of the machine readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable read only memory (EROM), floppy disks, compact discs read only memory (CD-ROM), optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segments can be downloaded via computer networks such as the Internet, intranet, etc.

[0132] It is also to be understood that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in an order different from the embodiments, or several steps can be performed simultaneously.

[0133] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0134] The above only is a specific implementation of the present application, and those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, module and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described herein. It should be understood that the protection scope of the present application is not limited to this, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements shall be covered within the protection scope of the present application.

Claims

1. A data transmission method, characterized by, The method comprises: obtaining an authentication configuration file of two computer clusters based on a Kerberos protocol; determining a data transmission mode according to the authentication configuration file; transmitting data between the two computer clusters according to the data transmission mode; the authentication configuration file comprises domain name information, domain network address information and authentication information; the determining of the data transmission mode according to the authentication configuration file comprises: judging whether the domain name information of the two computer clusters is consistent; in the case that the domain name information of the two computer clusters is consistent, judging whether the domain network address information of the two computer clusters is consistent; in the case that the domain network address information of the two computer clusters is consistent, determining that the data transmission mode is a pipe transmission mode across key distribution centers; in the case that the domain network address information of the two computer clusters is inconsistent, judging whether the authentication information of the two computer clusters is consistent; in the case that the authentication information of the two computer clusters is consistent, determining that the data transmission mode is a transmission mode without crossing key distribution centers; in the case that the authentication information of the two computer clusters is inconsistent, determining that the data transmission mode is an authentication configuration file merging strategy transmission mode across key distribution centers.

2. The method of claim 1, wherein, The method further comprises: in the case that the domain name information of the two computer clusters is inconsistent, judging whether the authentication information of the two computer clusters is consistent; in the case that the authentication information of the two computer clusters is consistent, determining that the data transmission mode is the transmission mode without crossing key distribution centers; in the case that the authentication information of the two computer clusters is inconsistent, determining that the data transmission mode is the authentication configuration file merging strategy transmission mode across key distribution centers.

3. The method according to claim 1 or 2, characterized in that, in the case that the data transmission mode is determined to be the authentication configuration file merging strategy transmission mode across key distribution centers, before the transmitting of data between the two computer clusters according to the data transmission mode, the method further comprises: judging whether the authentication configuration files of the two computer clusters can be merged; in the case that the authentication configuration files of the two computer clusters cannot be merged, updating the data transmission mode to the pipe transmission mode across key distribution centers.

4. The method of claim 3, wherein, The method further comprises: in the case that the authentication configuration files of the two computer clusters can be merged, merging the authentication configuration files of the two computer clusters into a strategy merging configuration file with the function of simultaneously authenticating two key distribution centers corresponding to the two computer clusters; authenticating the two key distribution centers by using the strategy merging configuration file.

5. The method of claim 4, wherein, Before the authenticating of the two key distribution centers by using the strategy merging configuration file, the method further comprises: updating the authentication configuration for authenticating the two key distribution centers by using the strategy merging configuration file.

6. A data transmission apparatus characterized by comprising: The device comprises: An acquisition module is configured to acquire an authentication configuration file of two computer clusters based on a Kerberos protocol; A determination module is configured to determine a data transmission mode according to the authentication configuration file; A transmission module is configured to transmit data between the two computer clusters according to the data transmission mode; The authentication configuration file includes domain name information, domain network address information and authentication information; The determination module is specifically configured to: determine whether the domain name information of the two computer clusters is consistent; in a case where the domain name information of the two computer clusters is consistent, determine whether the domain network address information of the two computer clusters is consistent; in a case where the domain network address information of the two computer clusters is consistent, determine that the data transmission mode is a pipe transmission mode across a key distribution center; in a case where the domain network address information of the two computer clusters is inconsistent, determine whether the authentication information of the two computer clusters is consistent; in a case where the authentication information of the two computer clusters is consistent, determine that the data transmission mode is a transmission mode without crossing the key distribution center; in a case where the authentication information of the two computer clusters is inconsistent, determine that the data transmission mode is an authentication configuration file merging strategy transmission mode across the key distribution center.

7. An electronic device, comprising: The electronic device includes a processor and a memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the data transmission method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, and the computer program instructions are executed by the processor to implement the data transmission method of any one of claims 1-5.

9. A computer program product, characterised in that, The instructions in the computer program product are executed by the processor of the electronic device, so that the electronic device executes the data transmission method of any one of claims 1-5.

Images