A method and device for accessing computing resources of an intelligent computing center

Abstract

The present application relates to the technical field of computing power infrastructure, and provides a computing power resource access method and device of an intelligent computing center, the method comprising: step S1: receiving a user's access instruction, the access instruction is used to indicate the target computing power resource that the user wants to access, the access instruction carries the user's access token, and the access token carries the user's identity information; step S2: performing a hash operation on the access token to obtain a hash value to be verified corresponding to the access token; step S3: judging whether the first condition is met, if so, executing step S4; if not, executing step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value; step S4: verifying whether the user has the authority to access the target computing power resource based on the user's identity information; step S5: denying the user access to the target computing power resource. Thus, the computing power resources of the intelligent computing center can be effectively managed and protected, and the overall security of the intelligent computing center is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computing power infrastructure technology, and in particular, to a computing power resource access method and device for an intelligent computing center. Background Art

[0002] With the development of artificial intelligence technology and computing power technology, the concept of intelligent computing center has emerged. "Intelligent computing center" refers to the use of large-scale heterogeneous computing power resources, including general computing power and intelligent computing power, mainly for artificial intelligence applications (such as artificial intelligence deep learning model development, model training and model reasoning and other scenarios) to provide the required computing power, data and algorithms. Intelligent computing center covers facilities, hardware, software, and can provide full-stack capabilities from bottom-level computing power to top-level application enablement.

[0003] The identity authentication mechanism is a core component of the intelligent computing center. It is not only related to the access control of the computing resources of the intelligent computing center, but also the first line of defense to prevent unauthorized information access and protect the intelligent computing center from attacks. In the intelligent computing center, if there is a lack of such a mechanism, it means that the basic security threshold does not exist, which makes the intelligent computing center face various security threats, including but not limited to data theft, denial of service attacks, and malware implantation.

[0004] Therefore, building an identity authentication framework for the intelligent computing center has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a computing resource access method and device for an intelligent computing center to solve the technical problem that the intelligent computing center is currently facing various security threats due to the lack of an identity authentication mechanism.

[0006] In order to solve the above technical problems, this application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for accessing computing resources of an intelligent computing center, the method comprising:

[0008] Step S1: receiving an access instruction from a user, wherein the access instruction is used to indicate the target computing resource that the user needs to access, the access instruction carries the access token of the user, and the access token carries the identity information of the user;

[0009] Step S2: performing a hash operation on the access token to obtain a hash value to be verified corresponding to the access token;

[0010] Step S3: Determine whether the first condition is met. If the first condition is met, execute step S4; if the first condition is not met, execute step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value;

[0011] Step S4: Verify whether the user has the authority to access the target computing resources according to the identity information of the user;

[0012] Step S5: Deny the user access to the target computing resources.

[0013] Optionally, before step S1, the method further includes:

[0014] Step S01: receiving an access token creation instruction input by a user, wherein the access token creation instruction is used to determine at least one of the following contents: a name of the access token, an expiration timestamp of the access token, and a scope of the access token;

[0015] Step S02: creating the access token for the user according to the access token creation instruction;

[0016] Step S03: Generate and store the reference hash value locally in the intelligent computing center based on the user's identity information and the expiration timestamp.

[0017] Optionally, the access token is a string, which includes: the user's identity information, an expiration timestamp, and a digital signature, wherein the digital signature is obtained by performing a hash operation on the user's identity information and the expiration timestamp to obtain the baseline hash value, and then encrypting the baseline hash value using a first key.

[0018] Optionally, step S3 further includes:

[0019] Step S31: decrypt the digital signature using the second key to obtain the reference hash value.

[0020] Optionally, the first condition also includes: the current time is earlier than the expiration timestamp.

[0021] Optionally, the first condition also includes: the access token has not been recalled.

[0022] Optionally, step S4 includes:

[0023] Step S41: Determine the user's authorized computing resource list according to the user's identity information;

[0024] Step S42: Determine whether the target computing power resource is in the list of authorized computing power resources; if so, determine that the user has the authority to access the target computing power resource, and allow the user to access the target computing power resource according to the access instruction; if not, determine that the user does not have the authority to access the target computing power resource, and deny the user access to the target computing power resource.

[0025] In a second aspect, an embodiment of the present application provides a computing resource access device for an intelligent computing center, wherein a device receiving module is used to receive an access instruction of a user, wherein the access instruction is used to indicate a target computing resource that the user needs to access, and the access instruction carries an access token of the user, and the access token carries identity information of the user;

[0026] An execution module, configured to perform a hash operation on the access token to obtain a hash value to be verified corresponding to the access token;

[0027] Determine whether the first condition is met, if the first condition is met, execute step S4; if the first condition is not met, execute step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value;

[0028] Verify, based on the user's identity information, whether the user has the authority to access the target computing resources;

[0029] Deny the user access to the target computing resource.

[0030] In a third aspect, an embodiment of the present application provides an electronic device comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of a method for accessing computing power resources of an intelligent computing center as described in the first aspect are implemented.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a method for accessing computing power resources of an intelligent computing center as described in the first aspect are implemented.

[0032] In a fifth aspect, an embodiment of the present application provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of a method for accessing computing power resources of an intelligent computing center as described in the first aspect.

[0033] In the embodiments of the present application, by combining hash operations and access tokens, the security of identity authentication and the immutability of data are ensured; by verifying user permissions, it is ensured that only authorized users can access specific computing resources, thereby reducing the risks brought by unauthorized users accessing computing resources; and a reasonable permission verification mechanism can prevent improper or excessive use of computing resources; through identity authentication and access control processes, the intelligent computing center can effectively manage and protect its own computing resources to create a safe and compliant operating environment, thereby improving the overall security of the intelligent computing center. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0035] Figure 1 A flowchart of a method for accessing computing resources of an intelligent computing center provided in an embodiment of the present application;

[0036] Figure 2 A schematic diagram of a process for issuing an access token provided in an embodiment of the present application;

[0037] Figure 3 A schematic diagram of components of an access token provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of an interface for a user to create an access token provided in an embodiment of the present application;

[0039] Figure 5 A structural block diagram of a computing resource access device for an intelligent computing center provided in an embodiment of the present application;

[0040] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] The following is a brief description of the technical terms involved in this application.

[0043] The "computing power" mentioned in this application is the ability of computer equipment or computing / data center to process information. It is the ability of computer hardware and software to work together to perform certain computing needs. It is the computing power to achieve target result output by processing information data. It is a new type of productivity that integrates information computing power, network carrying capacity, and data storage capacity. It mainly provides services to society through computing power infrastructure.

[0044] The "computing power (CP)" mentioned in this application is the ability of a data center server to process data and output results. It is a comprehensive indicator for measuring the computing power of a data center, including general computing power, supercomputing power, and intelligent computing power. The commonly used unit of measurement is the number of floating point operations per second (Floating Point Operations Per Second, FLOPS, where 1EFLOPS=10^18 FLOPS). The larger the value, the stronger the comprehensive computing power. The calculation formula is: CP=CP 通用 +CP 智能 +CP 超级 In the embodiment of the present application, the computing power adopts the half-precision floating point computing power (FP16) of the graphics card.

[0045] The "Network Power" (NP) described in this application is a manifestation of the data transmission capability of computing facilities, including comprehensive capabilities such as network architecture, network bandwidth, transmission latency, intelligent management and scheduling. Carrying capacity involves network transmission within and between data centers, and is a comprehensive indicator for measuring network transmission scheduling capabilities. In the embodiment of this application, carrying capacity uses video memory bandwidth. In the embodiment of this application, storage capacity uses video memory bandwidth.

[0046] The "Storage Power" (SP) described in this application refers to the comprehensive capabilities of a data center in terms of data storage capacity, performance, safety and reliability, and green and low-carbon. It is a comprehensive indicator for measuring the data storage capacity of a data center, including external storage devices such as storage arrays and server built-in storage devices. The commonly used unit of measurement for storage capacity is exabyte (EB, 1EB=2^60bytes), and the commonly used unit of measurement for performance is the number of reads and writes per second per unit capacity (IOPS / TB, Input / Output Operations Per Second / TB). The disaster recovery ratio is an important manifestation of safety and reliability. In the embodiment of this application, storage power refers to video memory capacity.

[0047] The "computing power infrastructure" described in this application is a new type of information infrastructure that integrates information computing power, network carrying capacity, and data storage capacity. It can realize centralized computing, storage, transmission and application of information, and presents characteristics such as diversity and ubiquity, intelligence and agility, security and reliability, green and low-carbon. It is of great significance to promote industrial transformation and upgrading, enable my country's scientific and technological innovation, meet people's better life and achieve high-efficiency social governance.

[0048] The “computing power” mentioned in this application includes general computing power CP 通用 、Intelligent computing power CP 智能 And super computing power CP 超级 .

[0049] The "general computing power" mentioned in this application refers to the computing power provided by servers based on CPU chips, which is used to support basic general computing such as cloud computing and edge computing.

[0050] The "intelligent computing power" mentioned in this application refers to the large-scale deployment of intelligent computing centers based on special chips such as GPU (Graphics Processing Unit), FPGA (Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit) for various innovative artificial intelligence applications, such as natural language processing, machine vision, etc.

[0051] The "supercomputing power" mentioned in this application is mainly the computing power provided by high-performance computing clusters such as supercomputers. It utilizes the centralized computing resources of multiple computer systems working in parallel and uses a dedicated operating system to handle extremely complex or data-intensive problems. It is mainly used for calculations in cutting-edge scientific fields, such as planetary simulation, drug molecule design, and gene analysis.

[0052] The "intelligent computing center" mentioned in this application refers to a facility that provides the required computing power, data and algorithms for artificial intelligence applications (such as artificial intelligence deep learning model development, model training and model reasoning) by using large-scale heterogeneous computing resources, including general computing power (CPU) and intelligent computing power (GPU, FPGA, ASIC, etc.). The intelligent computing center covers facilities, hardware, and software, and can provide full-stack capabilities from bottom-level computing power to top-level application enablement.

[0053] The "computing resources" mentioned in this application refer to technologies and facilities with information computing, transmission, storage and application capabilities required for the development of a digital society, including but not limited to computing resources such as CPUs and GPUs, network resources such as switches and routers, storage resources such as storage arrays and distributed storage, security resources such as firewalls and intrusion detection systems, and supporting and guarantee resources such as wind, fire, water and electricity.

[0054] The "access token" described in this application is generally a digital certificate used to verify the identity of the user and authorize the user to access system or network resources. In the method shown in the embodiment of this application, the access token is used to authorize the user to access the computing resources of the intelligent computing center. These tokens serve as a key part of the identity authentication and authorization process. For example, access tokens are widely used in cloud services, APIs (Application Programming Interfaces), and network applications to manage user access rights to different services.

[0055] An access token is a data structure specific to the security domain. It usually contains multiple key information parts, such as user identity, permissions, scope, expiration time, etc. Access tokens are usually implemented in string form. Access tokens usually include the following parts: Header: Usually contains information about the type and encryption algorithm used by the token. Payload: Contains a series of claims, which can include information such as user identification, token issuer, expiration time, and token scope. Signature: Used to verify the integrity of the token and that it has not been tampered with.

[0056] Please refer to Figure 1 , Figure 1 A method for accessing computing resources of an intelligent computing center according to an embodiment of the present application is shown. Figure 1 As shown, the method includes:

[0057] Step S1: receiving a user's access instruction;

[0058] The access instruction is used to indicate the target computing resource that the user needs to access. The access instruction carries the user's access token, and the access token carries the user's identity information.

[0059] Step S2: Perform a hash operation on the access token to obtain a hash value to be verified corresponding to the access token;

[0060] Step S3: Determine whether the first condition is met. If the first condition is met, execute step S4; if the first condition is not met, execute step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value;

[0061] Step S4: Verify whether the user has the authority to access the target computing resources based on the user's identity information;

[0062] Step S5: Deny the user access to the target computing resources.

[0063] In step S1, the intelligent computing center first receives an access request from the user, which is usually implemented through a network interface or API call. The access instruction contains an important security element - the access token. This access token is sent to the user by the intelligent computing center in advance through a certain registration or login process, and contains encrypted user identity information (such as user ID, user name, permission level, etc.). The access token is usually generated using encryption technology to ensure its security and cannot be easily cracked or forged.

[0064] In a possible implementation, before step S1, the method further includes:

[0065] Step S01: receiving an access token creation instruction input by a user, wherein the access token creation instruction is used to determine at least one of the following contents: a name of the access token, an expiration timestamp of the access token, and a scope of the access token;

[0066] Step S02: Create an access token for the user according to the access token creation instruction;

[0067] Step S03: Generate and store a reference hash value locally in the intelligent computing center based on the user's identity information and expiration timestamp.

[0068] This possible implementation provides a pre-access token generation and distribution mechanism for the entire access control process, further enhancing the security and flexibility of the intelligent computing center. Specifically, in this possible implementation, Figure 2As shown in the figure, the intelligent computing center first receives the access token creation instruction from the user. The access token creation instruction is mainly used to define the specific attributes of the access token, including: token name: to help users identify and manage different tokens; expiration timestamp: to determine the validity period of the token (the expiration timestamp is a key security feature that ensures that the token automatically expires after a certain period of time to prevent long-term unmodified tokens from being abused); token scope: to define the scope of use of the token. For example, the access token may only authorize access to specific computing resources or perform specific operations. Users can submit this information through a secure interface, and the intelligent computing center generates the corresponding access token based on these specified parameters. After that, based on the access token creation instruction provided by the user, the intelligent computing center generates a new access token. Once the access token is created, the intelligent computing center will send it to the user's client (such as the user's browser or application). The sending process also needs to ensure security, usually through an encrypted communication channel. In addition, the intelligent computing center generates a base hash value of the token locally (i.e., on the server of the intelligent computing center) based on the user's identity information and the expiration timestamp of the token, and stores this hash value. The base hash value is used to verify the validity of the incoming access token in the subsequent access control process.

[0069] In addition, it should be noted that a user can generate multiple access tokens, each with its own scope. Therefore, by setting the expiration time and scope for each access token, access rights can be finely controlled; users can create different tokens as needed to achieve customized access to different services or computing resources; the intelligent computing center can more effectively manage and control user access to its computing resources, thereby improving overall security and controllability of operations.

[0070] In step S2, hash operation is a process of processing an input of arbitrary length (such as an access token) through a function and outputting a string of fixed length. The key advantage of this method is its one-way nature, that is, it is almost impossible to derive the original input data given a hash value. In step S2, the intelligent computing center performs a hash operation on the received access token to generate a unique hash value, which will be used in the next step to compare with the reference hash value stored in the intelligent computing center to verify the validity of the token. The intelligent computing center does not record the user's access token, but the hash value, and the user only records and saves the access token when the access token is generated to avoid the risk of access token leakage.

[0071] In step S3, the first condition is to check whether the hash value generated in step S2 is consistent with the reference hash value pre-stored in the intelligent computing center and generated for the valid access token. This step is a key link in security verification, which ensures that the token being requested for access is issued by the intelligent computing center and has not been tampered with. If the two hash values ​​match, it means that the access token is valid and the user's request can be further processed; if they do not match, it may mean that the access token has been tampered with or forged, and the intelligent computing center will directly reject the access request.

[0072] In one possible implementation, the access token is a string, which includes: user identity information, expiration timestamp and digital signature, wherein the digital signature is obtained by performing a hash operation on the user's identity information and the expiration timestamp to obtain a base hash value, and then encrypting the base hash value using a first key.

[0073] In a possible implementation, step S3 also includes: step S31: decrypting the digital signature using the second key to obtain a reference hash value.

[0074] It should be noted that the optional components of the access token are: user identity information, expiration timestamp, and digital signature. Figure 3 As shown, AccessToken consists of three parts: code (user identity information), expire (expiration timestamp) and sign (digital signature).

[0075] User identity information: User identity information contains information that can uniquely identify the user, such as the user's username, user ID, or other specific identifiers. This information is the basis for verifying the user's identity, ensuring that the token is associated with a specific user, and this part is also used to identify the computing resources that the user can access (for example: the list of computing resources that the user is authorized to access).

[0076] Expiration timestamp: The expiration timestamp defines the validity period of the access token, that is, when the token becomes no longer valid, to limit the long-term use of the access token and reduce the risk of the access token being stolen or misused.

[0077] Digital signature: A digital signature is an encryption element that guarantees the integrity and authenticity of the access token. The signing process involves several key steps, including hashing and key encryption. First, the intelligent computing center hashes the user's identity information and expiration timestamp together. Hash operation is a process of converting data into a fixed-length output, and the output here is called a "baseline hash value" in the method shown in the embodiment of this application. Hash algorithms (such as SHA-256) ensure that even small changes in data will produce significant differences in the hash value, which helps prevent tampering. After obtaining the base hash value, the intelligent computing center encrypts the hash value using a "first key". This first key is usually a private key that is only known to the system and is not disclosed to the public. The encryption process adds an important level of security by ensuring that only entities with the corresponding public key can verify the authenticity of the signature. The encrypted result is a digital signature, which is included in the access token. When the token is used for an access request, the intelligent computing center will decrypt the digital signature using the public key paired with the first key to restore the base hash value. Afterwards, the Intelligent Computing Center performs a hash operation on the submitted user identity information and expiration timestamp again to obtain a new hash value. If this new hash value matches the reference hash value obtained by decrypting the digital signature, it means that the access token has not been tampered with and is valid. Therefore, this verification process ensures the authenticity of the access token and the integrity of the data. Only when the data has not been tampered with and the digital signature is legal, the Intelligent Computing Center allows access requests based on the access token. Through such a design, the access token provides a mechanism to protect the computing resource access of the Intelligent Computing Center, effectively preventing unauthorized access and data tampering, and ensuring the security and reliability of the Intelligent Computing Center.

[0078] In a possible implementation, the first condition further includes: the current time is earlier than the expiration timestamp. The first condition further includes: the access token has not been recalled.

[0079] The above two situations can be used either or together. In the first case, it is necessary to ensure that the access token is used within its validity period. The Intelligent Computing Center will check whether the current time is earlier than the expiration timestamp defined in the token. If the current time is later than the expiration timestamp, the access token is considered to have expired and is no longer valid. The Intelligent Computing Center will reject the access request. This mechanism prevents the abuse of expired tokens and enhances the security of the system. In the second case, access token recall is an important mechanism in security management. When security issues (such as token leakage) are discovered, the administrator can proactively invalidate some or all issued access tokens. When processing access requests, the Intelligent Computing Center will check whether the access token is marked as recalled. If an access token has been recalled, the system will reject the access request for the token even if other conditions are met. This step is to respond to possible security threats or abnormal behaviors and ensure that the computing resources of the Intelligent Computing Center can be protected even after the token is leaked.

[0080] Therefore, combined with Figure 1 The method shown, the two optional implementation methods of the first condition and their related verification conditions together constitute a comprehensive security check mechanism for the intelligent computing center, which not only verifies the authenticity and integrity of the access token, but also ensures the timeliness and validity of the access token when used. These security measures work together to greatly improve the security level of the intelligent computing center's access control to computing resources, effectively prevent unauthorized access and possible security vulnerabilities, and ensure the correct and safe use of computing resources.

[0081] In step S4, once the access token is deemed valid, the next step is to determine whether the user has sufficient permissions to access the target computing resources based on the user identity information contained in the access token.

[0082] In one possible implementation, step S4 includes: step S41: determining the user's authorized computing power resource list based on the user's identity information; step S42: judging whether the target computing power resource is in the authorized computing power resource list; if so, determining that the user has the authority to access the target computing power resource, and allowing the user to access the target computing power resource according to the access instruction; if not, determining that the user does not have the authority to access the target computing power resource, and denying the user access to the target computing power resource.

[0083] It should be noted that the intelligent computing center will check whether the target computing resource that the user requests to access is included in the list of authorized computing resources. This judgment is usually made by comparing the identifiers of the computing resources (such as resource names, etc.). If the target resource is in the user's authorized computing resource list, it means that the user has the right to access this computing resource, and the intelligent computing center will allow the user to access the computing resource in accordance with the user's access instructions; if the target computing resource is not in the user's authorized computing resource list, the intelligent computing center will determine that the user does not have the authority to access the computing resource and reject the user's access request accordingly. Therefore, by precisely controlling who can access what computing resources, the intelligent computing center can avoid potential security risks and promote the rational use and management of computing resources.

[0084] In step S5, if the user's access token is invalid or the user does not have sufficient authority to access the requested computing resources, access is denied, ensuring that computing resources are only open to verified and authorized users, thereby protecting the computing resources of the intelligent computing center from being accessed by unauthorized users to avoid possible security threats.

[0085] In summary, the computing power resource access method of the intelligent computing center provided in the embodiment of the present application constitutes a comprehensive identity authentication and authorization process, ensuring that only legitimate and authorized users can access the computing power resources of the intelligent computing center. This method utilizes encryption technology, hash operations and detailed permission checks to effectively improve the security of the entire system and ensure the compliance of operations. It also prevents the abuse of computing power resources and potential data leakage. Through such a process, the intelligent computing center can strengthen security protection measures while maintaining efficient operations.

[0086] like Figure 4 As shown, Figure 4 The following is a schematic diagram of the interface for users to create access tokens. The creation of access tokens can follow the following aspects:

[0087] 1. After a new access token is generated, the original access token is no longer accessible. After refreshing the page or revisiting the page, the original access token will no longer be displayed. In other words, after a new access token is generated, the system will invalidate the previous access token, which means that if a user generates a new access token in the same session, the previous access token can no longer be used to access computing resources. This can increase the security of the intelligent computing center and prevent the abuse of old access tokens.

[0088] 2. After generating an access token, you can enter the name and expiration date of the access token again on the current page. After submission, a new access token will be added. In other words, users can enter information (such as name and expiration date) multiple times on the same interface to generate multiple access tokens. After each submission, the Intelligent Computing Center will create a new access token, which provides operational flexibility and allows users to manage multiple access tokens as needed.

[0089] 3. Access tokens deleted from the personal access token list will become invalid.

[0090] 4. For example, the name of the access token cannot be repeated, and can support numbers, letters, Chinese characters, ".", "-", "_", "space", etc. It can only support Chinese characters and letters at the beginning, and an error will be reported when other characters are entered. There are the following two situations: the first character can only be letters and Chinese characters. When the first character entered is other symbols, it can be prompted: "Only Chinese characters and letters at the beginning are supported"; Intermediate character verification, when it does not meet the character requirements, it will be prompted: "Only numbers, letters, Chinese characters, underscores, hyphens, decimal points and spaces are supported".

[0091] 5. The expiration time of the access token is accurate to the day. By default, it is set to expire at 24:00 on the same day. This means that if an access token is set to expire on a certain day, it will expire at 24:00 on that day, providing users with a full day of usage time.

[0092] 6. If a user is deleted or disabled, the access token created by the user will become invalid, and the user cannot create a new access token. Moreover, after the disabled user is re-enabled, the original access token generated will be deleted. In other words, if the user status changes from disabled to re-enabled, all previously generated access tokens will not be restored, and the user will need to re-create a new access token. This can avoid security issues that may occur during the user's disabled period and affect the stable operation of the intelligent computing center.

[0093] It should be noted that the above six methods are only used as an exemplary description and do not constitute a limitation on the method of creating an access token provided in the embodiment of the present application. Users can flexibly create access tokens according to actual needs while meeting security requirements.

[0094] It should be noted that the computing resource access method of the intelligent computing center shown in the embodiment of the present application can adopt a secondary cache mechanism. In a specific application scenario, assuming that Jarvex is the central end of the intelligent computing center and apisix is ​​the edge end of the intelligent computing center, the Jarvex end can be responsible for issuance, and the specific authentication and model call can be performed on the apisix end. For example, the inference model can be called, that is, the model can be used directly; Alaya Studio can also be called, that is, the model can be combined with a specific application scenario, such as a ticket booking scenario. By adopting a secondary cache mechanism, an access token can be generated and issued at the central end of the intelligent computing center, and each branch intelligent computing center, that is, the edge end, performs a specific authentication and model call process. As a result, the data access performance and the response speed of the intelligent computing center can be significantly improved. By caching data at different levels, the average processing time of each data request can be effectively reduced, network latency can be reduced, and the burden on the main server of the intelligent computing center can be reduced.

[0095] Please refer to Figure 5 , Figure 5 A computing resource access device for an intelligent computing center provided according to an embodiment of the present application is shown. Figure 5 As shown, the device 50 includes:

[0096] The receiving module 51 is used to receive an access instruction from a user, wherein the access instruction is used to indicate the target computing resource that the user needs to access, and the access instruction carries the access token of the user, and the access token carries the identity information of the user;

[0097] An execution module 52 is used to perform a hash operation on the access token to obtain a hash value to be verified corresponding to the access token;

[0098] Determine whether the first condition is met, if the first condition is met, execute step S4; if the first condition is not met, execute step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value;

[0099] Verify, based on the user's identity information, whether the user has the authority to access the target computing resources;

[0100] Deny the user access to the target computing resource.

[0101] In a possible implementation, the execution module 52 is further used to receive an access token creation instruction input by a user, wherein the access token creation instruction is used to determine at least one of the following: a name of the access token, an expiration timestamp of the access token, and a scope of the access token;

[0102] Create an access token for the user according to the access token creation instruction;

[0103] A benchmark hash value is generated and stored locally in the intelligent computing center based on the user's identity information and expiration timestamp.

[0104] In one possible implementation, the access token is a string, which includes: user identity information, expiration timestamp and digital signature, wherein the digital signature is obtained by performing a hash operation on the user's identity information and the expiration timestamp to obtain a base hash value, and then encrypting the base hash value using a first key.

[0105] In a possible implementation, the execution module 52 is further configured to decrypt the digital signature using the second key to obtain a reference hash value.

[0106] In a possible implementation, the first condition also includes: the current time is earlier than the expiration timestamp.

[0107] In a possible implementation, the first condition also includes: the access token has not been recalled.

[0108] In one possible implementation, the execution module 52 is also used to determine the user's authorized computing power resource list based on the user's identity information; determine whether the target computing power resource is in the authorized computing power resource list; if so, determine that the user has the authority to access the target computing power resource, and allow the user to access the target computing power resource according to the access instruction; if not, determine that the user does not have the authority to access the target computing power resource, and deny the user access to the target computing power resource.

[0109] In summary, by combining hash operations and access tokens, the security of identity authentication and the immutability of data are ensured; by verifying user permissions, it is ensured that only authorized users can access specific computing resources, thereby reducing the risk of unauthorized access; a reasonable permission verification mechanism can prevent improper or excessive use of computing resources; through identity authentication and access control processes, the intelligent computing center can effectively manage and protect its computing resources to create a safe and compliant operating environment, thereby improving the overall security of the intelligent computing center.

[0110] Please refer to Figure 6 The embodiment of the present application also provides an electronic device 60, including a processor 61, a memory 62, and a computer program stored in the memory 62 and executable on the processor 61. When the computer program is executed by the processor 61, the various processes of the computing power resource access method embodiment of the above-mentioned intelligent computing center are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0111] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned intelligent computing center computing resource access method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0112] The embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the various processes of the above-mentioned intelligent computing center computing power resource access method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0113] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0114] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0115] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for accessing computing resources of an intelligent computing center, characterized in that: The method comprises: Step S1: receiving an access instruction from a user, wherein the access instruction is used to indicate the target computing resource that the user needs to access, the access instruction carries the access token of the user, and the access token carries the identity information of the user; Step S2: performing a hash operation on the access token to obtain a hash value to be verified corresponding to the access token; Step S3: Determine whether the first condition is met. If the first condition is met, execute step S4; if the first condition is not met, execute step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value; Step S4: Verify whether the user has the authority to access the target computing resources according to the identity information of the user; Step S5: denying the user access to the target computing resources; The access token is a character string, which includes: the user's identity information, an expiration timestamp, and a digital signature, wherein the digital signature is obtained by performing a hash operation on the user's identity information and the expiration timestamp to obtain the reference hash value, and then encrypting the reference hash value using a first key; Before step S1, the method further includes: Step S01: receiving an access token creation instruction input by a user, wherein the access token creation instruction is used to determine at least one of the following contents: a name of the access token, an expiration timestamp of the access token, and a scope of the access token; Step S02: creating the access token for the user according to the access token creation instruction; Step S03: Generate and store the reference hash value locally in the intelligent computing center based on the user's identity information and the expiration timestamp; The first condition also includes: the current time is earlier than the expiration timestamp; the first condition also includes: the access token has not been recalled; a user can generate multiple access tokens, each access token has its own scope; The step S3 further comprises: Step S31: decrypting the digital signature using the second key to obtain the reference hash value; The step S4 comprises: Step S41: Determine the user's authorized computing resource list according to the user's identity information; Step S42: determining whether the target computing resource is in the authorized computing resource list; if so, determining that the user has the authority to access the target computing resource, and allowing the user to access the target computing resource according to the access instruction; if not, determining that the user does not have the authority to access the target computing resource, and denying the user access to the target computing resource; The intelligent computing center is used to perform a hash operation on the received access token to generate the hash value to be verified. The intelligent computing center does not record the access token. The user only records and locally stores the access token when the access token is generated. When processing the access instruction, the intelligent computing center checks whether the access token is marked as recalled. If so, the intelligent computing center will deny the user access to the target computing resource even if other conditions are met. When a new access token is generated, the original access token is no longer accessible. After refreshing the page or revisiting the page, the original access token will no longer be displayed; If the user is deleted or disabled, the access token created by the user will become invalid, and the user cannot create a new access token. Moreover, after the disabled user is reactivated, the originally generated access token will be deleted. After generating an access token, enter the name and expiration date of the access token again on the current page. After submitting, a new access token will be added. Access tokens deleted from the personal access token list will become invalid; The name of the access token cannot be repeated. An error will be reported if other characters are entered. The computing power resource access method of the intelligent computing center adopts a secondary cache mechanism. The central end of the intelligent computing center is used to generate and issue access tokens, and the edge end of the intelligent computing center is used for authentication and model calling.

2. A computing resource access device for an intelligent computing center, characterized in that: The device comprises: A receiving module, configured to receive an access instruction from a user, wherein the access instruction is used to indicate a target computing resource that the user needs to access, and the access instruction carries an access token of the user, and the access token carries identity information of the user; An execution module, configured to perform a hash operation on the access token to obtain a hash value to be verified corresponding to the access token; Determine whether the first condition is met, if the first condition is met, execute step S4; if the first condition is not met, execute step S5; the first condition includes: the hash value to be verified is consistent with the reference hash value; Verify, based on the user's identity information, whether the user has the authority to access the target computing resources; Denying the user access to the target computing resource; The access token is a character string, which includes: the user's identity information, an expiration timestamp, and a digital signature, wherein the digital signature is obtained by performing a hash operation on the user's identity information and the expiration timestamp to obtain the reference hash value, and then encrypting the reference hash value using a first key; The execution module is further used to receive an access token creation instruction input by a user, wherein the access token creation instruction is used to determine at least one of the following: a name of the access token, an expiration timestamp of the access token, and a scope of the access token; create an access token for the user according to the access token creation instruction; generate and store a reference hash value locally in the intelligent computing center based on the user's identity information and the expiration timestamp; The first condition also includes: the current time is earlier than the expiration timestamp; the first condition also includes: the access token has not been recalled, a user can generate multiple access tokens, and each access token has its own scope; The execution module is further configured to decrypt the digital signature using a second key to obtain the reference hash value; and determine a list of authorized computing resources of the user according to the identity information of the user; It is also used to determine the authorized computing power resource list of the user according to the identity information of the user; determine whether the target computing power resource is in the authorized computing power resource list; if yes, determine that the user has the authority to access the target computing power resource, and allow the user to access the target computing power resource according to the access instruction; if not, determine that the user does not have the authority to access the target computing power resource, and deny the user access to the target computing power resource; The intelligent computing center is used to perform a hash operation on the received access token to generate the hash value to be verified. The intelligent computing center does not record the access token. The user only records and locally stores the access token when the access token is generated. When processing the access instruction, the intelligent computing center checks whether the access token is marked as recalled. If so, the intelligent computing center will deny the user access to the target computing resource even if other conditions are met. When a new access token is generated, the original access token is no longer accessible. After refreshing the page or revisiting the page, the original access token will no longer be displayed; If the user is deleted or disabled, the access token created by the user will become invalid, and the user cannot create a new access token. Moreover, after the disabled user is reactivated, the originally generated access token will be deleted. After generating an access token, enter the name and expiration date of the access token again on the current page. After submitting, a new access token will be added. Access tokens deleted from the personal access token list will become invalid; The name of the access token cannot be repeated. An error will be reported if other characters are entered. The computing resource access device of the intelligent computing center adopts a secondary cache mechanism. The central end of the intelligent computing center is used to generate and issue access tokens, and the edge end of the intelligent computing center is used for authentication and model calling.

3. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of a method for accessing computing resources of an intelligent computing center as described in claim 1 are implemented.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the method for accessing computing power resources of an intelligent computing center as claimed in claim 1 are implemented.

5. A computer program product, characterized in that It includes computer instructions, which, when executed by a processor, implement the steps of a method for accessing computing resources of an intelligent computing center as described in claim 1.

Images