Data service processing method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a data service processing method and device, a storage medium and electronic equipment, and relates to the field of computers.The data service processing method comprises the steps that a first identity authentication token issued to a target client through a first name node is obtained, and the first identity authentication token comprises a first password, a first secret key ID and first effective duration; creating a secure connection between the target client and the second name node; through the first identity authentication token, a target identity authentication index is searched from a first persistent storage area corresponding to the second name node, and the target identity authentication index comprises a second password and a second effective duration; and comparing the first password with the second password, and under the condition that the first comparison result shows that the first password is the same as the second password, determining that the verification of the first identity authentication token is passed, and allowing to access the metadata service of the second name node.

Description

Technical Field

[0001] The embodiments of the present application relate to the computer field, and specifically, to a data service processing method and device, a storage medium, and an electronic device. Background Art

[0002] In distributed big data storage systems, the HDFS (Hadoop Distributed File System) protocol is usually used as the access protocol of the distributed storage system. This protocol is mainly used for metadata and data interaction between upper-level computing components and lower-level file systems.

[0003] The security of HDFS services has always been an important part of the big data ecosystem. Identity authentication is usually required before business interactions with data services. HDFS is deployed in a fully symmetric architecture. All nodes in the cluster can provide name node services. Multiple name node services provide services to the outside world through domain names. Therefore, identity authentication is required between the name node services on each node.

[0004] In the related technology, a client applies for an authentication token from a name node through the HDFS protocol. When using the authentication token to access other name nodes or data nodes in the cluster, there is a problem of failure to pass the verification, which causes a technical problem of low efficiency in the process of processing data services in the cluster.

[0005] In the related technology, there is no effective solution to the problem of low efficiency in processing data services in the cluster. Summary of the invention

[0006] The embodiments of the present application provide a method and device for processing data services, a storage medium, and an electronic device to at least solve the problem of low efficiency in the process of processing data services in a cluster.

[0007] According to one embodiment of the present application, a data service processing method is provided, including: obtaining a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID and a first validity period; creating a secure connection between the target client and a second name node, wherein the second name node and the first name node are nodes in a distributed data storage system; searching for a target identity authentication index from a first persistent storage area corresponding to the second name node through the first identity authentication token, wherein the target identity authentication index includes a second password and a second validity period; comparing the first password and the second password, and when the first comparison result indicates that the first password and the second password are the same, determining that the verification of the first identity authentication token is passed, and access to the metadata service of the second name node is allowed.

[0008] In an exemplary embodiment, the above-mentioned acquisition of the first identity authentication token issued to the target client through the first name node includes: obtaining a pre-generated first key, wherein the first key ID corresponds to the first key; in response to an application request sent by the target client, generating a first identity authentication token and a target identity authentication index based on the self-incremented serial number of the first name node, the first key and user information; saving the first identity authentication token and the target identity authentication index to a persistent storage area of ​​the distributed data storage system, and returning the first identity authentication token to the target client.

[0009] In an exemplary embodiment, the above-mentioned acquisition of the pre-generated first key includes: locking the second persistent storage area where the current key ID of the first name node is located; reading the current key ID recorded in the second persistent storage area, and incrementing the current key ID to obtain the incremented key ID; persisting the incremented key ID in the second persistent storage area, and generating the first key based on the incremented key ID.

[0010] In an exemplary embodiment, before comparing the first password with the second password and, when the first comparison result indicates that the first password is the same as the second password, determining that the first identity authentication token is verified to allow access to the metadata service of the second name node, the method further includes: searching for a target identity authentication index from the cache of the second name node through the first identity authentication token; determining whether the second validity period in the target identity authentication index meets a preset period requirement; or searching for a target identity authentication index from the cache of the second name node through the first identity authentication token, and, when the target identity authentication is not found in the cache of the second name node, searching for the target identity authentication index through the first identity authentication token. Searching for a target identity authentication index in the first persistent storage area corresponding to the second name node; sending an exception indication message if the target identity authentication index is not found in the first persistent storage area; or searching for the target identity authentication index from the cache of the second name node through the first identity authentication token, and searching for the target identity authentication index from the first persistent storage area corresponding to the second name node through the first identity authentication token if the target identity authentication index is not found in the cache of the second name node; determining whether the second valid duration in the target identity authentication index meets a preset period requirement, wherein the preset period requirement includes that the maximum life cycle indicated by the second valid duration has not expired.

[0011] In an exemplary embodiment, after comparing the first password with the second password and, when the first comparison result indicates that the first password and the second password are the same, determining that the verification of the first identity authentication token is passed and access to the metadata service of the second name node is allowed, the above method also includes: in response to an update request sent by the target client to the second name node, parsing the first identity authentication token to obtain the first password, the first key ID and the first validity period contained in the first identity authentication token; when it is determined that the maximum life cycle indicated by the first validity period has not expired, finding the first key based on the first key ID recorded in the first identity authentication token; comparing the third password regenerated based on the first key with the first password, and when the first comparison result indicates that the third password and the first password are the same, updating data in the cache of the second name node and the first persistent storage area corresponding to the second name node.

[0012] In an exemplary embodiment, the above method also includes: obtaining data block location information in response to a read / write request sent by a target client to a first name node; generating a data block access token based on a second key and the data block location information, wherein the second key is the key used when generating the data block access token; and returning the data block access token to the target client based on the data block location information.

[0013] In an exemplary embodiment, before returning the data block access token to the target client based on the data block location information, the above method also includes: in response to a read and write request sent by the target client to the first data node, obtaining a data block access token issued to the target client by the first name node, wherein the data block access token includes a third password, a second key ID and a third validity period; creating a connection between the target client and the second data node, wherein the second data node and the first data are nodes responsible for reading and writing data in a distributed data storage system; reading a third key from a third persistent storage area corresponding to the second data node through the second key ID, wherein a fourth password is recorded in the third key; comparing the fourth password with the third password, and when the second comparison result indicates that the fourth password and the third password are the same, determining that the data block access token has been verified, allowing read and write operations on the data block associated with the second data node.

[0014] According to another embodiment of the embodiment of the present application, a data service processing device is also provided, including: a first acquisition unit, used to obtain a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID and a first validity period; a creation unit, used to create a secure connection between the target client and a second name node, wherein the second name node and the first name node are nodes in a distributed data storage system; a search unit, used to use the first identity authentication token to find a target identity authentication index from a first persistent storage area corresponding to the second name node, wherein the target identity authentication index includes a second password and a second validity period; a first processing unit, used to compare the first password with the second password, and when the first comparison result indicates that the first password and the second password are the same, determine that the verification of the first identity authentication token is passed, and access to the metadata service of the second name node is allowed.

[0015] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0016] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0017] According to another embodiment of the present application, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0018] Through the above-mentioned embodiments provided by the present application, when a secure connection is created between a target client and a second name node, the target authentication index is transmitted to the first persistent storage area corresponding to the second name node through the target client, and then the second password in the target authentication index is compared with the first password in the first authentication token pre-issued to the target client, and when the comparison result indicates that the first password is the same as the second password, it is determined that the metadata service of the second name node is allowed to be accessed through the first authentication token. In other words, by transmitting and storing the first authentication token issued to the first name node in a shared area of ​​a distributed data storage system, the first authentication token can be used to access the data services of other name nodes in the system, thereby improving the compatibility of the HDFS protocol of the distributed data storage system and achieving the technical effect of improving the processing efficiency of the system data services. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 It is a hardware structure block diagram of a server device of a data service processing method according to an embodiment of the present application;

[0021] Figure 2 is a flowchart of an optional data service processing method according to an embodiment of the present application;

[0022] Figure 3 It is the overall interaction flow chart of the distributed data storage system HDFS_TOKEN;

[0023] Figure 4 It is an optional flowchart of verification of DelegationToken between name nodes according to an embodiment of the present application;

[0024] Figure 5 This is an optional flowchart of issuing a DelegationToken according to an embodiment of the present application;

[0025] Figure 6 is an optional flow chart of generating a DelegationKey according to an embodiment of the present application;

[0026] Figure 7 is a flowchart of an optional name node delegation token update according to an embodiment of the present application;

[0027] Figure 8is a flowchart of an optional process of canceling a name node DelegationToken according to an embodiment of the present application;

[0028] Fig. 9 is a flowchart of an optional name node DelegationKey and DelegationToken scanning and removal according to an embodiment of the present application;

[0029] Fig.10 This is a flowchart of an optional name node BlockToken issuance according to an embodiment of the present application;

[0030] Fig.11 This is an optional data node BlockToken verification flow chart according to an embodiment of the present application;

[0031] Fig.12 is a structural block diagram of a verification device for a soft decoding function according to an embodiment of the present application;

[0032] Fig.13 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0035] The data service processing method embodiment provided in the embodiment of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 1 is a hardware structure block diagram of a server device of a data service processing method according to an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1 The server device may include a processor 102 (only one is shown) (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data, wherein the server device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components than shown, or with different Figure 1 Different configurations are shown.

[0036] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the processing method of the data service in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory set relative to the processor 102 process, and these process memories may be connected to the server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0037] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] In order to better understand the processing method of the above-mentioned data service, the overall structure of the HDFS-TOKEN sharing solution of the distributed data storage system in the embodiment of the present application under the HDFS fully symmetric architecture deployment scenario in the security mode is briefly introduced below.

[0039] like Figure 3 As shown, the HDFS name node (NameNode) includes multiple data services, such as HDFS service A, HDFS service B, and HDFS service C. When accessing these services, the following operations need to be performed through the management module: (1) The first authentication token issued to the first name node is transmitted to the shared area of ​​the system, that is, to the storage area where each object OMAP in the persistence module is located; (2) When creating a connection between the second name node and the target client, the second password is found by reading the target authentication index in the first persistence storage area where the OMAP corresponding to the second name node is located; (3) The first password in the first authentication token is compared with the second password, and if the two are consistent, access to the data of the second name node is allowed.

[0040] Among them, the name node is the node that manages metadata services in HDFS, the data node is the node responsible for specific data reading and writing in HDFS, and HDFS-TOKEN is a general term for security authentication certificates issued by HDFS to clients in a security cluster, including DelegationToken (hereinafter referred to as identity authentication token) and BlockToken (hereinafter referred to as data block access token).

[0041] DelegationToken can be, but is not limited to, an authentication token issued by HDFS, which can be used to access a specified HDFS service. BlockToken can be, but is not limited to, a data block access token issued by HDFS, which can be used to access a specified data block.

[0042] In order to solve the above problems existing in the related art, a data service processing method is provided in this embodiment, and its execution subjects include but are not limited to the client and the name node and data node in the distributed data storage system, such as Figure 2 As shown, the process includes the following steps S202-S208:

[0043] Step S202: Obtain a first identity authentication token issued to the target client through the first name node, wherein the first identity authentication token includes a first password, a first key ID, and a first validity period;

[0044] Step S204: creating a secure connection between the target client and the second name node, wherein the second name node and the first name node are nodes in the distributed data storage system;

[0045] Step S206: searching for a target identity authentication index from the first persistent storage area corresponding to the second name node through the first identity authentication token, wherein the target identity authentication index includes the second password and the second validity period;

[0046] Step S208: Compare the first password with the second password, and when the first comparison result indicates that the first password is the same as the second password, determine that the verification of the first identity authentication token is passed, and allow access to the metadata service of the second name node.

[0047] In an embodiment of the present application, an HDFS-TOKEN (identity authentication token) sharing scheme is proposed in a distributed data storage system security mode HDFS fully symmetric architecture deployment scenario, and shared synchronization is performed for HDFS-TOKEN issued by different Namenode nodes (name nodes), aiming to solve the problem in the prior art that the identity authentication token issued to the client by the first namenode cannot be used on other namenodes and data nodes.

[0048] The specific processing flow is as follows Figure 4 As shown, including:

[0049] S402, the target client carries the first identity authentication token and applies to establish a secure connection;

[0050] Assume that a first authentication token has been issued to the target client by the first name node, and a secure connection is established between the second name node and the target client.

[0051] S404, the second name node parses the first identity authentication token;

[0052] S406, searching the target identity authentication index DTInfo from the cache according to the first identity authentication token (DT);

[0053] Each name node maintains its own DT cache list, establishes an index relationship between the first identity authentication token (DT) and each data service, saves the index relationship to the cache of each name node, and synchronizes the index relationship to the shared location (i.e., the persistent storage area) of the distributed data storage system. Through the index, the second password transmitted to the distributed data storage system can be found.

[0054] It should be noted that if DTInfo is not found in the cache according to DT, step S412 is executed.

[0055] S408, checking whether the DTInfo exists, and if so, determining whether the maximum validity period of the found DT has expired;

[0056] The information transmitted by the target client includes not only the first identity authentication token, but also DelegationTokenInfo (also known as DTInfo) composed of the second password and the maximum validity period.

[0057] S410, comparing the second password recorded in the found DTInfo with the first password in the first identity authentication token carried by the target client;

[0058] The first identity authentication token carried by the target client is an identity authentication token issued to the target client by the first name node.

[0059] If the first password is the same as the second password, it means that the DelegationToken issued to the first name node is consistent with the DelegationToken transmitted by the target client to the distributed data storage system, thereby confirming the legitimacy of the first identity authentication token. Otherwise, an abnormal prompt is fed back.

[0060] For example, assuming that the first password in the first identity authentication token issued by the first name node to the target client is 101, and the second password found according to the target identity authentication index found in the first persistent storage area corresponding to the second name node is 102, it is determined that the verification fails, and the first identity authentication token cannot be used to access the data service under the second name node.

[0061] After determining that the first identity authentication token passes verification by the second name node, it is determined that the data service under the second name node can be accessed.

[0062] S412, if the target identity authentication index is not found in the cache, it is read from the persistent DT-OMAP.

[0063] Combined with the above description, it can be seen that while the index relationship is saved in the cache of each name node, the index relationship will also be synchronized to the shared location of the distributed data storage system (i.e., the persistent storage area). It is precisely because of the existence of this shared location that the identity authentication tokens issued by different name nodes within the same cluster can authenticate each other, thereby solving the pain point of being unable to verify when using identity authentication tokens applied for by different name nodes to access other name nodes in the cluster.

[0064] By adopting the above-mentioned method and the above-mentioned embodiment provided by the present application, when a secure connection is created between the target client and the second name node, the target authentication index is transmitted to the first persistent storage area corresponding to the second name node through the target client, and then the second password in the target authentication index is compared with the first password in the first authentication token pre-issued to the target client, and when the comparison result indicates that the first password is the same as the second password, it is determined that the metadata service of the second name node is allowed to be accessed through the first authentication token. In other words, by transmitting and storing the first authentication token issued to the first name node in the shared area of ​​the distributed data storage system, the first authentication token can be used to access the data services of other name nodes in the system, thereby improving the compatibility of the HDFS protocol of the distributed data storage system and achieving the technical effect of improving the processing efficiency of the system data services.

[0065] In an exemplary embodiment, the step of obtaining a first identity authentication token issued to a target client by a first name node includes:

[0066] Obtain a pre-generated first key, wherein the first key ID corresponds to the first key;

[0067] In response to the application request sent by the target client, generating a first identity authentication token and a target identity authentication index based on the self-incremented serial number of the first name node, the first secret key and the user information;

[0068] The first identity authentication token and the target identity authentication index are stored in a persistent storage area of ​​the distributed data storage system, and the first identity authentication token is returned to the target client.

[0069] In the embodiments of the present application, Figure 5 The issuance flow chart of the DelegationToken of the first name node shown in the figure has the following specific steps:

[0070] S502, the target client initiates a request for applying for DT to the first name node;

[0071] S504, the first name node locally increments SequenceNum;

[0072] S506, the first name node generates a new DelegationToken and DelegationTokenInfo using SequenceNum and the first secret key in the current DelegationKey and the user information transmitted by the target client;

[0073] The user information includes but is not limited to the user name, verification domain, and host name, etc. The newly generated DelegationToken includes DKID, SeqNum, password, and maximum validity period, etc. The DelegationTokenInfo consists of the password and maximum validity period.

[0074] S508, adding the newly generated DelegationToken and DelegationTokenInfo to the DT cache list of the current name node;

[0075] S510, storing the newly generated DelegationToken and DelegationTokenInfo in DT-OMAP;

[0076] For details, please refer to Figure 3 The object OMAP in the persistence module is shown.

[0077] In the distributed data storage system, each name node maintains its own self-incrementing SequenceNum and a unique DelegationKey for the entire cluster. The issuance of Tokens for each name node refers to the above steps S502 to 510.

[0078] It should be noted that DelegationKey (also known as DT) is the authorization basis for accessing the name node using DT, and DelegationToken is the identity authentication token itself. When using DelegationToken to access the data service of the name node, it is necessary to verify its legitimacy and whether the maximum validity period has expired.

[0079] By introducing OMAP as a shared persistent location, the DelegationKey and DelegationToken of this interface can be persisted to a shared location on each name node in the entire cluster. Then, each name node can access the unique DelegationKey of other name nodes and the DelegationToken issued by other name nodes through the shared persistent location, thereby realizing the HDFS_TOKEN at the entire cluster level. As a result, each name node in the entire cluster can provide unified services to the outside world, improving the availability and usability of the distributed data storage system.

[0080] In an exemplary embodiment, the step of obtaining the pre-generated first key includes:

[0081] Locking the second persistent storage area where the current key ID of the first name node is located;

[0082] Read the current key ID recorded in the second persistent storage area, and increment the current key ID to obtain the incremented key ID;

[0083] The self-incremented key ID is persisted in the second persisted storage area, and the first key is generated according to the self-incremented key ID.

[0084] Combined with the description in the above embodiment, it can be seen that each name node maintains its own DelegationKey and DelegationKey cache list, where the DelegationKey will be rolled over according to a certain time period. The DelegationKeyID required when generating the DelegationKey is a self-incrementing ID shared by multiple nodes. The self-increment and persistence of the DelegationKey can be referred to Figure 6 As shown, the steps are as follows:

[0085] S602, the first name node applies to the OMAP where the CurrentDelegationKeyID is located for locking;

[0086] After locking is completed, execute step S604.

[0087] S604, read the current keyID recorded in OMAP, increment it and then save it in OMAP;

[0088] S606, the first name point generates a new DelegationKey according to the self-incremented keyID;

[0089] Among them, DelegationKey contains attributes such as keyID, secret key and maximum validity period, and the so-called generation of a new DelegationKey essentially only updates the maximum validity period without changing the unique identification key.

[0090] For example, for a meeting scheduled for 2 hours, assuming that the validity period before the update is 14:00-16:00, after rolling over according to a certain time period, the updated validity period is 17:00-19:00.

[0091] S608, placing both the DelegationKey before update and the newly generated DelegationKey into the DK cache list;

[0092] S610: Store the newly generated DelegationKey in the storage area where the DK-OMAP is located.

[0093] By adding the whole cluster keyIDzizeng and DK persistence process in the embodiment of the present application, the keyID self-increment solves the concurrent self-increment problem through locking, ensuring that the keyID is not repeated and self-increments on demand, the persistence of DK can ensure the verification of other nodes, and improve the data security of the distributed data storage system.

[0094] In an exemplary embodiment, before comparing the first password with the second password and determining that access to the metadata service of the second name node is allowed through verification of the first identity authentication token when the first comparison result indicates that the first password is the same as the second password, the method further includes:

[0095] Find the target authentication index from the cache of the second name node using the first authentication token;

[0096] Determining whether the second validity period in the target identity authentication index meets the preset period requirement; or

[0097] Find the target identity authentication index from the cache of the second name node through the first identity authentication token, and if the target identity authentication is not found from the cache of the second name node, find the target identity authentication index from the first persistent storage area corresponding to the second name node through the first identity authentication token;

[0098] If the target identity authentication object is not found in the first persistent storage area, sending an abnormal indication message; or

[0099] Find the target identity authentication index from the cache of the second name node through the first identity authentication token, and if the target identity authentication is not found from the cache of the second name node, find the target identity authentication index from the first persistent storage area corresponding to the second name node through the first identity authentication token;

[0100] Determine whether the second validity period in the target identity authentication index meets a preset period requirement, wherein the preset period requirement includes that the maximum life cycle indicated by the second validity period has not expired.

[0101] In combination with the above embodiments Figure 4 As can be seen from the description of the first part, before the verification of the first authentication token is determined based on the comparison result of the first password and the second password, and access to the metadata service of the second name node is allowed, it is also necessary to check whether DTInfo exists and whether the maximum validity period of DelegationToken has expired, etc., including the following situations:

[0102] (1) When DTInfo is directly found from the cache of the second name node according to DelegationToken, determine whether the maximum validity period of the DelegationToken found according to the index relationship of DTInfo meets the preset period requirement. If the preset period requirement is met, execute the following Figure 4 In step S410, the first password is compared with the second password; otherwise, an abnormal prompt is directly fed back;

[0103] (2) If DTInfo is not found in the cache of the second name node according to DelegationToken, execute the following Figure 4 Step S412 shown in FIG. 4 is to read DTInfo from the persistent DT-OMAP. If the reading is successful, it is determined whether the maximum validity period of the DelegationToken found according to the index relationship of DTInfo meets the preset period requirement. If the preset period requirement is met, the following is executed: Figure 4 In step S410, the first password is compared with the second password, and it is determined whether to allow access to the data service of the second name node through the first identity authentication token according to the comparison result; otherwise, the process ends;

[0104] (3) If DTInfo is not found in the cache of the second name node according to DelegationToken, execute the following Figure 4In step S412, DTInfo is read from the maintained DT-OMAP. If the reading is unsuccessful, an abnormality prompt is fed back.

[0105] By using the above method, by judging whether DTInfo exists and verifying the validity period of DelegationToken, it can be ensured that the second password can be found using DTInfo. At the same time, it is ensured that the validity period of DelegationToken meets the requirements. The use of DelegationToken can directly perform security authentication in subsequent HDFS service interactions, which improves the reliability and versatility of identity authentication.

[0106] In an exemplary embodiment, after comparing the first password with the second password and, when the first comparison result indicates that the first password is the same as the second password, determining that access to the metadata service of the second name node is allowed through verification of the first identity authentication token, the method further includes:

[0107] In response to the update request sent by the target client to the second name node, the first identity authentication token is parsed to obtain the first password, the first key ID and the first validity period contained in the first identity authentication token;

[0108] When it is determined that the maximum life cycle indicated by the first validity period has not expired, searching for the first key based on the first key ID recorded in the first identity authentication token;

[0109] Compare the third password regenerated based on the first secret key with the first password, and when the first comparison result indicates that the third password is the same as the first password, update data in the cache of the second name node and the first persistent storage area corresponding to the second name node.

[0110] For details, please refer to Figure 7 As shown, the steps are as follows:

[0111] S702, the client carries the DT and sends an update request to the second name node;

[0112] S704, the second name node resolves DT;

[0113] The parsed information includes the recorded keyID, the first password and the first valid time (the maximum validity period of DT).

[0114] S706, check whether the DT exceeds the maximum life cycle;

[0115] If not, execute step S708; otherwise, end the process.

[0116] S708, searching for DK from the DK cache according to the keyID recorded in the DT;

[0117] If the DK is found in the cache, execute step S710; otherwise, execute step S716.

[0118] S710, recalculate the password based on the first secret key recorded in the DK and the information contained in the DT to obtain a third password, and compare the third password with the first password carried in the DT;

[0119] If the comparison result indicates that the first password is identical to the third password, execute S712; otherwise, end the process.

[0120] S712, searching DTInfo from the cache according to DT;

[0121] For details, please refer to the description in the above embodiment, which will not be repeated here.

[0122] S714, update cache and persist to DT-OMAP;

[0123] It should be noted that the key to updating the name node DelegationToken is that if the name node does not find the DK and DT in the local cache, it can search from the shared location.

[0124] S716, if the DK is not found in the DK cache, read the DK from the persistent DK-OMAP;

[0125] S718: If DTInfo is not found in the cache, read DTInfo from the persistent DT-OMAP.

[0126] If DTInfo is not found in the cache and is not read from the maintained DT-OMAP, an abnormal indication information is fed back.

[0127] By adopting the above method, the maximum life cycle of the DelegationToken issued by the name node can be updated, which ensures the validity of the DelegationToken and improves the data security of the DelegationToken.

[0128] In addition to the above-mentioned name node delegation token update process, the present application embodiment also provides the following Figure 8 The cancellation process of the name node DelegationToken shown in Fig. 9 The name node delegationkey and delegationToken scanning process shown below is for Figure 8 and Fig. 9 Describe them separately.

[0129] like Figure 8 As shown in the figure, the process of loading and removing the name node DelegationToken from the persistent storage area is as follows:

[0130] S802, the client sends a cancellation request with the DT to the name node;

[0131] S804, the name node resolves the DT;

[0132] S806, searching DTInfo from the cache according to DT;

[0133] If DTInfo is found, execute step S808; otherwise, execute step S810.

[0134] S808, remove the DT from the DT cache and the persistent DT-OMAP;

[0135] S810, read DTInfo from the maintained DT-OMAP.

[0136] It can be seen from the above steps S802 to S810 that the key to implementing the above cancellation process is that if the DT is not found in the local cache from the current name node, it can be searched and removed from the shared location (which can also be understood as a persistent storage area).

[0137] like Fig. 9 As shown in the figure, the scanning and removal process of the name node DelegationKey and DelegationToken is as follows:

[0138] S902, name node triggers scanning and removal;

[0139] S904, the name node loads all DKs and DTs from DK-OMAP and DT-OMAP;

[0140] S906, traverse the DK list and DT list respectively, and filter out expired DKs and DTs;

[0141] The method of filtering DK and DT is to filter out the DK and DT based on whether the maximum life cycle in the DK and DT has expired. If the maximum life cycle has expired, the DK and DT are filtered out.

[0142] S908, remove the expired DT from the DT cache, and remove the expired DK from the DK cache;

[0143] According to the screening result of step S906, the expired DT and the expired DK are removed from the DT cache and the DK cache in sequence.

[0144] S910, if it is a Master name node, remove the expired DK from the maintained DK-OMAP;

[0145] S912: If it is a Master name node, remove the expired DT from the maintained DT-OMAP.

[0146] It should be noted that while removing expired DK and DT from the local cache of the name node, it is also necessary to synchronously remove expired DK and DT from the shared location, so as to maintain the consistency of the local cache of the name node and the DK and DT in the shared location, ensuring data validity.

[0147] In an exemplary embodiment, after comparing the first password with the second password and, when the first comparison result indicates that the first password is the same as the second password, determining that access to the metadata service of the second name node is allowed through verification of the first identity authentication token, the method further includes:

[0148] Responding to a read / write request sent by a target client to a first name node, obtaining data block location information;

[0149] Generate a data block access token based on the second secret key and the data block location information, wherein the second secret key is a secret key used when generating the data block access token;

[0150] Based on the data block location information, a data block access token is returned to the target client.

[0151] In combination with the description in the above embodiments, it can be known that in a distributed data storage system, including but not limited to name nodes and data nodes, the name node is a node used to manage metadata services, and the data node is a node responsible for specific data reading and writing. Similar to the identity authentication token issued by the name node, before performing read and write operations on the data block, a data block access token needs to be issued to the client, and the data block access token must be used for verification before the read and write operations can be performed.

[0152] Combine the following Fig.10 , describes the implementation process of issuing a data block access token (BlockToken) to the target client.

[0153] S1002, the target client initiates a read / write request to the name node;

[0154] S1004, in response to the read / write request sent by the target client, the name node obtains data block location information according to the read / write request;

[0155] S1006, generating a data block access token according to the current second secret key and data block location information;

[0156] Among them, the current second secret key (BlockKey) is the secret key used to generate BlockToken. BlockToken is a data block access token issued by HDFS and can be used to access the specified data block Block.

[0157] It should be noted that in the embodiment of the present application, BlockToken can be issued through, but not limited to, the name node, but BlockToken is completed in the data node.

[0158] S1008, according to the data block location information (BlockLocation), return BlockToken to the target client.

[0159] Through the above method, BlockToken can be generated based on the second secret key and the data block location information, and BlockToken can be issued to the target client through the name node, ensuring the data security and accuracy of BlockToken.

[0160] In an exemplary embodiment, before returning the data block access token to the target client based on the data block location information, the method further includes:

[0161] In response to a read / write request sent by a target client to the first data node, obtaining a data block access token issued to the target client by the first name node, wherein the data block access token includes a third password, a second secret key ID, and a third validity period;

[0162] Creating a connection between the target client and the second data node, wherein the second data node and the first data node are nodes responsible for reading and writing data in the distributed data storage system;

[0163] Reading a third key from a third persistent storage area corresponding to the second data node through the second key ID, wherein the third key has a fourth password recorded therein;

[0164] The fourth password is compared with the third password, and when the second comparison result indicates that the fourth password is the same as the third password, it is determined that the data block access token is verified, and the read and write operations on the data block associated with the second data node are allowed.

[0165] Combine the following Fig.11 , describes the specific process of verifying BlockToken through data nodes.

[0166] S1102, the target client sends a read / write request to the first data node;

[0167] S1104, the first data node parses BlockToken (also known as BT);

[0168] Among them, BlockToken includes but is not limited to attributes such as the third password, the second key ID and the third validity period.

[0169] S1106, searching for BlockKey from the cache according to the BKID of BlockToken;

[0170] If the BlockKey is not found in the cache, step S1112 is executed; otherwise, step S1108 is executed. BlockKey includes attributes such as BKID, secret key and maximum validity period.

[0171] S1108, recalculate the password according to the secret key recorded in BK and the information in BT to obtain a fourth password, and compare the third password with the fourth password to obtain a comparison result;

[0172] If the comparison result indicates that the third password is not the same as the fourth password, it means that the data block access token issued to the first name node has passed the verification of the second data block node, and step S1110 is executed. Otherwise, it means that the data block access token issued to the first name node has not passed the verification of the second data block node, and data reading and writing operations cannot be performed on the second data block node.

[0173] S1110, performing data read and write operations on the second data block node.

[0174] By introducing the object omap as the permanent location of DelegationKey, DelegationToken, BlockKey, CurrentKeyId, and SequenceNum in the name node service, when the name node performs the full life cycle management of TOKEN, the name nodes can be isolated and synchronized with each other, achieving the purpose of both security and sharing. It can also deal with the problem that tokens issued by different name nodes can be authenticated with each other. Compared with the centralized strategy in the existing technology, it can improve the availability, usability, security and scalability of distributed big data storage systems.

[0175] In addition, you can also choose different TOKEN security levels according to different security needs, so as to cope with complex and changing scenario requirements.

[0176] In addition, it should be noted that the BlockKey rolling and persistence process of the name node is consistent with the DelegationKey process. The BlockKey of the data node is synchronized from the name node with the data node heartbeat; the BlockKey scanning and removal process of the name node and data node is consistent with the DelegationKey scanning and removal process, as follows:

[0177] S11, data node triggers scanning and removal;

[0178] S12, the name node loads all BKs and BTs from BK-OMAP and BT-OMAP;

[0179] S13, traverse the BK list and the BT list respectively, and filter out the expired BK and BT;

[0180] The method of filtering BK and BT is to filter out the BK and BT based on whether the maximum life cycle in the BK and BT has expired. If the maximum life cycle has expired, the BK and BT are filtered out.

[0181] S14, removing the expired BT from the BT cache, and removing the expired BK from the BK cache;

[0182] According to the screening result of step S13, the expired BT and the expired BK are removed from the BT cache and the BK cache in sequence.

[0183] S15, if it is a Master data node, remove the expired BK from the maintained BK-OMAP;

[0184] S16: If it is a Master data node, remove the expired BT from the maintained BT-OMAP.

[0185] It should be noted that while removing expired BK and BT from the local cache of the name node, it is also necessary to synchronously remove expired BK and BT from the shared location, so as to maintain the consistency of BK and BT in the local cache of the data node and the shared location, ensuring data validity.

[0186] Through the above embodiments provided by the present application, it can be seen that the HDFS_TOKEN sharing scheme in the present invention is mainly different from the prior art in that, first, OMAP is introduced as a shared persistent location in the HDFS service, and different DelegationKeys are generated by each name node using different keyIDs, and persisted to the shared location, and the Tokens issued by each name node are also persisted to the shared location. In the verification, update, and cancellation processes of the Token, each name node can read the specified HDFS_TOKEN from the shared location, thereby achieving the purpose of sharing the HDFS_TOKEN in the entire cluster. Secondly, by introducing OMAP as a shared persistent location, each name node at the entire cluster level can persist the DelegationKey and DelegationToken of the node to the shared location, and then each name node can access the unique DelegationKey of other nodes and the DelegationToken issued by other nodes through the shared persistent location, realizing the HDFS_TOKEN at the cluster level, and then realizing that each name node in the entire cluster can provide unified services to the outside. The HDFS_TOKEN sharing solution in the present invention solves the pain point problem that in a distributed big data storage system and a fully symmetric architecture deployment scenario of HDFS, the HDFS_TOKEN applied by the client to one of the NameNodes through the HDFS protocol cannot be verified when using the HDFS_TOKEN to access other NameNode nodes or DataNode nodes in the cluster.

[0187] Combined with the description of the above embodiments, it can be seen that compared with the prior art, the technical solution in the embodiments of the present application has at least the following beneficial effects:

[0188] (1) Availability: Compared with the single HDFS_TOKEN implementation in the prior art, the solution in the present invention provides other optional strategies to improve the availability of the entire system;

[0189] (2) Usability: The solution in the present invention provides a directly usable implementation solution that is applicable to most business scenarios and can be directly configured and used, thereby improving the usability of the entire system;

[0190] (3) Security: The solution of the present invention can use a more secure client connection and authentication method in the distributed big data storage system to adapt to different security business scenarios of the client and improve the security of the entire cluster;

[0191] (4) Compatibility: The solution in the present invention is compatible with the centralized HDFS_TOKEN implementation in the prior art and can be integrated into the existing distributed big data storage system.

[0192] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of inferior software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0193] In this embodiment, a data service processing device is also provided to implement the above-mentioned embodiments and preferred implementation modes, which have been described and will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the modules described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0194] Fig.12 : is a structural block diagram of a data service processing device according to an embodiment of the present application, the device comprising:

[0195] A first acquisition unit 1202 is used to acquire a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID, and a first validity period;

[0196] A creating unit 1204 is used to create a secure connection between the target client and the second name node, wherein the second name node and the first name node are nodes in a distributed data storage system;

[0197] A search unit 1206 is used to search for a target identity authentication index from a first persistent storage area corresponding to the second name node through the first identity authentication token, wherein the target identity authentication index includes a second password and a second validity period;

[0198] The first processing unit 1208 is used to compare the first password with the second password, and when the first comparison result indicates that the first password is the same as the second password, determine that the verification of the first identity authentication token is passed, and allow access to the metadata service of the second name node.

[0199] The above device indicates that when a secure connection is created between the target client and the second name node, the target authentication index is transmitted to the first persistent storage area corresponding to the second name node through the target client, and then the second password in the target authentication index is compared with the first password in the first authentication token issued in advance to the target client, and when the comparison result indicates that the first password is the same as the second password, it is determined that the metadata service of the second name node is allowed to be accessed through the first authentication token. In other words, by transmitting and storing the first authentication token issued to the first name node in the shared area of ​​the distributed data storage system, the first authentication token can be used to access the data services of other name nodes in the system, thereby improving the compatibility of the HDFS protocol of the distributed data storage system and achieving the technical effect of improving the processing efficiency of the system data services.

[0200] In an exemplary embodiment, the above-mentioned first acquisition unit 1202 includes: a first acquisition module, used to obtain a pre-generated first key, wherein the first key ID does not correspond to the first key; a first processing module, used to respond to an application request sent by a target client, based on the self-incremented serial number of the first name node, the first key and user information, to generate a first identity authentication token and a target identity authentication index; a second processing module, used to save the first identity authentication token and the target identity authentication index to a persistent storage area of ​​a distributed data storage system, and return the first identity authentication token to the target client.

[0201] In an exemplary embodiment, the above-mentioned first acquisition module includes: a first processing sub-module, used to lock the second persistent storage area where the current key ID of the first name node is located; a reading sub-module, used to read the current key ID recorded in the second persistent storage area, and increment the current key ID to obtain the incremented key ID; a second processing sub-module, used to persist the incremented key ID in the second persistent storage area, and generate the first key according to the incremented key ID.

[0202] In an exemplary embodiment, the above-mentioned device also includes: a search unit, which is used to compare the first password with the second password, and when the first comparison result indicates that the first password is the same as the second password, determine that before the verification of the first identity authentication token is passed and access to the metadata service of the second name node is allowed, search for the target identity authentication index from the cache of the second name node through the first identity authentication token; determine whether the second valid time in the target identity authentication index meets the preset time limit requirement; or search for the target identity authentication index from the cache of the second name node through the first identity authentication token, and when the target identity authentication is not found in the cache of the second name node, search for the target identity authentication index from the cache of the second name node through the first identity authentication token. , search for the target identity authentication index in the first persistent storage area corresponding to the second name node; if the target identity authentication index is not found in the first persistent storage area, send an abnormal indication message; or use the first identity authentication token to search for the target identity authentication index from the cache of the second name node, and if the target identity authentication is not found in the cache of the second name node, use the first identity authentication token to search for the target identity authentication index from the first persistent storage area corresponding to the second name node; determine whether the second valid duration in the target identity authentication index meets the preset period requirement, wherein the preset period requirement includes that the maximum life cycle indicated by the second valid duration has not expired.

[0203] In an exemplary embodiment, the above-mentioned device also includes: a parsing unit, which is used to compare the first password with the second password, and when the first comparison result indicates that the first password is the same as the second password, determine that the first identity authentication token is verified and access to the metadata service of the second name node is allowed, and then, in response to an update request sent by the target client to the second name node, parse the first identity authentication token to obtain the first password, the first key ID and the first validity period contained in the first identity authentication token; a second processing unit, which is used to find the first key based on the first key ID recorded in the first identity authentication token when it is determined that the maximum life cycle indicated by the first validity period has not expired; a comparison unit, which is used to compare the third password regenerated based on the first key with the first password, and when the first comparison result indicates that the third password is the same as the first password, update the data in the cache of the second name node and the first persistent storage area corresponding to the second name node.

[0204] In an exemplary embodiment, the above-mentioned device also includes: a second acquisition unit, used to obtain data block location information in response to a read and write request sent by a target client to the first name node; a third processing unit, used to generate a data block access token based on a second key and the data block location information, wherein the second key is the key used when generating the data block access token; and a fourth processing unit, used to return the data block access token to the target client based on the data block location information.

[0205] In an exemplary embodiment, the above-mentioned device also includes: a second acquisition module, which is used to obtain a data block access token issued to the target client through the first name node in response to a read and write request sent by the target client to the first data node before returning the data block access token to the target client based on the data block location information, wherein the data block access token includes a third password, a second key ID and a third validity period; a creation module, which is used to create a connection between the target client and the second data node, wherein the second data node and the first data are nodes responsible for reading and writing data in a distributed data storage system; a reading module, which is used to read the third key from the third persistent storage area corresponding to the second data node through the second key ID, wherein the third key records a fourth password; a comparison module, which is used to compare the fourth password with the third password, and when the second comparison result indicates that the fourth password and the third password are the same, determine that the data block access token is verified, and allow the data block associated with the second data node to perform read and write operations.

[0206] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0207] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0208] Optionally, in this embodiment, the computer program may be configured to perform the following steps by means of the computer program:

[0209] S1, obtaining a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID, and a first validity period;

[0210] S2, establishing a secure connection between the target client and the second name node, wherein the second name node and the first name node are nodes in a distributed data storage system;

[0211] S3, searching for a target identity authentication index from a first persistent storage area corresponding to the second name node through the first identity authentication token, wherein the target identity authentication index includes a second password and a second validity period;

[0212] S4, comparing the first password with the second password, and when the first comparison result indicates that the first password is the same as the second password, determining that the verification of the first identity authentication token is passed, allowing access to the metadata service of the second name node.

[0213] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0214] The embodiment of the present application also provides an electronic device, such as Fig.13 As shown, the electronic device includes a memory 1302 and a processor 1304. The memory 1302 stores a computer program, and the processor 1304 is configured to execute the steps in any of the above method embodiments through the computer program.

[0215] Optionally, in this embodiment, the processor 1304 may be configured to perform the following steps through a computer program:

[0216] S1, obtaining a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID, and a first validity period;

[0217] S2, establishing a secure connection between the target client and the second name node, wherein the second name node and the first name node are nodes in a distributed data storage system;

[0218] S3, searching for a target identity authentication index from a first persistent storage area corresponding to the second name node through the first identity authentication token, wherein the target identity authentication index includes a second password and a second validity period;

[0219] S4, comparing the first password with the second password, and when the first comparison result indicates that the first password is the same as the second password, determining that the verification of the first identity authentication token is passed, allowing access to the metadata service of the second name node.

[0220] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0221] Alternatively, a person skilled in the art may understand that: Fig.13 The structure shown is for illustration only. Fig.13 The structure of the electronic device is not limited. For example, the electronic device may also include Fig.13 More or fewer components (such as network interfaces, etc.) shown in the figure, or with different Fig.13 Different configurations are shown.

[0222] Among them, the memory 1302 can be used to store software programs and modules, such as the program instructions / modules corresponding to the data service processing method and the alarm information blowing device in the embodiment of the present application. The processor 1304 executes various functional applications and data processing by running the software programs and modules stored in the memory 1302, that is, realizing the above-mentioned data service processing method. The memory 1302 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1302 may further include a memory set relative to the processor 1304 process, and these process memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 1302 may be specifically, but not limited to, used to store information such as a first identity authentication token, a first password, and a first validity period. As an example, if Fig.13 As shown, the memory 1302 may include, but is not limited to, the first acquisition unit 1202, the creation unit 1204, the search unit 1206, and the first processing unit 1208 in the data service processing device. In addition, other module units in the verification device of the soft decoding function may also be included but are not limited to the above, which will not be repeated in this example.

[0223] Optionally, the transmission device 1306 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 1306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 1306 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0224] In addition, the electronic device further includes: a display 1308; and a connection bus 1310, which is used to connect various module components in the electronic device.

[0225] In other embodiments, the electronic device may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes in the form of network communication. Among them, the nodes may form a peer-to-peer (P2P) network, and any form of computing device, such as a server, terminal, or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0226] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0227] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0228] The embodiments of the present application also provide a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of any one of the above method embodiments.

[0229] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0230] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A data service processing method, characterized in that: include: Obtain a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID, and a first validity period; Creating a secure connection between the target client and a second name node, wherein the second name node and the first name node are nodes in a distributed data storage system; Using the first identity authentication token, searching for a target identity authentication index from a first persistent storage area corresponding to the second name node, wherein the target identity authentication index includes a second password and a second validity period; The first password is compared with the second password, and when a first comparison result indicates that the first password is the same as the second password, it is determined that the verification of the first identity authentication token is passed, and access to the metadata service of the second name node is allowed.

2. The method according to claim 1, characterized in that The obtaining of a first identity authentication token issued to a target client by a first name node includes: Obtaining a pre-generated first key, wherein the first key ID corresponds to the first key; In response to the application request sent by the target client, generating the first identity authentication token and the target identity authentication index based on the self-incremented serial number of the first name node, the first secret key and the user information; The first identity authentication token and the target identity authentication index are saved in a persistent storage area of ​​the distributed data storage system, and the first identity authentication token is returned to the target client.

3. The method according to claim 2, characterized in that The obtaining of the pre-generated first secret key comprises: Locking the second persistent storage area where the current key ID of the first name node is located; Read the current key ID recorded in the second persistent storage area, and increment the current key ID to obtain the incremented key ID; The self-incremented key ID is persisted in the second persistent storage area, and the first key is generated according to the self-incremented key ID.

4. The method according to claim 1, characterized in that: Before comparing the first password with the second password and, if the first comparison result indicates that the first password is the same as the second password, determining that the first identity authentication token is verified and access to the metadata service of the second name node is allowed, the method further includes: Using the first identity authentication token, searching for the target identity authentication index from the cache of the second name node; Determining whether the second validity period in the target identity authentication index meets a preset period requirement; or Find the target authentication index from the cache of the second name node by using the first authentication token, and if the target authentication is not found from the cache of the second name node, find the target authentication index from the first persistent storage area corresponding to the second name node by using the first authentication token; If the target identity authentication object is not found in the first persistent storage area, sending abnormal indication information; or Find the target authentication index from the cache of the second name node by using the first authentication token, and if the target authentication is not found from the cache of the second name node, find the target authentication index from the first persistent storage area corresponding to the second name node by using the first authentication token; Determine whether the second validity period in the target identity authentication index meets a preset period requirement, wherein the preset period requirement includes that the maximum life cycle indicated by the second validity period has not expired.

5. The method according to claim 1, characterized in that After comparing the first password with the second password and, when the first comparison result indicates that the first password is the same as the second password, determining that the access to the metadata service of the second name node is allowed through the verification of the first identity authentication token, the method further includes: In response to the update request sent by the target client to the second name node, the first identity authentication token is parsed to obtain the first password and the first key ID contained in the first identity authentication token. and the first effective duration; When it is determined that the maximum life cycle indicated by the first validity period has not expired, searching for the first key based on the first key ID recorded in the first identity authentication token; Compare the third password regenerated based on the first secret key with the first password, and when the first comparison result indicates that the third password is the same as the first password, update the data of the cache of the second name node and the first persistent storage area corresponding to the second name node.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: In response to a read / write request sent by the target client to the first name node, acquiring data block location information; Generate a data block access token based on a second secret key and the data block location information, wherein the second secret key is a secret key used when generating the data block access token; Based on the data block location information, the data block access token is returned to the target client.

7. The method according to claim 6, characterized in that Before returning the data block access token to the target client based on the data block location information, the method further includes: In response to a read / write request sent by the target client to the first data node, obtaining the data block access token issued to the target client by the first name node, wherein the data block access token includes a third password, a second key ID, and a third validity period; Creating a connection between the target client and a second data node, wherein the second data node and the first data node are nodes responsible for reading and writing data in the distributed data storage system; Reading a third key from a third persistent storage area corresponding to the second data node by using the second key ID, wherein a fourth password is recorded in the third key; The fourth password is compared with the third password, and when a second comparison result indicates that the fourth password is the same as the third password, it is determined that the data block access token is verified, and read and write operations on the data block associated with the second data node are allowed.

8. A data service processing device, characterized in that: include: A first acquisition unit, configured to acquire a first identity authentication token issued to a target client through a first name node, wherein the first identity authentication token includes a first password, a first key ID, and a first validity period; A creating unit, configured to create a secure connection between the target client and a second name node, wherein the second name node and the first name node are nodes in a distributed data storage system; A search unit, configured to search for a target identity authentication index from a first persistent storage area corresponding to the second name node through the first identity authentication token, wherein the target identity authentication index includes a second password and a second validity period; The first processing unit is used to compare the first password with the second password, and when a first comparison result indicates that the first password is the same as the second password, determine that the verification of the first identity authentication token is passed, and access to the metadata service of the second name node is allowed.

9. A computer-readable storage medium, characterized in that: The computer readable storage medium stores a computer program, wherein the computer program is executed by the processor. When executed, the steps of the method described in any one of claims 1 to 7 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 7 are implemented.

Images