Database creation method, apparatus, and storage medium

Abstract

The application provides a database creation method and device and a storage medium, relates to the technical field of computers, and aims to solve the technical problem of low security of a general database. The method comprises the following steps: receiving database instance information for creating a target database sent by a terminal; the database instance information comprises whitelist rules allowing access to the target database, proxy node configuration information, an available zone, network configuration information and database shard information; when the database instance information meets preset conditions, creating a plurality of proxy nodes based on the whitelist rules, the proxy node configuration information and the network configuration information; the proxy nodes are used for filtering data access requests for accessing the target database according to the whitelist rules; and based on the network configuration information and the database shard information, a plurality of database shards are created in the available zone, so that the target database is obtained.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to a database creation method, apparatus and storage medium. Background Technology

[0002] Currently, distributed databases have gained widespread adoption due to their high efficiency, reliability, and ease of use. However, general cloud database solutions have limited functionality; for example, the OpenStack Trove component only supports either master-slave replication or cluster sharding, and does not support the creation of master-slave clusters.

[0003] Furthermore, when the OpenStack Trove component creates a cluster, it creates security groups for each node instance in the cluster, allowing network requests from all sources to access the local database service. Therefore, in addition to allowing normal user access requests and normal communication requests between nodes, this security group also allows network requests from unknown hosts and even malicious attacks. Databases in this architecture are vulnerable to malicious attacks from unknown hosts, resulting in low security. Summary of the Invention

[0004] This application provides a database creation method, apparatus, and storage medium to address the technical problem of low security in general-purpose databases.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a database creation method is provided, comprising: receiving database instance information sent by a terminal for creating a target database; the database instance information includes whitelist rules allowing access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information; when the database instance information meets preset conditions, creating multiple proxy nodes based on the whitelist rules, proxy node configuration information, and network configuration information; the proxy nodes are used to filter data access requests for accessing the target database according to the whitelist rules; and creating multiple database shards within the availability zone based on the network configuration information and database sharding information to obtain the target database.

[0007] Optionally, the proxy node configuration information includes node quantity information, node type information, node specification information, and data disk information; the method for creating multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information specifically includes: determining the network port of each proxy node based on the network configuration information, and configuring whitelist rules on the network port of each proxy node; configuring the network port of each proxy node according to the node type information, node specification information, and data disk information to obtain multiple proxy nodes corresponding to the node quantity information.

[0008] Optionally, the database instance information also includes load balancing configuration information; before creating multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information, the database creation method further includes: configuring a load balancer applied to the target database based on the load balancing configuration information; the load balancer is used to determine the proxy node responding to the data access request among the multiple proxy nodes.

[0009] Optionally, the database creation method further includes: receiving an update request message sent by a terminal, indicating that an update operation should be performed on the target database; the update request message includes the database name of the target database and the network address information of the terminal; the update operation includes deleting the target database or restarting the target database; and performing an update operation on the target database when verifying that there is a correspondence between the database name and the network address information.

[0010] Secondly, a database creation apparatus is provided, comprising: a receiving unit and a creation unit;

[0011] The receiving unit is used to receive database instance information sent by the terminal for creating the target database; the database instance information includes whitelist rules that allow access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information;

[0012] The creation unit is used to create multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information when the database instance information meets preset conditions. The proxy nodes are used to filter data access requests for accessing the target database according to the whitelist rules.

[0013] The creation unit is also used to create multiple database shards within the availability zone based on network configuration information and database sharding information, thereby obtaining the target database.

[0014] Optionally, the agent node configuration information includes node quantity information, node type information, node specification information, and data disk information; the creation unit is specifically used for:

[0015] The network ports of each proxy node are determined based on the network configuration information, and whitelist rules are configured on the network ports of each proxy node.

[0016] Configure the network ports of each agent node according to the node type information, node specification information, and data disk information to obtain multiple agent nodes corresponding to the number of nodes.

[0017] Optionally, the database instance information also includes load balancing configuration information; the creation unit is also used to configure a load balancer applied to the target database based on the load balancing configuration information; the load balancer is used to determine the proxy node that responds to the data access request among multiple proxy nodes.

[0018] Optionally, the database creation apparatus further includes: an update unit;

[0019] The receiving unit is also configured to receive an update request message sent by the terminal, which instructs the execution of an update operation on the target database; the update request message includes the database name of the target database and the network address information of the terminal; the update operation includes deleting the target database or restarting the target database;

[0020] The update unit is used to perform update operations on the target database when verifying that there is a correspondence between the database name and network address information.

[0021] Thirdly, a database creation apparatus is provided, including a memory and a processor; the memory is used to store computer-executed instructions, and the processor is connected to the memory via a bus; when the database creation apparatus is running, the processor executes the computer-executed instructions stored in the memory, so that the database creation apparatus performs the database creation method as described in the first aspect.

[0022] The database creation apparatus can be a network device or a component of a network device, such as a chip system within the network device. The chip system supports the network device in implementing the functions involved in the first aspect and any possible implementation thereof, such as receiving, determining, and routing the data and / or information involved in the aforementioned database creation method. The chip system includes a chip, but may also include other discrete devices or circuit structures.

[0023] Fourthly, a computer-readable storage medium is provided, including computer-executable instructions that, when executed on a computer, cause the computer to perform the database creation method as described in the first aspect.

[0024] It should be noted that the aforementioned computer instructions may be stored, in whole or in part, on the first computer-readable storage medium. The first computer-readable storage medium may be packaged together with the processor of the database creation apparatus, or it may be packaged separately from the processor of the database creation apparatus; this application does not impose any limitation on this.

[0025] In this application, the name of the aforementioned database creation apparatus does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear under other names. As long as the function of each device or functional module is similar to that of this application, it falls within the scope of the claims of this application and its equivalents.

[0026] These or other aspects of this application will become more readily apparent in the following description.

[0027] The technical solution provided in this application brings at least the following beneficial effects:

[0028] Based on any of the above aspects, in this application, after receiving database instance information sent by the terminal for creating the target database, multiple proxy nodes can be created based on whitelist rules, proxy node configuration information, and network configuration information when the database instance information meets preset conditions. Furthermore, multiple database shards are created within the availability zone based on network configuration information and database sharding information to obtain the target database. The database instance information includes whitelist rules allowing access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information. Since the proxy nodes are used to filter data access requests for accessing the target database according to the whitelist rules, the target database created in this application can intercept data access requests that do not conform to the whitelist rules based on the proxy nodes, preventing the target database from being maliciously attacked by unknown hosts. Therefore, this application can solve the technical problem of low security in general-purpose databases and improve database security. Attached Figure Description

[0029] Figure 1 This application provides a schematic diagram of the structure of a database creation system according to an embodiment of the present application.

[0030] Figure 2 A schematic diagram of the hardware structure of a server provided in an embodiment of this application;

[0031] Figure 3 A flowchart illustrating a database creation method provided in this application embodiment. Figure 1 ;

[0032] Figure 4 A flowchart illustrating a database creation method provided in this application embodiment. Figure 2 ;

[0033] Figure 5 A schematic diagram of a database architecture provided for an embodiment of this application;

[0034] Figure 6 A flowchart illustrating a database creation method provided in this application embodiment. Figure 3 ;

[0035] Figure 7 A schematic diagram illustrating a database creation process provided in an embodiment of this application;

[0036] Figure 8 This is a schematic diagram of the structure of a database creation apparatus provided in an embodiment of this application. Detailed Implementation

[0037] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0039] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0040] Furthermore, the terms "comprising" and "having" in the embodiments, claims, and drawings of this application are not exclusive. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but may also include steps or modules not listed.

[0041] To facilitate understanding of this application, the relevant elements involved in this application are described below.

[0042] Database technology is the study of the fundamental theories and implementation methods of database structure, storage, design, management, and application, and the use of these theories to process, analyze, and understand data within databases. Database technology specifically includes relational database technology and non-relational database technology. Examples include relational database technologies such as MySQL, PostgreSQL, and Oracle, and non-relational database technologies such as Redis (remote dictionary server) and MongoDB.

[0043] A single point of failure in a database can easily become a performance and capacity bottleneck, and introduce reliability vulnerabilities. However, multiple databases can be connected through a network and managed in a unified manner, allowing data to be distributed and stored across multiple databases in a sharded and / or multi-replica manner, while simultaneously exposing a single logical database to the outside world. Such a logical database is called a distributed database, which can provide access performance and storage capacity higher than a single-point database, and offers greater reliability through multi-replica redundancy.

[0044] Proxy services can hide some of the specific implementation details of their backend services. For distributed databases, proxies also handle the implementation of functions such as data sharding and read / write splitting. A common data sharding proxy's processing logic is as follows: when creating a sharded table, a column is specified as the sharding key. Then, for each row in the table, the value of that column is hashed. Based on the hash result, the appropriate backend database and table are selected to store the corresponding data row, thereby achieving logical horizontal partitioning of the data table, which is transparent to the user.

[0045] Load balancing technology distributes load evenly across multiple identical backend services to avoid performance bottlenecks and single points of failure. Some common load balancing methods include round-robin scheduling, fixed mapping based on source IP or source IP and port (e.g., direct segmentation or hashing), and assigning new connections to the backend service with the fewest current connections. A load balancer is software or hardware that implements these technologies. Common load balancing software includes Nginx, LVS, and switching mechanisms (e.g., keepalived).

[0046] Virtualization technology is a computer resource management technology that can divide and isolate the hardware resources of a physical computer, such as the central processing unit (CPU) and memory, to provide one or more virtual computers.

[0047] Cloud computing technology, especially Infrastructure as a Service (IaaS), can pool the hardware resources of multiple servers, such as CPU and memory. Users can then use computing resources from this pool on demand. Computing resources are delivered rapidly in the form of virtual machines or similar devices, while ensuring isolation between computing resources belonging to different users.

[0048] Currently, distributed databases have gained widespread adoption due to their high efficiency, reliability, and ease of use. However, general cloud database solutions have limited functionality; for example, the OpenStack Trove component only supports either master-slave replication or cluster sharding, and does not support the creation of master-slave clusters.

[0049] Furthermore, when the OpenStack Trove component creates a cluster, it creates security groups for each node instance in the cluster, allowing network requests from all sources to access the local database service. Therefore, in addition to allowing normal user access requests and normal communication requests between nodes, this security group also allows network requests from unknown hosts and even malicious attacks. Databases in this architecture are vulnerable to malicious attacks from unknown hosts, resulting in low security.

[0050] To address the aforementioned issues, this application provides a database creation method. Upon receiving database instance information from a terminal for creating a target database, this method can create multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information, provided the database instance information meets preset conditions. Furthermore, based on network configuration information and database sharding information, multiple database shards are created within an availability zone to obtain the target database. The database instance information includes whitelist rules allowing access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information. Since proxy nodes are used to filter data access requests for accessing the target database according to whitelist rules, the target database created in this application can intercept data access requests that do not conform to the whitelist rules based on the proxy nodes, preventing the target database from being maliciously attacked by unknown hosts. Therefore, this application can solve the technical problem of low security in general-purpose databases and improve database security.

[0051] This database creation method is applicable to database creation systems. Figure 1 This illustrates one structure of the database creation system 100. For example... Figure 1 As shown, the database creation system 100 includes a terminal 101 and a server 102. The terminal 101 and the server 102 can communicate with each other.

[0052] In practical applications, server 102 can also communicate with multiple terminals 101.

[0053] For ease of understanding, this application uses the communication connection between server 102 and terminal 101 as an example for illustration.

[0054] Figure 1 Terminal 101 can be configured with a Hypertext Transfer Protocol (HTTP) client. The HTTP client can be a service implemented based on a World Wide Web (WEB) browser.

[0055] In one possible configuration, terminal 101 can be configured with functional modules such as a display module, an input module, and a communication module. The input module can be an external computer input device such as a mouse and keyboard to support various user operations, such as database information editing and database creation. The display module can be a device such as an LCD screen to display the relevant interface of the HTTP client, such as a database information editing interface. The communication module can be a transceiver or similar device for communicating with server 102.

[0056] Optionally, Figure 1 Terminal 101 can be a device providing voice and / or data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The wireless terminal can communicate with one or more core networks via a radio access network (RAN). The wireless terminal can be a mobile terminal, such as a computer with a mobile terminal, or a portable, pocket-sized, handheld, or computer-embedded mobile device that exchanges voice and / or data with the radio access network, such as a mobile phone, tablet computer, laptop computer, netbook, or personal digital assistant (PDA). This application does not impose any limitations on these embodiments.

[0057] Figure 1 Server 102 can be configured with an HTTP server to provide various data and services. For example, Figure 1 Server 102 can be configured with the OpenStack Trove service, as well as OpenStack components such as Nova, Glance, Cinder, Neutron, and Octavia. The OpenStack Trove service can be used to invoke OpenStack components such as Nova, Glance, Cinder, and Neutron to create the virtual machines used by the database instance and manage the virtual machines and their database services. Furthermore, the OpenStack Trove service can also be used to create master-slave instances and manage them using a unified group identifier. The Neutron or Octavia components in OpenStack can be used to create and manage load balancers.

[0058] Optionally, server 102 can be a server. This server can be a single server, or it can be a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. This application does not impose any limitations in this regard.

[0059] like Figure 2The diagram shown is a hardware structure schematic of a server 102 provided in an embodiment of this application. The server 102 includes a processor 21, a memory 22, a communication interface 23, and a bus 24. The processor 21, the memory 22, and the communication interface 23 can be connected via the bus 24.

[0060] Processor 21 is the control center of server 102. It can be a single processor or a collective term for multiple processing elements. For example, processor 21 can be a CPU or other general-purpose processors. Among them, general-purpose processors can be microprocessors or any conventional processors.

[0061] As one embodiment, processor 21 may include one or more CPUs, for example Figure 2 CPU0 and CPU1 are shown in the diagram.

[0062] The memory 22 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0063] In one possible implementation, the memory 22 can exist independently of the processor 21. The memory 22 can be connected to the processor 21 via a bus 24 and is used to store instructions or program code. When the processor 21 calls and executes the instructions or program code stored in the memory 22, it can implement the database creation method provided in the following embodiments of this application.

[0064] In another possible implementation, the memory 22 can also be integrated with the processor 21.

[0065] Communication interface 23 is used for server 102 to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc. Communication interface 23 may include a receiving unit for receiving data and a sending unit for sending data.

[0066] Bus 24 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 2 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0067] It should be pointed out that, Figure 2 The structure shown does not constitute a limitation on server 102, except... Figure 2 In addition to the components shown, server 102 may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0068] like Figure 3 The diagram shown is a flowchart illustrating a database creation method provided in an embodiment of this application. This database creation method is applied to... Figure 1 The database creation system 100 shown includes server 102. The database creation method includes: S301-S303.

[0069] S301. The server receives database instance information sent by the terminal for creating the target database.

[0070] The database instance information includes whitelist rules that allow access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information.

[0071] In one possible approach, the whitelist rule allowing access to the target database may include one or more user-specified Internet Protocol (IP) addresses. Furthermore, the whitelist rule allowing access to the target database may be a security group rule, edited by the user within a security group.

[0072] In one possible approach, the proxy node configuration information may include node quantity information, node type information, node specification information, and data disk information. The node quantity information indicates the number of proxy nodes to be created. The node type information can be of types such as Cetus or Sharding-Proxy. The node specification information indicates the amount of CPU and memory resources that the proxy nodes need to be configured with. The data disk information indicates the size of the data disk that the proxy nodes need to be configured with.

[0073] In one possible approach, the availability zone may include one or more discrete databases.

[0074] In one possible approach, network configuration information may include network address information and subnet information to which the target database belongs.

[0075] In one possible approach, the database sharding information may include the number of database shards that need to be configured for the target database, the number of slave nodes and read-only nodes in each database shard, the type of nodes in each database shard (e.g., MySQL 5.7, MySQL 8.0, and Redis), the specifications of nodes in each database shard, and the data disk size of nodes in each database shard.

[0076] In one possible approach, the target database could be a distributed database used to store business data related to a specific business activity, thereby meeting users' data storage and access needs. For example, the specific business activity could be logistics, and the business data related to logistics could be logistics delivery data. Alternatively, the specific business activity could be food delivery, and the business data related to food delivery could be food delivery data.

[0077] Optionally, the database instance information may also include the database name of the target database. For example, if the target database is used to store business data related to logistics operations, the database name could be "Logistics Delivery Database".

[0078] In one possible approach, combining Figure 1 When a user needs to create a target database, they can edit the database instance information through the input module configured on the terminal and perform a database creation operation (e.g., clicking the create button). In response to the user's database creation operation, the terminal can send the database instance information used to create the target database to the server. Correspondingly, the server can receive the database instance information used to create the target database from the terminal.

[0079] S302. When the database instance information meets the preset conditions, the server creates multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information.

[0080] In this system, the proxy node is used to filter data access requests for accessing the target database based on whitelist rules. Specifically, the proxy node can filter requests that do not conform to the whitelist rules.

[0081] In one possible approach, staff can pre-set preset conditions on the server. These preset conditions could include string editing rules for whitelist rules, proxy node configuration information, availability zones, network configuration information, and database sharding information. Based on this, the server can verify whether the database instance information conforms to the editing specifications according to the preset conditions, thereby avoiding failures or errors during database creation and ensuring the reliability of the database creation process.

[0082] In one possible implementation, after receiving database instance information from the terminal for creating the target database, the server can verify whether the database instance information meets preset conditions. If the database instance information does not meet the preset conditions, the server can send a response message carrying error information to the terminal. Accordingly, the terminal can receive the response message carrying error information from the server and display the error information to facilitate the user in correcting the relevant errors.

[0083] If the database instance information meets the preset conditions, the server can create multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information. Specifically, the server can determine the network port of each proxy node based on the network configuration information and configure whitelist rules on the network port of each proxy node. Then, the server can configure the network port of each proxy node according to the node type information, node specification information, and data disk information to obtain multiple proxy nodes corresponding to the number of nodes.

[0084] In one possible approach, the server can also configure functions such as database sharding and read / write splitting for the proxy nodes.

[0085] S303. Based on network configuration information and database sharding information, the server creates multiple database shards within the availability zone to obtain the target database.

[0086] In one possible approach, the server can determine the network ports of the master node, slave node, and read-only node in each database shard based on network configuration information. Then, according to the database sharding information, it configures the specifications and data disk parameters of each node in each database shard within the availability zone, resulting in multiple database shards. Based on this, the server can obtain a target database composed of multiple proxy nodes and multiple database shards.

[0087] In one possible approach, each database shard can be assigned a unique identifier for easy management. Each shard can include a master node, one or more slave nodes, and one or more read-only nodes. The master node can have a corresponding Virtual IP Address (VIP). The one or more slave nodes establish a master-slave replication relationship with the master node, achieving redundant data storage and high shard reliability. The one or more read-only nodes establish a master-slave replication relationship with the master node, achieving redundant data storage while also supporting read requests from proxy nodes.

[0088] In one possible approach, a database shard can also have an internal security group for functions such as master-slave replication and master-slave failover.

[0089] In one possible approach, the server can generate a configuration file that includes the network port addresses of each node in each database shard, so that each proxy node can store and retrieve data.

[0090] In one possible approach, the unique identifier for a database shard in this embodiment of the application can be a universally unique identifier (UUID).

[0091] In one embodiment, when the server creates multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information, such as Figure 4 As shown, the database creation method provided in this application embodiment further includes: S401-S402.

[0092] S401. The server determines the network port of each proxy node based on the network configuration information and configures whitelist rules on the network port of each proxy node.

[0093] In one possible approach, the target database can connect to a user's specific Virtual Private Cloud (VPC), or it can exist as a separate VPC belonging to the user. A VPC is a dynamically configured pool of public cloud computing resources.

[0094] In one possible approach, the server can determine the network ports of each proxy node based on network configuration information, allowing the proxy nodes to be accessed within the user's VPC. Furthermore, the server can configure whitelist rules on the network ports of each proxy node to ensure the security of the target database.

[0095] One possible approach is to configure whitelist rules on the network ports of each proxy node by binding a security group containing whitelist rules to the network ports of each proxy node.

[0096] S402. The server configures each agent node's network port according to the node type information, node specification information, and data disk information to obtain multiple agent nodes corresponding to the number of nodes.

[0097] In one possible approach, the server can configure the network ports of each proxy node according to node type information, node specification information, and data disk information to obtain multiple proxy nodes corresponding to the number of nodes.

[0098] In one possible approach, the server can also configure management ports for each agent node to facilitate restarting or deleting the agent nodes.

[0099] In one embodiment, before the server creates multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information, the database creation method provided in this application embodiment further includes: S501.

[0100] S501. The server configures a load balancer applied to the target database based on the load balancing configuration information.

[0101] The load balancer is used to determine which proxy node responds to a data access request among multiple proxy nodes.

[0102] In one possible approach, the database instance information may also include load balancing configuration information. The load balancing configuration information may include a load balancing algorithm.

[0103] Optionally, the load balancing algorithm can be a round-robin scheduling algorithm, or an algorithm that distributes new requests to the proxy node with the lowest current load. This application does not limit this specific approach.

[0104] In one possible approach, the server can configure a load balancer applied to the target database based on load balancing configuration information. This allows the server to determine the appropriate proxy node from among multiple proxy nodes to respond to a data access request received from the target database, thereby ensuring high availability of the load balancer. For example, the server can invoke the load balancer to determine the appropriate proxy node from among multiple proxy nodes based on a load balancing algorithm.

[0105] In one possible approach, the server can also configure a unique identifier (e.g., a UUID) for the load balancer to facilitate load balancer management. Furthermore, the server can also configure a virtual IP address for the load balancer to allow users to access the target database.

[0106] In one possible example, such as Figure 5 The diagram shown is a schematic representation of the structure of a target database provided in an embodiment of this application. The preset target database includes a load balancer, three proxy nodes (proxy node 1, proxy node 2, and proxy node 3), and three database shards (database shard 1, database shard 2, and database shard 3).

[0107] The load balancer can be configured with a virtual IP address. Each of the three proxy nodes can be configured with a network port and a management port. Furthermore, each proxy node's network port is bound to a first security group. This first security group can be specified by the user and is used by the load balancer to access each proxy node. The security rules for the first security group can be user-edited whitelist rules.

[0108] Each database shard consists of one master node, two slave nodes, and one read-only node, with each node configured with a network port and a management port. Database shard 1 corresponds to shard security group 1, database shard 2 corresponds to shard security group 2, and database shard 3 corresponds to shard security group 3. A shard security group corresponding to a database shard can be created by the server and is invisible to users; it is used for master-slave replication and master-slave failover within the database shard. Furthermore, a shard security group corresponding to a database shard can be bound to the network ports of each node within that database shard. For example, shard security group 1 corresponding to database shard 1 can be bound to the network ports of each node within database shard 1 for master-slave replication and master-slave failover within database shard 1. Additionally, the master node within each database shard may include a virtual IP address to facilitate data storage and retrieval by proxy nodes.

[0109] Additionally, the network port of each node in the three database shards can be bound to a second security group. This second security group, created by the server and invisible to users, is used to proxy node access to each database shard and forward read / write requests.

[0110] In one embodiment, such as Figure 6 As shown, the database creation method provided in this application embodiment further includes: S601-S602.

[0111] S601, The server receives an update request message sent by the terminal, which indicates that an update operation should be performed on the target database.

[0112] The update request message includes the target database name and the terminal's network address information. The update operation can include deleting the target data or restarting the target database.

[0113] In one possible approach, combining Figure 1 When a user needs to update the target database (e.g., delete or restart the database), they can perform the database update operation through the input module configured on the terminal (e.g., clicking the delete or restart button). In response to the user's database update operation, the terminal can send an update request message to the server, indicating that the target database needs to be updated. Correspondingly, the server can receive the update request message from the terminal and parse it to determine the database name of the target database and the terminal's network address information.

[0114] S602. When the server verifies that there is a correspondence between the database name and the network address information, it performs an update operation on the target database.

[0115] It should be noted that when creating the target database, the server can also generate a database identifier (such as a UUID) to uniquely identify the target database, and store the correspondence between the database identifier and the database name, as well as the correspondence between the database identifier and the terminal's network address information.

[0116] Therefore, to determine the validity of the update request message, the server can verify whether a corresponding database identifier exists for the database name. If not, the server will not respond to the update request message. If a corresponding database identifier exists for the database name, the server will further verify whether the database identifier corresponds to the terminal's network address information. If not, the server will not respond to the update request message. If the identifier exists, the server can respond to the update request message and update the target database.

[0117] In one possible approach, drawing on the example in S501, when the update operation is to delete the target database, the server can first set the instance status of the target database to "deleting," then unbind the second security group from each database shard and unbind the first security group from each proxy node. Next, the server can delete all database shards, i.e., delete the master node, slave nodes, read-only nodes, virtual IP addresses, and corresponding shard security groups within each shard. Then, the server can delete all proxy instances associated with the target database, as well as related network resources such as the load balancer and the second security group. After all deletion steps are completed, the server can set the instance status of the target database to "deleted," record the deletion time, and send a response message to the terminal indicating that the deletion operation is complete.

[0118] In one possible approach, drawing on the example in S501, when the update operation involves restarting the target database, the server can first set the instance status of the target database to "restarting" and stop the load balancer service. Next, the server can restart the master, slave, and read-only nodes within each database shard, maintaining the shard status to prevent master-slave failover. Then, the server can restart each proxy node and restart the load balancer service. After all the above steps are completed, the server can set the instance status of the target database to "normal" and send a response message to the terminal indicating that the restart operation is complete.

[0119] In one embodiment, referring to the example in S501, such as Figure 7 The diagram illustrates a database creation process according to an embodiment of this application. A user can send a database creation request carrying database instance information to a server via a terminal. Correspondingly, the server can receive the database creation request from the terminal based on the target service interface. Next, the server can generate a database identifier for the target database, create a data row in the database to record the database identifier and creation time, set the instance status of the target database to "creating," and return the database identifier to the terminal via the target service interface.

[0120] Next, the server can invoke the target service for multi-coroutine processing. Specifically, the main coroutine of the target service can invoke the target component to request the creation of a load balancer. Correspondingly, the target component can respond to the main coroutine's invocation by configuring the load balancer and generating its identifier, and then returning the load balancer identifier to the main coroutine. Then, the main coroutine can invoke the target component to request the creation of a second security group. Correspondingly, the target component can respond to the main coroutine's invocation by configuring the second security group and generating its identifier, and then returning the second security group identifier to the main coroutine.

[0121] Next, the main coroutine can, based on the second security group, sequentially call the three sub-coroutines to create each database shard. Each sub-coroutine can create its own database shard and generate an identifier for each shard and a virtual IP address for the master node within that shard. For example, the sub-coroutine corresponding to database shard 1 can create database shard 1, generate its identifier and a virtual IP address for the master node within it, and return the identifier and virtual IP address to the main coroutine. After each master node in each database shard has a corresponding virtual IP address, the server can generate a proxy configuration file that includes these virtual IP addresses.

[0122] Next, the main coroutine can, based on the first security group, sequentially call the other three sub-coroutines to create each proxy node, establish connections between each proxy node and each virtual IP in the proxy configuration file, and generate identifiers for each proxy node. For example, the sub-coroutine corresponding to proxy node 1 can be used to create proxy node 1, generate the identifier of proxy node 1, and return the identifier of proxy node 1 to the main coroutine.

[0123] Next, after each proxy node is created, the main coroutine can call the target component to request the establishment of connections between the network ports of each proxy node and the load balancer, in order to request that each proxy node be added to the load balancer. Correspondingly, the target component can respond to the main coroutine's call by configuring the network ports of each proxy node and the connections to the load balancer, and return a message indicating successful addition to the main coroutine.

[0124] Next, the main coroutine can set the instance status of the target database to "normal" and send a successful creation response message to the terminal.

[0125] In one possible approach, the target service could be an OpenStack Trove service. The target service interface could be an application programming interface (API) of the OpenStack Trove service. The target component could be a Neutron component within OpenStack.

[0126] In this embodiment, after receiving database instance information from the terminal for creating a target database, the server can create multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information, provided the database instance information meets preset conditions. Furthermore, based on network configuration information and database sharding information, it creates multiple database shards within the availability zone to obtain the target database. The database instance information includes whitelist rules allowing access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information. Since the proxy nodes are used to filter data access requests for accessing the target database according to the whitelist rules, the target database created in this application can intercept data access requests that do not conform to the whitelist rules based on the proxy nodes, preventing the target database from being maliciously attacked by unknown hosts. Therefore, this application can solve the technical problem of low security in general-purpose databases and improve database security.

[0127] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0128] This application embodiment can divide the server into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0129] like Figure 8 The diagram shown is a structural schematic of a database creation apparatus provided in an embodiment of this application. This database creation apparatus can be applied to a server to perform tasks such as... Figures 3-4 and Figure 6 The database creation method shown is illustrated. The database creation apparatus includes: a receiving unit 701 and a creation unit 702.

[0130] The receiving unit 701 is configured to receive database instance information sent by the terminal for creating the target database; the database instance information includes whitelist rules allowing access to the target database, proxy node configuration information, availability zone, network configuration information, and database sharding information; for example, combined with... Figure 3 The receiving unit 701 can be used to execute S301.

[0131] Creation unit 702 is used to create multiple proxy nodes based on whitelist rules, proxy node configuration information, and network configuration information when the database instance information meets preset conditions. The proxy nodes are used to filter data access requests for accessing the target database according to the whitelist rules; for example, combining... Figure 3 Unit 702 can be used to execute S302.

[0132] Unit 702 is also used to create multiple database shards within an availability zone based on network configuration information and database sharding information, thereby obtaining the target database. For example, combined with... Figure 3 Unit 702 can be used to execute S303.

[0133] Optionally, the agent node configuration information includes node quantity information, node type information, node specification information, and data disk information; creation unit 702 is specifically used for:

[0134] The network ports of each proxy node are determined based on network configuration information, and whitelist rules are configured for the network ports of each proxy node; for example, combining... Figure 4 Unit 702 can be used to execute S401.

[0135] Based on node type, node specification, and data disk information, configurations are made on the network ports of each proxy node to obtain multiple proxy nodes corresponding to the number of nodes. For example, combining... Figure 4 Unit 702 can be used to execute S402.

[0136] Optionally, the database instance information also includes load balancing configuration information; the creation unit 702 is further configured to configure a load balancer applied to the target database based on the load balancing configuration information; the load balancer is used to determine the proxy node responding to a data access request among multiple proxy nodes. For example, the creation unit 702 can be used to execute S501.

[0137] Optionally, the database creation apparatus further includes: an update unit 703;

[0138] The receiving unit 701 is further configured to receive an update request message sent by the terminal, indicating an update operation to be performed on the target database; the update request message includes the database name of the target database and the network address information of the terminal; the update operation includes deleting the target database or restarting the target database; for example, in combination with Figure 6 The receiving unit 701 can be used to execute S601.

[0139] Update unit 703 is used to perform an update operation on the target database when verifying the correspondence between the database name and network address information. For example, combined with... Figure 6 The update unit 703 can be used to execute S602.

[0140] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this application can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer-readable storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0141] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0142] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and other division methods may exist in actual implementation. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms. Units described as separate components may or may not be physically separate; components shown as units may be one physical unit or multiple physical units, i.e., they may be located in one place or distributed in multiple different places. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0143] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A database creation method, characterized in that, include: The receiver sends database instance information for creating the target database; the database instance information includes whitelist rules that allow access to the target database, proxy node configuration information, availability zone, network configuration information, database sharding information, and load balancing configuration information. The agent node configuration information includes node quantity information, node type information, node specification information, and data disk information; Based on the load balancing configuration information, a load balancer is configured for application to the target database; the load balancer is used to determine the proxy node responding to the data access request among the plurality of proxy nodes; When the database instance information meets the preset conditions, the network port of each of the proxy nodes is determined based on the network configuration information, and a first security group is configured on the network port of each of the proxy nodes. The first security group is used for the load balancer to access each proxy node, and the security rules of the first security group are whitelist rules edited by the user. A second security group is configured on the network port of each of the agent nodes; the second security group is created by the server and is not visible to the user, and is used to allow each of the agent nodes to access the database shards of the target database. According to the node type information, the node specification information, and the data disk information, the network ports of each of the agent nodes are configured to obtain multiple agent nodes corresponding to the node quantity information; The proxy node is used to filter data access requests for accessing the target database according to the whitelist rules; Based on the network configuration information and the database sharding information, multiple database shards are created within the availability zone to obtain the target database.

2. The database creation method according to claim 1, characterized in that, Multiple proxy nodes are created based on the whitelist rules, the proxy node configuration information, and the network configuration information, including: The network ports of each proxy node are determined based on the network configuration information, and the whitelist rules are configured on the network ports of each proxy node.

3. The database creation method according to claim 1 or 2, characterized in that, Also includes: Receive an update request message sent by the terminal, indicating that an update operation should be performed on the target database; The update request message includes the database name of the target database and the network address information of the terminal; the update operation includes deleting the target database or restarting the target database; When verifying the correspondence between the database name and the network address information, the update operation is performed on the target database.

4. A database creation apparatus, characterized in that, include: Receiving unit and creation unit; The receiving unit is used to receive database instance information sent by the terminal for creating the target database; The database instance information includes whitelist rules that allow access to the target database, proxy node configuration information, availability zone, network configuration information, database sharding information, and load balancing configuration information; The agent node configuration information includes node quantity information, node type information, node specification information, and data disk information; The creation unit is used to configure a load balancer applied to the target database based on the load balancing configuration information; the load balancer is used to determine the proxy node responding to the data access request among the plurality of proxy nodes; The creation unit is further configured to determine the network port of each proxy node based on the network configuration information when the database instance information meets the preset conditions, and configure a first security group on the network port of each proxy node. The first security group is used for the load balancer to access each proxy node, and the security rules of the first security group are whitelist rules edited by the user. The creation unit is further configured to configure a second security group on the network port of each of the proxy nodes; the second security group is created by the server and is not visible to the user, and is used to allow each of the proxy nodes to access the database shards of the target database; The creation unit is further configured to configure the network ports of each proxy node according to the node type information, the node specification information, and the data disk information to obtain multiple proxy nodes corresponding to the node quantity information; the proxy nodes are used to filter data access requests for accessing the target database according to the whitelist rules; The creation unit is further configured to create multiple database shards within the availability zone based on the network configuration information and the database sharding information, thereby obtaining the target database.

5. The database creation apparatus according to claim 4, characterized in that, The creation unit is specifically used for: The network ports of each proxy node are determined based on the network configuration information, and the whitelist rules are configured on the network ports of each proxy node.

6. The database creation apparatus according to claim 4 or 5, characterized in that, Also includes: Update unit; The receiving unit is further configured to receive an update request message sent by the terminal, which instructs the execution of an update operation on the target database; The update request message includes the database name of the target database and the network address information of the terminal; the update operation includes deleting the target database or restarting the target database; The update unit is used to perform the update operation on the target database when verifying that there is a correspondence between the database name and the network address information.

7. A database creation apparatus, characterized in that, It includes a memory and a processor; the memory is used to store computer execution instructions, and the processor is connected to the memory via a bus; when the database creation device is running, the processor executes the computer execution instructions stored in the memory, so that the database creation device performs the database creation method as described in any one of claims 1-3.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the database creation method as described in any one of claims 1-3.

Images