Distributed cloud system, initial configuration method of cloud site, cluster and storage medium

Abstract

The application provides a distributed cloud system, a start-up configuration method of a cloud site, a cluster and a storage medium, and belongs to the technical field of clouds. In the production stage, the application can automatically generate site metadata through a planning subsystem, and then a pre-delivery subsystem can utilize the site metadata to realize network configuration, hardware and software configuration and the like of the cloud site in the production stage. In other words, the application can pre-configure the cloud site in the production line, that is, the original on-site deployment process can be pre-completed in the production line. In addition, the application also presets a trusted wireless network through unloading technology, and then the entire initialization process can be automatically and quickly completed through the wireless network provided by the inserted unloading card in the deployment stage, which saves time and effort, and does not require relevant personnel to enter the business site for start-up configuration, thereby greatly reducing the labor cost.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and in particular to a distributed cloud system, a cloud site initial configuration method, a cluster, and a storage medium. Background Technology

[0002] Distributed cloud refers to a cloud service provider distributing public cloud services to different physical locations, while the ownership, operation, governance, updates, and evolution of the cloud services remain the responsibility of the cloud service provider. The distributed cloud portfolio comprises two parts: distributed cloud infrastructure and a combination of cloud services that can fully collaborate with it. For example, distributed cloud infrastructure includes central regions and on-premises edge clouds, where edge cloud sites can be deployed in user data centers. In other words, cloud sites can be edge sites extending to the business site to achieve localized cloud service deployment.

[0003] Deploying a cloud site involves initial configuration. For cloud sites, initial configuration refers to a series of configuration steps that need to be completed after the relevant hardware is installed in the rack before the cloud site can provide cloud services.

[0004] In related technologies, initial configuration is completed by personnel with specialized knowledge at the business site. That is, initial configuration requires manual completion by relevant personnel at the business site. This method of initial configuration is time-consuming and labor-intensive, significantly increasing labor costs. Summary of the Invention

[0005] This application provides a method for initial configuration of a distributed cloud system and cloud site, as well as a cluster and storage medium, eliminating the need for personnel to enter the business site for initial configuration, thus significantly reducing labor costs. The technical solution is as follows:

[0006] In a first aspect, a distributed cloud system is provided, comprising a central region and locally deployed edge clouds, wherein the central region and the edge clouds are connected via a network; the central region is equipped with a planning subsystem, a pre-installed delivery subsystem, and a registration and discovery center; and the edge clouds are equipped with cloud sites.

[0007] During the production phase, the planning subsystem is used to acquire cloud service demand information; based on the cloud service demand information, it generates site metadata for cloud sites to be deployed; wherein, the site metadata is used to indicate the deployment requirements of the cloud sites;

[0008] During the production phase, the pre-installed delivery subsystem is used to assemble hardware into a cabinet in response to the deployment of the cloud site, and to configure the network and hardware and software for the cloud site according to the site metadata; wherein, the hardware assembled into the cabinet includes a server with an unloading card and a security chip inserted, and the security chip stores a hardware root of trust.

[0009] During the deployment phase, the offloading card is used to respond to the cloud site, which has completed the production phase, being deployed and powered on in the user's data center, to establish a trusted wireless network based on the hardware trusted root, to obtain the site metadata from the planning subsystem based on the wireless network, and to send a registration request to the registration and discovery center, the registration request carrying the site metadata.

[0010] This application enables the automatic generation of site metadata through a planning subsystem during the production phase. The pre-installed delivery subsystem then utilizes this site metadata to perform network and hardware / software configurations for the cloud site during production. In other words, this application allows for pre-configuration of the cloud site on the production line, meaning the traditional on-site deployment process can be completed beforehand. Furthermore, this application pre-configures a trusted wireless network using offloading technology. During deployment, the wireless network provided by the inserted offloading card automatically and quickly completes the entire initialization process, saving time and effort. It also eliminates the need for personnel to enter the business site for initial configuration, significantly reducing labor costs.

[0011] Optionally, the pre-installed delivery subsystem is used to configure the cloud site's network based on the site metadata, configure the cloud site's server, and install the cloud service underlying software and cloud service business components on the server.

[0012] Through the above optional implementation methods, since the pre-installed delivery subsystem can complete such as network configuration and server configuration, and install cloud service underlying software and cloud service business components in advance during the production stage, without the need for relevant personnel to enter the business site for initial configuration during the deployment stage, it can greatly reduce labor costs.

[0013] Optionally, the uninstallation card includes an environment initialization module and a software development kit (SDK) module; wherein, the SDK module includes a configuration SDK, a testing SDK, and an activation SDK;

[0014] The environment initialization module is used to call the configuration SDK to initialize the first type of configuration parameters and the second type of configuration parameters; wherein, the first type of configuration parameters are related to the cloud site itself, and the second type of configuration parameters are related to the central Region that interfaces with the cloud site;

[0015] The environment initialization module is used to call the test SDK to perform performance tests on the cloud site.

[0016] The environment initialization module is used to call the activation SDK to activate the cloud site from the delivery state to the maintenance state.

[0017] Through the above optional implementation methods, the initialization engine is unloaded to the uninstallation card using the uninstallation technology. The environment initialization module of the uninstallation card, as the main control module, can automatically orchestrate and schedule the initialization process. The SDK module includes configuration SDK, dial test SDK, and activation SDK, which can realize configuration initialization, self-test and activation, thus providing a guarantee for automatic start-up configuration.

[0018] Optionally, the planning subsystem is used to acquire cloud service demand information; and generate site metadata that can be identified by the pre-installed delivery subsystem based on the cloud service demand information; wherein the cloud service demand information includes cloud service orders and engineering survey information.

[0019] Through the above optional implementation methods, the planning subsystem can automatically generate site metadata that can be recognized by the pre-installed delivery subsystem based on the cloud service demand information. This data conversion method ensures that the initial configuration process can proceed smoothly.

[0020] Optionally, the offloading card is used to send a connection request to the registration and discovery center based on the wireless network;

[0021] The registration discovery center is used to send an authentication request to the uninstallation card after receiving the connection request; receive the identity authentication information sent by the uninstallation card according to the authentication request, and verify the legality of the identity authentication information; if the identity authentication information passes the verification, receive the connection request and establish a communication connection with the uninstallation card based on the connection request.

[0022] The uninstallation card is used to send the registration request to the registration discovery center based on the communication connection.

[0023] The above optional implementation methods ensure the security of communication between the uninstallation card and the registration discovery center.

[0024] Optionally, the uninstallation card is used to send the registration request to the registration discovery center based on the wireless network; wherein the registration request also carries identity authentication information;

[0025] The registration discovery center is used to verify the legitimacy of the identity authentication information after receiving the registration request; if the identity authentication information passes the verification, it stores the site metadata carried in the registration request.

[0026] The above optional implementation methods ensure the security of communication between the uninstallation card and the registration discovery center.

[0027] Optionally, the unloading card includes a wireless communication module;

[0028] The offloading card is used to perform integrity measurement on the target component on the trusted chain based on the hardware root of trust; if the target component passes the integrity measurement, the target component continues to perform integrity measurement on the next level component; and so on, repeating the step of performing integrity measurement on the (i+1)th level component if the i-th level component passes the integrity measurement, until the last level component; where i is a positive integer; if the last level component passes the integrity measurement, the offloading card is used to invoke the wireless communication module to trustedally start the wireless network;

[0029] The trusted chain starts from the security chip and involves multiple components, which are the hardware and software of the server. The target component is located at the next level of the security chip on the trusted chain.

[0030] Through the above optional implementation methods, the offloaded card is pre-installed with a wireless communication module. This module enables trusted booting of the wireless network based on the security chip, allowing the offloaded card to connect to the registration and discovery center in a reliable manner, thus providing good security. Furthermore, since this initial configuration method does not rely on the user's network, it also ensures the delivery of the service-level agreement (SLA).

[0031] Optionally, the central Region further includes an operations and maintenance subsystem and a management subsystem; the operations and maintenance subsystem and the management subsystem are used to manage the cloud site after initial configuration;

[0032] The registration and discovery center is also used to send notification messages to the operations and maintenance subsystem and the management subsystem; wherein, the notification message is used to instruct the operations and maintenance subsystem and the management subsystem to synchronize the site metadata; or,

[0033] The operation and maintenance subsystem and the management subsystem are also used to actively obtain the site metadata from the central Region.

[0034] The above optional implementation methods enable timely synchronization and refresh of site metadata when the lifecycle of a cloud site changes. In other words, they ensure timely synchronization and refresh of data between the registration and discovery center and multiple subsystems.

[0035] Secondly, a method for initial configuration of cloud sites is provided, applied to a distributed cloud system, wherein the distributed cloud system includes a central region and locally deployed edge clouds, the central region and the edge clouds being connected via a network; the central region deploys a planning subsystem, a pre-installation delivery subsystem, and a registration and discovery center; the edge clouds deploy cloud sites; the method includes:

[0036] During the production phase, the planning subsystem acquires cloud service demand information; based on the cloud service demand information, it generates site metadata for cloud sites to be deployed; wherein, the site metadata is used to indicate the deployment requirements of the cloud sites;

[0037] During the production phase, after the hardware required for deploying the cloud site is assembled into the cabinet, the pre-installed delivery subsystem configures the network and hardware and software for the cloud site according to the site metadata; wherein, the hardware assembled into the cabinet includes a server with an unloading card and a security chip inserted, and the security chip stores a hardware root of trust.

[0038] During the deployment phase, in response to the cloud site having completed deployment and power-on in the user's data center after the production phase, the offloading card establishes a trusted wireless network based on the hardware trusted root, obtains the site metadata from the planning subsystem based on the wireless network, and sends a registration request to the registration and discovery center, the registration request carrying the site metadata.

[0039] Optionally, the pre-installed delivery subsystem configures the network and hardware / software for the cloud site based on the site metadata, including:

[0040] The pre-installed delivery subsystem configures the network of the cloud site based on the site metadata;

[0041] The pre-installed delivery subsystem configures the cloud site's server based on the site metadata;

[0042] The pre-installed delivery subsystem installs the underlying cloud service software and cloud service business components on the server based on the site metadata.

[0043] Optionally, the uninstallation card includes an environment initialization module and an SDK module; wherein, the SDK module includes a configuration SDK, a testing SDK, and an activation SDK; the method further includes:

[0044] The uninstallation card calls the configuration SDK through the environment initialization module to initialize the first type of configuration parameters and the second type of configuration parameters; wherein, the first type of configuration parameters are related to the cloud site itself, and the second type of configuration parameters are related to the central Region that is connected to the cloud site;

[0045] The uninstallation card calls the test SDK through the environment initialization module to perform performance testing on the cloud site.

[0046] The uninstallation card activates the cloud site from the delivery state to the maintenance state by calling the activation SDK through the environment initialization module.

[0047] Optionally, the planning subsystem acquires cloud service demand information; based on the cloud service demand information, it generates site metadata for the cloud site to be deployed, including:

[0048] The planning subsystem acquires cloud service demand information; wherein, the cloud service demand information includes cloud service orders and engineering survey information;

[0049] The planning subsystem generates site metadata that can be recognized by the pre-installed delivery subsystem based on the cloud service requirement information.

[0050] Optionally, sending a registration request to the registration discovery center includes:

[0051] The uninstallation card sends a connection request to the registration and discovery center based on the wireless network;

[0052] Upon receiving the connection request, the registration discovery center sends an authentication request to the uninstallation card.

[0053] The registration discovery center receives the identity authentication information sent by the uninstallation card according to the authentication request, and verifies the legality of the identity authentication information;

[0054] If the identity authentication information passes verification, the registration discovery center receives the connection request and establishes a communication connection with the uninstallation card based on the connection request;

[0055] The uninstallation card sends the registration request to the registration discovery center based on the communication connection.

[0056] Optionally, sending a registration request to the registration discovery center includes:

[0057] The uninstallation card sends the registration request to the registration discovery center based on the wireless network; wherein, the registration request also carries identity authentication information;

[0058] The method further includes:

[0059] Upon receiving the registration request, the registration discovery center verifies the legitimacy of the identity authentication information;

[0060] If the identity authentication information passes verification, the registration discovery center stores the site metadata carried in the registration request.

[0061] Optionally, the offloading card includes a wireless communication module; the offloading card establishes a trusted wireless network based on the hardware trusted root, including:

[0062] Integrity measurement is performed on the target component on the trusted chain based on the hardware root of trust; wherein the trusted chain starts from the security chip and involves multiple components, the multiple components being the hardware and software of the server, and the target component is located at the next level below the security chip on the trusted chain;

[0063] If the target component passes the integrity measurement, the target component will continue to perform integrity measurement on the next level component.

[0064] And so on, repeating the step of performing integrity measurement on the (i+1)th level component by the i-th level component when the i-th level component passes the integrity measurement, until the last level component; where i is a positive integer;

[0065] Upon successful integrity measurement of the last-level component, the offloading card invokes the wireless communication module to reliably start the wireless network.

[0066] Optionally, the central Region further includes an operations and maintenance subsystem and a management subsystem; the operations and maintenance subsystem and the management subsystem are used to manage the cloud site after initial configuration;

[0067] The method further includes:

[0068] The registration and discovery center sends a notification message to the operations and maintenance subsystem and the management subsystem; wherein, the notification message is used to instruct the operations and maintenance subsystem and the management subsystem to synchronize the site metadata; or,

[0069] The operation and maintenance subsystem and the management subsystem actively obtain the site metadata from the central Region.

[0070] Thirdly, a computing device cluster is provided, including at least one computing device, each computing device including a processor and memory;

[0071] The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to execute the cloud site initial configuration method provided in the second aspect or any possible implementation thereof.

[0072] Fourthly, a computer-readable storage medium is provided, including computer program instructions that, when executed by a cluster of computing devices, enable the cluster to perform the cloud site initial configuration method provided in the second aspect or any possible implementation thereof. This storage medium includes, but is not limited to, volatile memory, such as random access memory, and non-volatile memory, such as flash memory, hard disk, and solid-state drive.

[0073] Fifthly, a computer program product containing instructions is provided, which, when run by a computing device cluster, causes the computing device cluster to execute the cloud site initial configuration method provided in the second aspect or any possible implementation thereof. Attached Figure Description

[0074] Figure 1 This is a schematic diagram of the structure of a distributed cloud system provided in an embodiment of this application;

[0075] Figure 2 This is a schematic diagram of the structure of an initialization engine provided in an embodiment of this application;

[0076] Figure 3 This is an interactive schematic diagram of a distributed cloud system provided in an embodiment of this application;

[0077] Figure 4 This is a flowchart illustrating a cloud site configuration method provided in an embodiment of this application;

[0078] Figure 5 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0079] Figure 6 This is a schematic diagram of the structure of a computer device cluster provided in an embodiment of this application. Detailed Implementation

[0080] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0081] Before providing a detailed explanation of this application, the abbreviations and terms used in this application will be explained.

[0082] Cloud: refers to servers or server clusters. The services provided by these servers or server clusters that constitute the cloud are called cloud services, which can also be described as cloud computing services. Users obtain the resources and services they need from the cloud through the network.

[0083] Public cloud: This refers to a cloud provided by a third-party provider (also known as a cloud service provider) to the general public or large industrial groups for use. The core attribute of public cloud is shared resource service. In other words, public cloud is owned and operated by a third-party provider, who provides resource services to the general public or large industrial groups through the network on a rental basis.

[0084] Distributed cloud: Public cloud services (typically including the necessary hardware and software) are distributed to different physical locations (i.e., the edge), while the ownership, operation, governance, updates and evolution of the services remain the responsibility of the original public cloud service provider.

[0085] Region: Divided by geographical location and network latency, a Region uses the same resource pool and can be understood as sharing public services such as elastic computing, block storage, object storage, virtual private cloud (VPC) network, elastic internet protocol (IP), and images.

[0086] Central Region: Also known as central cloud, in this application it refers to a region of public cloud.

[0087] Edge: In this application, it refers to the edge cloud, such as the edge cloud deployed on Premise.

[0088] On Premise: Generally refers to the user's data center. On Premise deployed edge cloud is the same as locally deployed edge cloud.

[0089] Edge cloud: Based on the core and edge computing capabilities of cloud computing technology, it is a cloud computing platform (referred to as cloud platform) built on edge infrastructure. It forms a comprehensive elastic cloud platform with computing, network, storage, security and other capabilities at the edge. By placing network forwarding, storage, computing and intelligent data analysis at the edge, it reduces response latency, alleviates cloud pressure and reduces bandwidth costs, and can provide cloud services such as network-wide scheduling and computing power distribution.

[0090] Cloud-edge network: A network channel connecting public cloud and edge cloud, which can be carried and implemented through various networks such as public network, dedicated line, and local area network.

[0091] Registry Discovery Center: A service that manages Internet technology (IT) objects, allowing IT objects to register their identity information and enabling other systems to find and discover registered objects in a trustworthy manner.

[0092] Optionally, the IT object can be a hardware device with an IP address and a unique identifier, a microservice node, middleware, etc. In this application, the IT object refers to a distributed cloud site, also known as a distributed cloud mini-site or cloud site.

[0093] Offload Card: As a peripheral component interconnect express (PCIe) terminal device, it is inserted into the PCIe slot of the server's motherboard via the PCIe interface. The offload card itself has a processor and memory, enabling it to perform basic calculations. For example, the offload card can be implemented using a RISC microprocessor (advanced RISC machines, ARM).

[0094] Optionally, the initial configuration method for distributed cloud systems and cloud sites provided in this application can be applied to the following scenarios.

[0095] In local low-latency scenarios, some services have high network latency requirements due to their business characteristics. However, public cloud data centers are usually far away from user terminal devices, and network latency cannot be reduced due to distance. Traditional public cloud services usually cannot meet the requirements of these services.

[0096] In scenarios where data is stored locally, large-scale use of public cloud has brought significant benefits to government and enterprise users. However, due to limitations imposed by policies and regulations, data security, business scenarios, and the difficulty of architectural transformation, many enterprise applications are still unable to migrate to the public cloud.

[0097] Group branch management involves enterprises setting up branches in different regions based on their business needs. These branches may serve as office spaces, factories for production, warehousing centers for logistics, or laboratories for research and development. Most branches require the deployment of various office applications for normal operation, such as general functions like attendance and finance, as well as specialized systems like logistics and sales. Currently, many branches face numerous challenges in their operation and maintenance, such as differences in operating environments and underlying services compared to the group headquarters, and complex infrastructure maintenance.

[0098] Software-as-a-Service (SaaS) application distribution has gained increasing popularity among government and enterprise users due to its rich functionality and pay-as-you-go pricing. However, because SaaS application user data is stored in the cloud by default, and all functionality depends on internet bandwidth, the user experience for some government and enterprise customers is unsatisfactory. Furthermore, the local deployment solutions offered by some SaaS application vendors for large government and enterprise customer data centers are often cumbersome.

[0099] The following is an exemplary description of the initial configuration method for the distributed cloud system and cloud site provided in the embodiments of this application.

[0100] This application enables the original on-site installation process to be completed in advance during the production stage. Furthermore, this application uses offloading technology to offload the distributed cloud initialization engine (hereinafter referred to as the initialization engine) to the offloading card. This initialization engine is pre-configured with a trusted wireless network, enabling automatic site commissioning and configuration based on this trusted wireless network. This plug-and-play approach avoids the time-consuming, costly, and error-prone problems associated with on-site commissioning by personnel. For example, after signing a contract with a user, commissioning typically encompasses a series of activities including hardware deployment, network connectivity, software installation, configuration initialization, management plane access, operation and maintenance, and acceptance testing. Plug-and-play embodies end-to-end intelligent and automated capabilities, reducing complex manual operations and automating commissioning configuration through systematic technical means. In other words, plug-and-play commissioning configuration is an automated commissioning method that requires no human intervention.

[0101] Figure 1 This is a schematic diagram of the structure of a distributed cloud system provided in an embodiment of this application. Figure 1 As shown, the distributed cloud system includes: a central Region 10 and a locally deployed edge cloud 11, with the central Region 10 and the edge cloud 11 connected via a network; the central Region 10 is equipped with a planning subsystem 101, a pre-installed delivery subsystem 102, a registration and discovery center 103, an operation and maintenance subsystem 104, and a management subsystem 105; the edge cloud 11 is equipped with a cloud site 111.

[0102] Optionally, the aforementioned network is a long term evolution (LTE) network or a 5th-generation mobile communication (5G) network; in addition, an encrypted tunnel is established between the central Region 10 and the edge cloud 11 to ensure the security of communication, which is not limited in this application.

[0103] Among them, Edge Cloud 11 is a cloud platform built on edge infrastructure (such as cloud sites) based on the core and edge computing capabilities of cloud computing technology. This cloud platform is also referred to as a distributed cloud platform in this article. Optionally, this cloud platform includes a computing subsystem, a storage subsystem, a network subsystem, an operation and maintenance subsystem, a configuration subsystem, and a management and control subsystem, thereby providing underlying basic capabilities such as computing, storage, networking, operation and maintenance, configuration, and management and control.

[0104] Production stage

[0105] During the production phase, the planning subsystem 101 is responsible for generating site metadata. Optionally, relevant personnel can import cloud service requirement information using a systematic modeling tool, which the planning subsystem 101 then parses to generate site metadata recognizable by downstream production lines. Downstream production lines include, but are not limited to, manufacturing production lines and pre-assembly / delivery production lines. The planning subsystem 101 can parse cloud service requirement information into structured data recognizable by all downstream production lines. For example, for the manufacturing production line, it can determine the bill of materials based on the parsed site metadata, then manufacture the hardware required for deploying the cloud site based on the bill of materials, and assemble this hardware into server racks. These server racks are deployed at the business site. The hardware involved here includes, but is not limited to, servers, network switches, rack locks, power supply modules, and cables. Optionally, deploying cloud site 111 may require multiple servers, and correspondingly, multiple server racks may be required.

[0106] In summary, the planning subsystem 101 is used to acquire cloud service demand information; based on this cloud service demand information, it generates site metadata for the cloud site 111 to be deployed. Optionally, the cloud service demand information includes cloud service orders and subsequent engineering survey information. The cloud service order can be either an order from a user or an order from a cloud service provider, meaning the cloud service provider automatically plans and places the order. Correspondingly, the planning subsystem 101 generates site metadata recognizable by the pre-installation delivery subsystem 102 based on the cloud service orders and engineering survey information included in the cloud service demand information. The site metadata indicates the deployment requirements of the cloud site; optionally, the site metadata includes, but is not limited to, basic attribute information such as site number and site location, infrastructure information such as the site's hardware specifications, model, and version, and the site's IP address, etc.

[0107] During the production phase, the pre-installed delivery subsystem 102 is used to load hardware into the cabinet in response to the deployment requirements of cloud site 111, and to configure the network and hardware / software for cloud site 111 based on the site's metadata; as previously described, see [link to previous section]. Figure 2 The hardware assembled into the cabinet includes a server with an unloading card 20 and a security chip 21 inserted. Figure 2 The left side of the image shows the server architecture, and the right side shows the specific structure of the offload card 20.

[0108] Optionally, the server is an x86 / ARM server; the offload card 20 and security chip 21, as PCIe terminal devices, are inserted into the PCIe slot of the server's motherboard via the PCIe interface. The offload card 20 typically has its own processor and memory, enabling basic computation. Before being inserted into the PCIe slot, the offload card 20 has already been initialized, such as... Figure 2As shown, the unloading card 20 includes a wireless communication module 201, an environment initialization module 202, and an SDK module 203. Optionally, the wireless communication module 201 mainly includes a softSIM component and a wireless radio frequency component; among which, the softSIM is a subscriber identity module (SIM) function implemented purely in software based on the operating system. The environment initialization module 202 is the main control module of the initialization engine. During the deployment phase, it is responsible for automatically orchestrating and scheduling the initialization process, such as wireless network activation, initiating registration requests, configuration initialization, and self-testing.

[0109] Optionally, in addition to the modules mentioned above, the offloading card 20 may also include modules such as a storage module, a security module, and a management module to provide storage, security, and management capabilities.

[0110] Optionally, since hardware attacks are generally more difficult than software attacks, the security chip 21 stores a hardware root of trust. In addition, the security chip 21 can be a security chip based on a trusted platform module (TPM) or a security chip based on a trusted cryptography module (TCM), and this application does not impose any restrictions on it.

[0111] Optionally, during the production phase, the pre-installed delivery subsystem 102 is used to perform network and server configuration on the cloud site 111 based on the site's metadata, and to install the underlying cloud service software and cloud service business components on the server.

[0112] Deployment phase

[0113] During the deployment phase, the offload card 20 is used in response to the cloud site 111, which has completed the production phase, being deployed and powered on in the user's data center. It then establishes a trusted wireless network based on the hardware trusted root stored in the security chip 21, thereby enabling... Figure 3 As shown, the system obtains the site metadata from the planning subsystem 101 based on the wireless network and sends a registration request to the registration discovery center 103, which carries the site metadata.

[0114] Optionally, the unloading card 20 requests complete site metadata from the planning subsystem 101. This site metadata is stored in the database of the planning subsystem 101 and is then encrypted before being returned to the cloud site 111. Optionally, after obtaining the site metadata, the unloading card 20 refreshes the site metadata into memory.

[0115] The wireless network is provided by the wireless communication module 201 of the offload card 20. The trusted wireless network established by the wireless communication module 201 is based on the hardware trusted root and encrypted tunnel provided by the security chip 21.

[0116] Before discussing roots of trust, let's first introduce trusted computing. The general approach of trusted computing is as follows: First, establish a root of trust as the foundation and starting point of trust. Then, establish a chain of trust, starting from the root of trust and measuring and trusting each level, extending this trust to the entire system, thereby ensuring the trustworthiness of the entire computing environment. For example, before starting the wireless communication module 201, static measurement can be used to ensure that the system's trust has not been tampered with. The root of trust is the component that initiates the chain of trust. The chain of trust starts from a trusted component (hardware root of trust) and measures the next level of components until all components that need to be measured have been measured.

[0117] In detail, the offloading card 20 is used to perform integrity measurements on target components on the trusted chain based on the hardware root of trust. This trusted chain starts with the security chip 21 and involves multiple components, which are the hardware and software of the server in the cloud site 111. The target component is located at the next level down from the security chip 21 on the trusted chain. If the target component passes the integrity measurement, it continues to perform integrity measurements on the next level component; and so on, repeating the step of performing integrity measurements on the (i+1)th level component if the i-th level component passes the integrity measurement, until the last level component; where i is a positive integer. If the last level component passes the integrity measurement, it indicates that the entire computing environment is trustworthy, and the offloading card 20 calls the wireless communication module 201 to reliably start the wireless network.

[0118] Newly deployed cloud sites need to send site metadata to the Registration and Discovery Center 103. Optionally, a registration request can be sent to the Registration and Discovery Center 103 in the following two ways.

[0119] In the first method, the registration request sent by the uninstallation card 20 to the registration discovery center 103 also carries identity authentication information; optionally, this identity authentication information can be a digital signature or digital certificate recognized by the registration discovery center 103. After receiving the connection request, the registration discovery center 103 verifies the legitimacy of the identity authentication information; if the identity authentication information passes the verification, it stores the site metadata carried in the registration request.

[0120] In the second method, the uninstallation card 20 sends a connection request to the registration and discovery center 103 based on the wireless network; after receiving the connection request, the registration and discovery center 103 sends an authentication request to the uninstallation card 20 and receives the identity authentication information sent by the uninstallation card 20 according to the authentication request, and verifies the legality of the identity authentication information; if the identity authentication information passes the verification, the registration and discovery center 103 receives the connection request and establishes a communication connection with the uninstallation card 20 based on the connection request; then the uninstallation card 20 sends the registration request to the registration and discovery center 103 based on the communication connection.

[0121] Regarding the second method, upon receiving a connection request, the Registration Discovery Center 103 can first verify the legitimacy of the other party. Only if the other party passes the legitimacy verification will a connection be established and the registration request accepted; otherwise, the connection will be rejected. Similarly, the authentication information here can also be a digital signature or digital certificate recognized by the Registration Discovery Center 103, etc., and this application does not impose any restrictions on it.

[0122] Optionally, SDK module 203 includes configuration SDK 2031, testing SDK 2031, and activation SDK 2031.

[0123] The environment initialization module 202 is used to call the configuration SDK for configuration initialization. This includes initializing a first type of configuration parameter and a second type of configuration parameter. The first type of configuration parameter is related to the cloud site 111 itself, while the second type is related to the central Region 10 that the cloud site 111 interfaces with. In other words, configuration initialization can be divided into configuration initialization related to the cloud site itself and configuration initialization related to the central cloud. Furthermore, from another perspective, configuration initialization can be divided into static configuration initialization, which does not change with the environment, and dynamic configuration initialization, which is related to the environment. Additionally, the environment initialization module 202 is also used to call the probing SDK to perform performance testing on the cloud site 111 after initial configuration to check if it functions correctly; and, after maintenance transition, to call the activation SDK to activate the cloud site 111 from the delivery state to the maintenance transition state.

[0124] The above process completes the initial configuration of the cloud site, making it ready to transition from the delivery phase to the maintenance phase. Figure 3 As shown, after authentication, the cloud site, once transferred to maintenance, is officially managed by the operations and maintenance subsystem 104 and the management subsystem 105. In other words, the operations and maintenance subsystem 104 and the management subsystem 105 are used to manage the cloud site 111 after initial configuration. For example, the operations and maintenance subsystem 104 monitors, responds to, locates, and handles aspects of the cloud site's hardware, software, network, and performance. The management subsystem 10 is responsible for maintaining site metadata and managing the cloud site's lifecycle, including its online and offline processes.

[0125] Optionally, such as Figure 3 As shown, the registration discovery center 103 is also used to send a notification message to the operation and maintenance subsystem 104 and the management subsystem 105; wherein, the notification message is used to instruct the operation and maintenance subsystem 104 and the management subsystem 105 to synchronize the site metadata; or, the operation and maintenance subsystem 104 and the management subsystem 105 are also used to actively obtain the site metadata from the center Region 10, such as actively querying the site metadata they need through a self-discovery mechanism, which is not limited in this application.

[0126] In summary, when the lifecycle of a cloud site changes (such as expiring and going offline), the planning subsystem 101, the operation and maintenance subsystem 104, and the management subsystem 105 can update the corresponding site metadata in a timely manner.

[0127] This application enables the automatic generation of site metadata through a planning subsystem during the production phase. The pre-installed delivery subsystem then utilizes this site metadata to perform network and hardware / software configurations for the cloud site during production. In other words, this application allows for pre-configuration of the cloud site on the production line, meaning the traditional on-site deployment process can be completed beforehand. Furthermore, this application pre-installs a trusted wireless network using offloading technology. During deployment, the wireless network provided by the inserted offloading card automatically and quickly completes the entire initialization process, saving time and effort, and eliminating the need for personnel to enter the business site for initial configuration, thus significantly reducing labor costs. Specifically, because the pre-installed delivery subsystem can pre-compile network and server configurations, install cloud service underlying software and cloud service business components during the production phase, without requiring personnel to enter the business site for initial configuration during deployment, labor costs are greatly reduced.

[0128] In addition, the initialization engine is uninstalled to the uninstallation card through the uninstallation technology. The environment initialization module of the uninstallation card, as the main control module, can automatically orchestrate and schedule the initialization process. The SDK module includes configuration SDK, dial test SDK and activation SDK, which can realize configuration initialization, self-test and activation, thus providing a guarantee for automatic start configuration.

[0129] In addition, the planning subsystem can automatically generate site metadata that can be recognized by the pre-installed delivery subsystem based on the cloud service requirements. This data conversion method ensures that the initial configuration process can proceed smoothly.

[0130] In addition, the uninstallation card is pre-installed with a wireless communication module, which enables trusted booting of wireless networks based on a security chip. This allows the uninstallation card to connect to the registration and discovery center in a reliable manner, providing good security.

[0131] In addition, since this initial configuration method does not depend on the user's network, it also ensures the delivery SLA.

[0132] Optionally, the planning subsystem 101, the pre-installation delivery subsystem 102, the registration and discovery center 103, the operation and maintenance subsystem 104, the management subsystem 105, and the cloud site 111 can all be implemented using software and hardware. For example, the implementation method of the planning subsystem 101 will be described below. Similarly, the implementation methods of the pre-installation delivery subsystem 102, the registration and discovery center 103, the operation and maintenance subsystem 104, and the management subsystem 105 can refer to the implementation method of the planning subsystem 101.

[0133] As an example of a software functional unit, the planning subsystem 101 may include code running on computing instances. These computing instances can be at least one of the following: physical hosts (computing devices), virtual machines, containers, etc. Further, the aforementioned computing devices may be one or more. For example, the planning subsystem 101 may include code running on multiple hosts / virtual machines / containers. These multiple hosts / virtual machines / containers running the code are distributed across a central Region 10. The multiple hosts / virtual machines / containers running the code may be distributed within the same availability zone (AZ) or across different AZs, each AZ comprising one or more geographically proximate data centers. Typically, a Region may include multiple AZs.

[0134] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same VPC or across multiple VPCs. Communication between two VPCs within the same Region requires a communication gateway to be configured within each VPC, enabling interconnection between VPCs.

[0135] As an example of a hardware functional unit, the planning subsystem 101 may include at least one computing device, such as a server. Alternatively, the planning subsystem 101 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0136] The planning subsystem 101 includes multiple computing devices that can be distributed within a central Region 10. These computing devices can be located in the same Availability Zone (AZ) or in different AZs. Similarly, they can be located in the same Virtual Private Cloud (VPC) or in multiple VPCs. These computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0137] Figure 4 This is a flowchart illustrating a cloud site initial configuration method provided in an embodiment of this application. The method is applied to... Figure 1 The distributed cloud system shown includes a central region and locally deployed edge clouds, connected via a network. The central region deploys a planning subsystem, a pre-installed delivery subsystem, a registration and discovery center, an operations and maintenance subsystem, and a management subsystem. The edge clouds deploy cloud sites. Figure 4 As shown, the method includes:

[0138] 401. During the production phase, the planning subsystem acquires cloud service demand information; based on this cloud service demand information, it generates site metadata for the cloud sites to be deployed; wherein, the site metadata is used to indicate the deployment requirements of the cloud site.

[0139] 402. During the production phase, after the hardware required for deploying the cloud site is assembled into the cabinet, the pre-installation delivery subsystem configures the network and hardware and software for the cloud site based on the site's metadata; wherein, the hardware assembled into the cabinet includes a server with an unloading card and a security chip inserted, the security chip storing a hardware root of trust.

[0140] 403. During the deployment phase, in response to the cloud site having completed deployment and power-on in the user's data center after the production phase, the offloading card starts the wireless network based on the hardware trusted root, obtains the site's metadata from the planning subsystem based on the wireless network, and sends a registration request to the registration and discovery center, which carries the site's metadata.

[0141] This application enables the automatic generation of site metadata through a planning subsystem during the production phase. The pre-installed delivery subsystem then utilizes this site metadata to perform network and hardware / software configurations for the cloud site during production. In other words, this application allows for pre-configuration of the cloud site on the production line, meaning the traditional on-site deployment process can be completed beforehand. Furthermore, this application pre-configures a trusted wireless network using offloading technology. During deployment, the wireless network provided by the inserted offloading card automatically and quickly completes the entire initialization process, saving time and effort. It also eliminates the need for personnel to enter the business site for initial configuration, significantly reducing labor costs.

[0142] Optionally, the pre-installed delivery subsystem configures the network and hardware / software for the cloud site based on the site's metadata, including:

[0143] The pre-installed delivery subsystem configures the network for the cloud site based on the site's metadata;

[0144] The pre-installed delivery subsystem configures the cloud site's servers based on the site's metadata;

[0145] The pre-installed delivery subsystem installs the underlying cloud service software and cloud service business components on the server based on the site's metadata.

[0146] Optionally, the uninstallation card includes an environment initialization module and an SDK module; wherein the SDK module includes a configuration SDK, a testing SDK, and an activation SDK; the method further includes:

[0147] The uninstallation card calls the configuration SDK through the environment initialization module to initialize the first type of configuration parameters and the second type of configuration parameters; among them, the first type of configuration parameters are related to the cloud site itself, and the second type of configuration parameters are related to the central region connected to the same cloud site;

[0148] The uninstallation card uses the environment initialization module to call the dial-up testing SDK to perform performance testing on the cloud site.

[0149] The uninstallation card activates the cloud site from the delivery state to the maintenance state by calling the activation SDK through the environment initialization module.

[0150] Optionally, the planning subsystem obtains cloud service demand information; based on this cloud service demand information, it generates site metadata for the cloud site to be deployed, including:

[0151] The planning subsystem acquires cloud service demand information, which includes cloud service orders and engineering survey information; based on this cloud service demand information, it generates site metadata that can be identified by the pre-installed delivery subsystem.

[0152] Optionally, a registration request may be sent to the registration discovery center, including:

[0153] The uninstallation card sends a connection request to the registration and discovery center based on the wireless network;

[0154] Upon receiving the connection request, the Registration Discovery Center sends an authentication request to the Uninstallation Card;

[0155] The registration discovery center receives the identity authentication information sent by the uninstallation card based on the authentication request and verifies the legality of the identity authentication information;

[0156] If the identity authentication information passes verification, the registration discovery center receives the connection request and establishes a communication connection with the uninstallation card based on the connection request.

[0157] The uninstallation card sends the registration request to the registration discovery center based on this communication connection.

[0158] Optionally, a registration request may be sent to the registration discovery center, including:

[0159] The uninstallation card sends the registration request to the registration and discovery center based on the wireless network; the registration request also carries identity authentication information.

[0160] The method further includes: upon receiving the registration request, the registration discovery center verifies the legitimacy of the identity authentication information; if the identity authentication information passes the verification, the registration discovery center stores the site metadata carried in the registration request.

[0161] Optionally, the offloading card includes a wireless communication module; the offloading card establishes a trusted wireless network based on this hardware root of trust, including:

[0162] Integrity measurement of target components on the trusted chain is performed based on the hardware root of trust. The trusted chain starts with the security chip and involves multiple components, which are the hardware and software of the cloud site's server. The target component is located at the next level of the security chip on the trusted chain.

[0163] If the target component passes the integrity measurement, the target component will continue to perform integrity measurements on the next level component.

[0164] And so on, repeating the step of performing integrity measurement on the (i+1)th level component by the i-th level component if the i-th level component passes the integrity measurement, until the last level component; where i is a positive integer;

[0165] With the last-level component passing the integrity metric, the unloading card invokes the wireless communication module to reliably start the wireless network.

[0166] Optionally, the central region also includes an operations and maintenance subsystem and an administration subsystem; the operations and maintenance subsystem and the administration subsystem are used to manage cloud sites after initial configuration.

[0167] The method also includes:

[0168] The registration discovery center sends a notification message to the operations and maintenance subsystem and the management subsystem; the notification message is used to instruct the operations and maintenance subsystem and the management subsystem to synchronize the site's metadata; or, the operations and maintenance subsystem and the management subsystem actively obtain the site's metadata from the central Region.

[0169] All of the above-mentioned optional technical solutions can be combined in any way to form optional embodiments of this disclosure.

[0170] This application also provides a computing device 500. For example... Figure 5 As shown, the computing device 500 includes a bus 502, a processor 504, a memory 506, and a communication interface 508. The processor 504, the memory 506, and the communication interface 508 communicate with each other via the bus 502. The computing device 500 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 500.

[0171] Bus 502 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 5 The bus 502 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 502 may include a path for transmitting information between various components of the computing device 500 (e.g., memory 506, processor 504, communication interface 508).

[0172] Processor 504 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0173] Memory 506 may include volatile memory, such as random access memory (RAM). Processor 504 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0174] The memory 506 stores executable program code, which the processor 504 executes to implement the functions of the aforementioned planning subsystem 101, pre-installation delivery subsystem 102, registration and discovery center 103, operation and maintenance subsystem 104, management subsystem 105, or cloud site 111, thereby implementing the cloud site's initial configuration method. In other words, the memory 506 stores instructions for executing the cloud site's initial configuration method.

[0175] The communication interface 508 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 500 and other devices or communication networks.

[0176] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0177] like Figure 6 As shown, the computing device cluster includes at least one computing device 500. Optionally, the memory 506 in one or more computing devices 500 in the computing device cluster may store the same instructions for executing the initial configuration method of the cloud site.

[0178] Optionally, the memory 506 of one or more computing devices 500 in the computing device cluster may each store a portion of the instructions for executing the initial configuration method of the cloud site. In other words, a combination of one or more computing devices 500 can jointly execute the instructions for executing the initial configuration method of the cloud site.

[0179] Optionally, the memory 506 in different computing devices 500 within the computing device cluster can store different instructions, which are used to execute parts of the aforementioned planning subsystem 101, pre-installation delivery subsystem 102, registration and discovery center 103, operation and maintenance subsystem 104, management subsystem 105, or cloud site 111. That is, the instructions stored in the memory 506 of different computing devices 500 can implement the functions of one or more parts of the aforementioned planning subsystem 101, pre-installation delivery subsystem 102, registration and discovery center 103, operation and maintenance subsystem 104, management subsystem 105, or cloud site 111.

[0180] Optionally, one or more computing devices in the computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc.

[0181] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform a cloud site initial configuration method.

[0182] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium, or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute a cloud site initialization configuration method.

[0183] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items that have substantially the same function and purpose. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor does it limit the quantity or execution order. It should also be understood that although the following description uses the terms "first," "second," etc., to describe various elements, these elements should not be limited by the terms. These terms are merely used to distinguish one element from another. For example, without departing from the various examples described, a first model can be referred to as a second model, and similarly, a second model can be referred to as a first model. Both the first and second models can be models, and in some cases, they can be separate and distinct models.

[0184] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple servers means two or more servers.

[0185] It should also be understood that the term "if" can be interpreted as meaning "when or upon" or "in response to determination" or "in response to detection." Similarly, depending on the context, the phrases "if determination..." or "if detection [the stated condition or event]" can be interpreted as meaning "when determination..." or "in response to determination..." or "when detection [the stated condition or event]" or "in response to detection [the stated condition or event]."

[0186] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0187] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer program instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0188] The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer program instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media such as digital video discs (DVDs), or semiconductor media (e.g., solid-state drives).

[0189] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0190] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A distributed cloud system, characterized in that, The distributed cloud system includes a central region and locally deployed edge clouds, with the central region and the edge clouds connected via a network; the central region is equipped with a planning subsystem, a pre-installed delivery subsystem, and a registration and discovery center; the edge clouds are equipped with cloud sites. During the production phase, the planning subsystem is used to obtain cloud service demand information; Based on the cloud service requirement information, site metadata for the cloud site to be deployed is generated; wherein, the site metadata is used to indicate the deployment requirements of the cloud site; During the production phase, the pre-installed delivery subsystem is used to assemble hardware into a cabinet in response to the deployment of the cloud site, and to configure the network and hardware and software for the cloud site according to the site metadata; wherein, the hardware assembled into the cabinet includes a server with an unloading card and a security chip inserted, and the security chip stores a hardware root of trust. During the deployment phase, the offloading card is used to respond to the cloud site, which has completed the production phase, being deployed and powered on in the user's data center, to establish a trusted wireless network based on the hardware trusted root, to obtain the site metadata from the planning subsystem based on the wireless network, and to send a registration request to the registration and discovery center, the registration request carrying the site metadata.

2. The system according to claim 1, characterized in that, The pre-installed delivery subsystem is used to configure the cloud site's network based on the site's metadata, configure the cloud site's server, and install the cloud service underlying software and cloud service business components on the server.

3. The system according to claim 1, characterized in that, The uninstallation card includes an environment initialization module and a software development kit (SDK) module; wherein, the SDK module includes a configuration SDK, a testing SDK, and an activation SDK; The environment initialization module is used to call the configuration SDK to initialize the first type of configuration parameters and the second type of configuration parameters; wherein, the first type of configuration parameters are related to the cloud site itself, and the second type of configuration parameters are related to the central Region that interfaces with the cloud site; The environment initialization module is used to call the test SDK to perform performance tests on the cloud site. The environment initialization module is used to call the activation SDK to activate the cloud site from the delivery state to the maintenance state.

4. The system according to claim 1, characterized in that, The planning subsystem is used to acquire cloud service demand information; based on the cloud service demand information, it generates site metadata that can be identified by the pre-installed delivery subsystem; wherein, the cloud service demand information includes cloud service orders and engineering survey information.

5. The system according to claim 1, characterized in that, The uninstallation card is used to send a connection request to the registration and discovery center based on the wireless network; The registration discovery center is used to send an authentication request to the uninstallation card after receiving the connection request; receive the identity authentication information sent by the uninstallation card according to the authentication request, and verify the legality of the identity authentication information; if the identity authentication information passes the verification, receive the connection request and establish a communication connection with the uninstallation card based on the connection request. The uninstallation card is used to send the registration request to the registration discovery center based on the communication connection.

6. The system according to claim 1, characterized in that, The uninstallation card is used to send the registration request to the registration discovery center based on the wireless network; wherein, the registration request also carries identity authentication information; The registration discovery center is used to verify the legitimacy of the identity authentication information after receiving the registration request; if the identity authentication information passes the verification, it stores the site metadata carried in the registration request.

7. The system according to claim 1, characterized in that, The unloading card includes a wireless communication module; The offloading card is used to perform integrity measurement on the target component on the trusted chain based on the hardware root of trust; if the target component passes the integrity measurement, the target component continues to perform integrity measurement on the next level component; And so on, repeating the step of performing integrity measurement on the (i+1)th level component by the i-th level component when the i-th level component passes the integrity measurement, until the last level component; where i is a positive integer; when the last level component passes the integrity measurement, the offloading card is used to call the wireless communication module to reliably start the wireless network; The trusted chain starts from the security chip and involves multiple components, which are the hardware and software of the server. The target component is located at the next level of the security chip on the trusted chain.

8. The system according to claim 1, characterized in that, The central region also includes an operations and maintenance subsystem and a management subsystem; the operations and maintenance subsystem and the management subsystem are used to manage the cloud site after initial configuration; The registration and discovery center is also used to send notification messages to the operations and maintenance subsystem and the management subsystem; wherein, the notification message is used to instruct the operations and maintenance subsystem and the management subsystem to synchronize the site metadata; or, The operation and maintenance subsystem and the management subsystem are also used to actively obtain the site metadata from the central Region.

9. A method for initial configuration of a cloud site, characterized in that, This is applied to a distributed cloud system, which includes a central region and locally deployed edge clouds, with the central region and the edge clouds connected via a network; the central region is equipped with a planning subsystem, a pre-installed delivery subsystem, and a registration and discovery center. The edge cloud is deployed with cloud sites; the method includes: During the production phase, the planning subsystem acquires cloud service demand information; based on the cloud service demand information, it generates site metadata for cloud sites to be deployed; wherein, the site metadata is used to indicate the deployment requirements of the cloud sites; During the production phase, after the hardware required for deploying the cloud site is assembled into the cabinet, the pre-installed delivery subsystem configures the network and hardware and software for the cloud site according to the site metadata; wherein, the hardware assembled into the cabinet includes a server with an unloading card and a security chip inserted, and the security chip stores a hardware root of trust. During the deployment phase, in response to the cloud site having completed deployment and power-on in the user's data center after the production phase, the offloading card establishes a trusted wireless network based on the hardware trusted root, obtains the site metadata from the planning subsystem based on the wireless network, and sends a registration request to the registration and discovery center, the registration request carrying the site metadata.

10. The method according to claim 9, characterized in that, The pre-installed delivery subsystem configures the network and hardware / software for the cloud site based on the site metadata, including: The pre-installed delivery subsystem configures the network of the cloud site based on the site metadata; The pre-installed delivery subsystem configures the cloud site's server based on the site metadata; The pre-installed delivery subsystem installs the underlying cloud service software and cloud service business components on the server based on the site metadata.

11. The method according to claim 9, characterized in that, The uninstallation card includes an environment initialization module and a software development kit (SDK) module; wherein, the SDK module includes a configuration SDK, a testing SDK, and an activation SDK; the method further includes: The uninstallation card calls the configuration SDK through the environment initialization module to initialize the first type of configuration parameters and the second type of configuration parameters; wherein, the first type of configuration parameters are related to the cloud site itself, and the second type of configuration parameters are related to the central Region that is connected to the cloud site; The uninstallation card calls the test SDK through the environment initialization module to perform performance testing on the cloud site. The uninstallation card activates the cloud site from the delivery state to the maintenance state by calling the activation SDK through the environment initialization module.

12. The method according to claim 9, characterized in that, The planning subsystem acquires cloud service demand information; Based on the cloud service requirement information, generate site metadata for the cloud site to be deployed, including: The planning subsystem acquires cloud service demand information; wherein, the cloud service demand information includes cloud service orders and engineering survey information; The planning subsystem generates site metadata that can be recognized by the pre-installed delivery subsystem based on the cloud service requirement information.

13. The method according to claim 9, characterized in that, Sending a registration request to the registration discovery center includes: The uninstallation card sends a connection request to the registration and discovery center based on the wireless network; Upon receiving the connection request, the registration discovery center sends an authentication request to the uninstallation card. The registration discovery center receives the identity authentication information sent by the uninstallation card according to the authentication request, and verifies the legality of the identity authentication information; If the identity authentication information passes verification, the registration discovery center receives the connection request and establishes a communication connection with the uninstallation card based on the connection request; The uninstallation card sends the registration request to the registration discovery center based on the communication connection.

14. The method according to claim 9, characterized in that, Sending a registration request to the registration discovery center includes: The uninstallation card sends the registration request to the registration discovery center based on the wireless network; wherein, the registration request also carries identity authentication information; The method further includes: Upon receiving the registration request, the registration discovery center verifies the legitimacy of the identity authentication information; If the identity authentication information passes verification, the registration discovery center stores the site metadata carried in the registration request.

15. The method according to claim 9, characterized in that, The offloading card includes a wireless communication module; the offloading card establishes a trusted wireless network based on the hardware trusted root, including: Integrity measurement is performed on the target component on the trusted chain based on the hardware root of trust; wherein the trusted chain starts from the security chip and involves multiple components, the multiple components being the hardware and software of the server, and the target component is located at the next level below the security chip on the trusted chain; If the target component passes the integrity measurement, the target component will continue to perform integrity measurement on the next level component. And so on, repeating the step of performing integrity measurement on the (i+1)th level component by the i-th level component when the i-th level component passes the integrity measurement, until the last level component; where i is a positive integer; Upon successful integrity measurement of the last-level component, the offloading card invokes the wireless communication module to reliably start the wireless network.

16. The method according to claim 9, characterized in that, The central region also includes an operations and maintenance subsystem and a management subsystem; the operations and maintenance subsystem and the management subsystem are used to manage the cloud site after initial configuration; The method further includes: The registration and discovery center sends a notification message to the operations and maintenance subsystem and the management subsystem; wherein, the notification message is used to instruct the operations and maintenance subsystem and the management subsystem to synchronize the site metadata; or, The operation and maintenance subsystem and the management subsystem actively obtain the site metadata from the central Region.

17. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform the cloud site initial configuration method as described in any one of claims 9-16.

18. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a computing device cluster, enable the cloud site initial configuration method as described in any one of claims 9-16.

Images