Computing power task network isolation method of intelligent computing center and related equipment

Abstract

The invention provides a computing power task network isolation method of an intelligent computing center and related equipment, and relates to the technical field of computing power of the intelligent computing center, the intelligent computing center comprises a plurality of virtual subnets, and the method comprises the following steps: S1, obtaining a target network strategy corresponding to a computing power task, the target network strategy comprises an address of at least one virtual subnet allowed to be accessed by the computing power task, and the at least one virtual subnet is a subnet in a plurality of virtual subnets; and S2, performing access configuration on a target virtual subnet based on the target network strategy, the access configuration being used for enabling the target virtual subnet to access the at least one virtual subnet through the address, and the target virtual subnet being a virtual subnet including the computing power task in the plurality of virtual subnets. The risk of data leakage of the computing power task is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computing power technology of an intelligent computing center, and in particular to a computing power task network isolation method and related equipment of an intelligent computing center. Background Art

[0002] "Intelligent computing center" refers to a facility that provides the required computing power, data and algorithms for artificial intelligence applications (such as artificial intelligence deep learning model development, model training and model reasoning) by using large-scale heterogeneous computing resources, including general computing power and intelligent computing power. The intelligent computing center covers facilities, hardware, and software, and can provide full-stack capabilities from bottom-level computing power to top-level application enablement.

[0003] Different virtual subnets are set up in the intelligent computing center, and containers (pods) or virtual machines (VMs) are set up in the virtual subnets. Different computing tasks are carried and executed by the containers or virtual machines.

[0004] Currently, data exchange between virtual subnets in the intelligent computing center is achieved through network ports. However, different computing tasks have different confidentiality requirements, and the data of some computing tasks need to be kept confidential. In related technologies, network isolation is not achieved between virtual subnets, resulting in a high risk of data leakage in computing tasks.

[0005] It can be seen that there is a high risk of data leakage in computing tasks in the relevant technology. Summary of the invention

[0006] The embodiment of the present invention provides a computing task network isolation method and related equipment for an intelligent computing center to solve the problem of high risk of data leakage of computing tasks in related technologies.

[0007] To solve the above problems, the present invention is achieved as follows:

[0008] In a first aspect, an embodiment of the present invention provides a computing task network isolation method for an intelligent computing center, wherein the intelligent computing center includes multiple virtual subnets, including:

[0009] Step S1: obtaining a target network policy corresponding to the computing task, wherein the target network policy includes an address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets;

[0010] Step S2: perform access configuration on the target virtual subnet based on the target network policy, wherein the access configuration is used to enable the target virtual subnet to access the at least one virtual subnet through the address, and the target virtual subnet is a virtual subnet among the multiple virtual subnets that includes the computing task.

[0011] In one embodiment, step S1 includes:

[0012] Step S11, obtaining an initial network policy and an address of the at least one virtual subnet, wherein the initial network policy is a network policy pre-configured when creating the target virtual subnet;

[0013] Step S12: Adjust the initial network policy to an address that allows access to the at least one virtual subnet to obtain the target network policy.

[0014] In one embodiment, step S2 includes:

[0015] Step S21, monitoring events of the target virtual subnet;

[0016] Step S22: When an event of creating a network port in the target virtual subnet is monitored, access configuration is performed on the target virtual subnet based on the target network policy configuration.

[0017] In one embodiment, step S22 includes:

[0018] Step S221, performing access configuration on the target virtual subnet based on the target network policy through the target function;

[0019] The target function is an Internet Protocol IP table rule, an Open Virtual Switch OVS flow table, an IP virtual server or an extended Berkeley Packet Filter eBPF hook.

[0020] In one embodiment, the address of the at least one virtual subnet includes the address of the virtual router of the intelligent computing center, the virtual router is communicatively connected with the virtual switch of the intelligent computing center, and the virtual switch is used to access the public network.

[0021] In one embodiment, the target virtual subnet includes at least one container or virtual machine in the intelligent computing center, and the at least one container or virtual machine is used to undertake the computing task. The at least one container or virtual machine accesses the public network through a virtual network card channel, and the virtual network card channel includes the virtual router and the virtual switch.

[0022] In a second aspect, an embodiment of the present invention further provides a computing task network isolation device for an intelligent computing center, wherein the intelligent computing center includes a plurality of virtual subnets, and the device includes:

[0023] An acquisition module, used to acquire a target network policy corresponding to the computing task, wherein the target network policy includes an address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets;

[0024] A configuration module is used to configure access to the target virtual subnet based on the target network policy, wherein the access configuration is used to enable the target virtual subnet to access at least one virtual subnet through the address, and the target virtual subnet is a virtual subnet among the multiple virtual subnets that includes the computing task.

[0025] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps in the method for isolating computing power tasks in a network of an intelligent computing center as described in the first aspect above are implemented.

[0026] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the computing power task network isolation method of the intelligent computing center as described in the first aspect above are implemented.

[0027] In a fifth aspect, an embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps in the computing power task network isolation method of the intelligent computing center as described in the first aspect above.

[0028] In an embodiment of the present invention, a target network policy corresponding to a computing task is obtained, the target network policy includes the address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets. Then, access to the target virtual subnet is configured based on the target network policy, so that the configured target virtual subnet can access at least one virtual subnet through the address, but cannot access other virtual subnets, thereby achieving network isolation of the computing tasks included in the virtual subnet and reducing the risk of data leakage of the computing tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0030] Figure 1 It is a flow chart of a computing task network isolation method for an intelligent computing center provided by an embodiment of the present invention;

[0031] Figure 2 is a schematic diagram of data interaction between virtual subnets provided by an embodiment of the present invention;

[0032] Figure 3 It is a structural diagram of a computing task network isolation device for an intelligent computing center provided by an embodiment of the present invention;

[0033] Figure 4 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] The "computing power" mentioned in the present invention is the ability of computer equipment or computing / data center to process information. It is the ability of computer hardware and software to work together to execute certain computing requirements. It is the computing power to achieve target result output by processing information data. It is a new type of productivity that integrates information computing power, network carrying capacity, and data storage capacity. It mainly provides services to the society through computing power infrastructure.

[0036] The "computing power" (Computational Power, CP) described in the present invention is the ability of a data center server to process data and output results. It is a comprehensive indicator to measure the computing power of a data center, including general computing power, super computing power and intelligent computing power. The commonly used unit of measurement is the number of floating point operations performed per second (FLOPS: Floating Point Operations Per Second, 1EFLOPS = 10^18FLOPS). The larger the value, the stronger the comprehensive computing power. According to calculations, 1EFLOPS is approximately the computing power output of 5 Tianhe-2A or 500,000 mainstream server CPUs or 2 million mainstream notebooks. The calculation formula is: CP = CP 通用 +CP 智能 +CP 超级 .

[0037] The "Network Power" (NP) described in the present invention is a manifestation of the data transmission capability of computing facilities, including comprehensive capabilities such as network architecture, network bandwidth, transmission latency, intelligent management and scheduling, etc. The carrying capacity involves network transmission within and between data centers, and is a comprehensive indicator for measuring network transmission scheduling capabilities. In the embodiment of the present invention, the carrying capacity uses the memory bandwidth.

[0038] The "Storage Power" (SP) described in the present invention is the comprehensive ability of a data center in terms of data storage capacity, performance, safety and reliability, and green and low-carbon. It is a comprehensive indicator for measuring the data storage capacity of a data center, including external storage devices such as storage arrays and server built-in storage devices. The commonly used unit of measurement for storage capacity is exabyte (EB, 1EB = 2^60bytes), and the commonly used unit of measurement for performance is the number of reads and writes per second per unit capacity (IOPS / TB, Input / Output Operations Per Second / TB). The disaster recovery ratio is an important manifestation of safety and reliability.

[0039] The "computing power infrastructure" described in the present invention is a new type of information infrastructure that integrates information computing power, network carrying capacity, and data storage capacity. It can realize centralized computing, storage, transmission and application of information, and presents characteristics such as diversity and ubiquity, intelligence and agility, safety and reliability, green and low-carbon. It is of great significance to promote industrial transformation and upgrading, enable my country's scientific and technological innovation, meet people's better life and realize high-efficiency social governance.

[0040] The “computing power” mentioned in the present invention includes general computing power, intelligent computing power and super computing power.

[0041] The “general computing power” mentioned in the present invention refers to the computing power provided by a server based on a central processing unit (CPU) chip, which is used to support basic general computing such as cloud computing and edge computing.

[0042] The "intelligent computing power" described in the present invention is a computing platform for large-scale deployment of special chips such as graphics processing units (GPUs), field programmable gate arrays (FPGAs), and application-specific integrated circuits (ASICs) for various innovative applications of artificial intelligence, such as natural language processing and machine vision.

[0043] The "super computing power" mentioned in the present invention is mainly the computing power provided by high-performance computing clusters such as supercomputers. It utilizes the centralized computing resources of multiple computer systems working in parallel and uses a dedicated operating system to handle extremely complex or data-intensive problems. It is mainly used for calculations in cutting-edge scientific fields, such as planetary simulation, drug molecule design, and gene analysis.

[0044] The "intelligent computing center" mentioned in the present invention refers to a facility that provides the required computing power, data and algorithms for artificial intelligence applications (such as artificial intelligence deep learning model development, model training and model reasoning) by using large-scale heterogeneous computing resources, including general computing power (CPU) and intelligent computing power (GPU, FPGA, etc.). The intelligent computing center covers facilities, hardware, and software, and can provide full-stack capabilities from bottom-level computing power to top-level application enablement.

[0045] The "computing resources" mentioned in the present invention refer to the technologies and facilities with information calculation, transmission, storage and application capabilities required for the development of the digital society, including but not limited to computing resources such as CPUs and GPUs, network resources such as switches and routers, storage resources such as storage arrays and distributed storage, security resources such as firewalls and intrusion detection systems, and supporting and guarantee resources such as wind, fire, water and electricity.

[0046] The "virtual subnet" described in the present invention refers to a network composed of terminal nodes that are physically distributed in different subnets and logically connected to each other. A virtual subnet is not just a fictitious network, but a logical subnet formed by connecting terminal nodes distributed in different physical locations through logical connections. Data transmission is allowed between interconnected virtual subnets. The concept of virtual subnets is very important in computer network architecture, especially in scenarios where it is necessary to integrate dispersed resources and improve network flexibility and scalability.

[0047] The "pod" described in the present invention refers to a series of processes or tasks that are isolated from the rest of the system. All files required to run these processes or tasks are provided by another image, that is, the container is portable and consistent throughout the entire process from development to testing to production. Containers provide isolation between processes or tasks, and can divide the resources managed by computers, servers, or intelligent computing centers into isolated groups, resolving conflicts in resource usage between isolated groups.

[0048] The "virtual machine" described in the present invention is a computer system with complete hardware system functions simulated by software, which runs in a completely isolated environment. A virtual machine (VM) can be created on a physical computer, server or intelligent computing center, and a part of the hard disk and memory capacity of the physical computer, server or intelligent computing center is allocated to the virtual machine as its hard disk and memory capacity. Each virtual machine can perform the same operations as a physical computer. Virtual machine technology allows multiple operating systems to run simultaneously on a physical computer without interfering with each other.

[0049] See also Figure 1 , Figure 1 is a flow chart of a computing task network isolation method for an intelligent computing center provided by an embodiment of the present invention, wherein the intelligent computing center includes multiple virtual subnets, such as Figure 1 As shown, the following steps are included:

[0050] Step S1: obtaining a target network policy corresponding to the computing task, wherein the target network policy includes an address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets;

[0051] Step S2: perform access configuration on the target virtual subnet based on the target network policy, wherein the access configuration is used to enable the target virtual subnet to access the at least one virtual subnet through the address, and the target virtual subnet is a virtual subnet among the multiple virtual subnets that includes the computing task.

[0052] In an embodiment of the present invention, a target network policy corresponding to a computing task is obtained, the target network policy includes the address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets. Then, access to the target virtual subnet is configured based on the target network policy, so that the configured target virtual subnet can access at least one virtual subnet through the address, but cannot access other virtual subnets, thereby achieving network isolation of the computing tasks included in the virtual subnet and reducing the risk of data leakage of the computing tasks.

[0053] In an embodiment of the present invention, the intelligent computing center includes multiple virtual subnets that are virtual subnets in a virtual private cloud (VPC) within the intelligent computing center. VPC allows users to create an isolated, dedicated network space in a public Internet environment (such as the intelligent computing center in the present invention, or a public network to which the intelligent computing center is connected). In this isolated network space, users can freely deploy and manage resources corresponding to computing tasks, such as servers, databases, applications, etc., and the resources will not conflict with other users' resources or be accessed by external intruders. The main advantages of VPC include security, isolation, scalability, and flexibility. VPC provides a secure network boundary to prevent external users or hackers from accessing your applications and data; at the same time, VPC can separate resources from other users' resources to avoid conflicts and competition between resources.

[0054] For example, Figure 2 As shown in the figure, there are multiple different virtual subnets in VPC, each of which carries different computing tasks, and each virtual subnet is accessed and configured through the network policy corresponding to the computing tasks it carries, so that access to the allowed virtual subnets is achieved, while access to other virtual subnets is prevented, thus achieving network isolation of computing tasks.

[0055] Among them, Figure 2 As shown, virtual subnet 1 can access virtual subnet 2 and virtual subnet 3 respectively to achieve data interaction between virtual subnets; while virtual subnet 2 and virtual subnet 3 cannot directly access each other, thereby achieving network isolation between virtual subnet 2 and virtual subnet 3.

[0056] Furthermore, the VPC is set up in the overlay network of the intelligent computing center. When the virtual subnet in the VPC needs to access the public network, it needs to access the public network through the underlying network.

[0057] Specifically, the address of the at least one virtual subnet includes the address of a virtual router (vrouter) of the intelligent computing center, the virtual router is communicatively connected to a virtual switch of the intelligent computing center, and the virtual switch is used to access a public network.

[0058] In an embodiment of the present invention, the address of at least one virtual subnet includes the address of the virtual router of the intelligent computing center. The virtual router is communicated with the virtual switch of the intelligent computing center. The virtual switch is used to access the public network, so that the target virtual subnet can access the public network through the virtual router and the virtual switch.

[0059] In the embodiment of the present invention, Figure 2As shown in the figure, the virtual switch connects the network cluster of the physical node to achieve connection with different networks. The virtual switch can be connected to the virtual network interface card (Virtual Network Interface Card, VNIC) of the underlying network, or to different Ethernets (Ethernet, ETH), and then access different networks (such as network 1, network 2 and network 3), such as through Figure 2 ETH0, ETH1, ETH2, ETH3, etc. shown in the figure.

[0060] It should be noted that if Figure 2 As shown in the figure, the virtual subnet cannot be directly connected to the virtual switch, but needs to be connected to the virtual router first, and then connected to the virtual switch through the virtual router to achieve access to the public network.

[0061] In the embodiments of the present invention, the bottom layer network refers to the basic network layer, that is, the physical network or the basic network architecture. It provides basic connection capabilities between hosts, including Internet Protocol (IP) network, subnet division, routing protocol, etc. The bottom layer network is a network directly established on the physical layer, responsible for the transmission of data packets between hosts, and provides basic network connectivity.

[0062] In the embodiment of the present invention, the overlay network is a logical network layer built on top of the underlying network, and the overlay network is a network created by using virtualization technology. The overlay network provides a way to abstract multiple physical networks into a single network, thereby achieving higher-level network functions and services. The overlay network uses the basic connectivity of the underlying network to create a logical network on it, and can add additional functions such as tunnels, encryption, load balancing, virtual networks, etc. without changing the underlying network.

[0063] It should be noted that the overlay network and the underlying network are relative networks. The underlying network provides the basic network architecture and the other side is the overlay network. The overlay network and the underlying network make the network architecture more flexible and scalable.

[0064] In one embodiment, step S1 includes:

[0065] Step S11, obtaining an initial network policy and an address of the at least one virtual subnet, wherein the initial network policy is a network policy pre-configured when creating the target virtual subnet;

[0066] Step S12: Adjust the initial network policy to an address that allows access to the at least one virtual subnet to obtain the target network policy.

[0067] In an embodiment of the present invention, an initial network policy and the address of at least one virtual subnet are obtained, wherein the initial network policy is a network policy pre-configured when creating a target virtual subnet; the initial network policy is adjusted to allow access to the address of at least one virtual subnet, thereby obtaining the target network policy, thereby achieving the address of at least one virtual subnet allowed to be accessed in the target network policy.

[0068] In the embodiment of the present invention, the initial network policy is a network policy pre-configured when creating the target virtual subnet. It should be noted that each virtual subnet needs to set the initial network policy at the same time when it is created to achieve the pre-configuration of each virtual subnet. When it is necessary to configure access to the target virtual subnet, the virtual address of the virtual network running access in the initial network policy is adjusted to achieve access configuration to the target virtual subnet.

[0069] Furthermore, in the case where the address of the network of the virtual subnet allowed to access by the target virtual subnet needs to be adjusted again, the target network policy can be obtained, the address of the network of the virtual subnet allowed to access in the target network policy can be updated, and the access to the target virtual subnet can be reconfigured according to the updated target network policy, so that the virtual subnet can access the updated virtual subnet, thereby realizing the adjustment of the virtual subnet allowed to access according to actual needs.

[0070] In one embodiment, step S2 includes:

[0071] Step S21, monitoring events of the target virtual subnet;

[0072] Step S22: When an event of creating a network port in the target virtual subnet is monitored, access configuration is performed on the target virtual subnet based on the target network policy configuration.

[0073] In an embodiment of the present invention, by monitoring events of the target virtual subnet, when an event of creating a network port in the target virtual subnet is monitored, access configuration is performed on the target virtual subnet based on the target network policy configuration, so that the target virtual subnet can access at least one virtual subnet allowed to be accessed in the target network policy configuration through the created network port.

[0074] In an embodiment of the present invention, monitoring the events of the target virtual subnet may be monitoring the events of the target virtual subnet through a network plug-in, and the network plug-in may be a container network interface (CNI). Among them, a CNI plug-in is usually an executable program file, which is called by a container orchestration system (such as Kubernetes), responsible for inserting a network interface into the network namespace of the container and performing necessary tasks on the host to complete the virtual network configuration. These plug-ins can be developed and deployed independently of the container runtime environment, thereby providing a high degree of flexibility and scalability. CNI plug-ins can support multiple network modes, including overlay networks and direct connection modes, etc., to meet different network requirements and performance requirements.

[0075] Furthermore, in the case where the address of the network of the virtual subnet allowed to access by the target virtual subnet needs to be adjusted again, since the network port of the target virtual subnet has been created, there is no need to monitor it. Instead, the access to the target virtual subnet is reconfigured directly according to the updated target network policy so that the virtual subnet can access the updated virtual subnet.

[0076] In one embodiment, step S22 includes:

[0077] Step S221, performing access configuration on the target virtual subnet based on the target network policy through the target function;

[0078] The target function is an Internet Protocol IP table rule, an Open vSwitch (OVS) flow table, an IP virtual server or an extended Berkeley Packet Filter (eBPF) hook.

[0079] In an embodiment of the present invention, access configuration is performed on the target virtual subnet through IP Table rules, OVS flow tables, IP virtual servers or eBPF hooks, so that the configured target virtual subnet can access at least one target virtual subnet allowed to access in the target network policy.

[0080] In the embodiment of the present invention, the IP Table rule is a summary of IP addresses and their representation methods, including information such as the classification of IP addresses, the association between IP addresses and virtual subnets, etc. The IP Table rule can be used to manage the address of at least one virtual subnet that the target virtual subnet is allowed to access.

[0081] In the embodiment of the present invention, OVS runs on each virtualized physical machine (such as VPC), and provides remote management functions, supports the OpenFlow protocol and the OVS basic data (Open vSwitch Database, OVSDB) management protocol, which is used to expose the port status of the switch and manage the behavior of the switch. The address of at least one virtual subnet that the target virtual subnet is allowed to access can be managed through the OVS flow table.

[0082] In an embodiment of the present invention, an IP Virtual Server (IPVS) is a unified entrance for client access, and is used to forward access requests to a real server at the back end according to a scheduling algorithm. Through the IP Virtual Server, the address management of at least one virtual subnet that the target virtual subnet is allowed to access can be achieved.

[0083] In the embodiment of the present invention, eBPF can efficiently filter and process network traffic at the data packet level, thereby achieving network security and traffic control. The eBPF hook can be used to manage the address of at least one virtual subnet that the target virtual subnet is allowed to access.

[0084] In one embodiment, the target virtual subnet includes at least one container or virtual machine in the intelligent computing center, and the at least one container or virtual machine is used to undertake the computing task. The at least one container or virtual machine accesses the public network through a virtual network card channel, and the virtual network card channel includes the virtual router and the virtual switch.

[0085] In an embodiment of the present invention, the computing task is specifically carried by a container or a virtual machine, and the container or the virtual machine can access the public network through a virtual network card channel, thereby realizing data transmission and interaction of the computing task.

[0086] Among them, one or more containers or virtual machines can be set in the target virtual subnet. Different containers or virtual machines carry different computing tasks. Figure 2 The virtual router and virtual switch shown enable access to a public network.

[0087] See also Figure 3 , Figure 3 is a structural diagram of a computing task network isolation device for an intelligent computing center provided by an embodiment of the present invention, wherein the intelligent computing center includes multiple virtual subnets, such as Figure 3 As shown, the device 300 includes:

[0088] An acquisition module 301 is used to acquire a target network policy corresponding to the computing task, wherein the target network policy includes an address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets;

[0089] Configuration module 302 is used to configure access to the target virtual subnet based on the target network policy, and the access configuration is used to enable the target virtual subnet to access at least one virtual subnet through the address, and the target virtual subnet is the virtual subnet among the multiple virtual subnets that includes the computing task.

[0090] In one embodiment, the acquisition module 301 includes:

[0091] An acquisition unit, configured to acquire an initial network policy and an address of the at least one virtual subnet, wherein the initial network policy is a network policy pre-configured when creating the target virtual subnet;

[0092] An adjusting unit is used to adjust the initial network policy to an address that allows access to the at least one virtual subnet, so as to obtain the target network policy.

[0093] In one embodiment, the configuration module 302 includes:

[0094] A monitoring unit, used for monitoring events of the target virtual subnet;

[0095] The configuration unit is used to perform access configuration on the target virtual subnet based on the target network policy configuration when an event of creating a network port in the target virtual subnet is monitored.

[0096] In one embodiment, the configuration unit includes:

[0097] A configuration subunit, configured to perform access configuration on the target virtual subnet based on the target network policy through a target function;

[0098] The target function is an Internet Protocol IP table rule, an Open Virtual Switch OVS flow table, an IP virtual server or an extended Berkeley Packet Filter eBPF hook.

[0099] In one embodiment, the address of the at least one virtual subnet includes the address of the virtual router of the intelligent computing center, the virtual router is communicatively connected with the virtual switch of the intelligent computing center, and the virtual switch is used to access the public network.

[0100] In one embodiment, the target virtual subnet includes at least one container or virtual machine in the intelligent computing center, and the at least one container or virtual machine is used to undertake the computing task. The at least one container or virtual machine accesses the public network through a virtual network card channel, and the virtual network card channel includes the virtual router and the virtual switch.

[0101] The computing power task network isolation device of the intelligent computing center provided in the embodiment of the present invention is capable of implementing the various processes of the various embodiments of the computing power task network isolation method of the above-mentioned intelligent computing center. The technical features correspond one to one and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0102] It should be noted that the computing power task network isolation device of the intelligent computing center in the embodiment of the present invention can be a device, or a component, integrated circuit, or chip in an electronic device.

[0103] The embodiment of the present invention further provides an electronic device, see Figure 4 , Figure 4 4 is a schematic diagram of a structure of an electronic device provided by the present invention, the electronic device includes a memory 401, a processor 402 and a program or instruction stored in the memory 401 and running thereon, and when the program or instruction is executed by the processor 402, it can be realized Figure 1 Any steps in the corresponding embodiment of the computing power task network isolation method of the intelligent computing center and the same beneficial effects achieved will not be repeated here.

[0104] The processor 402 may be a CPU, an ASIC, an FPGA or a GPU.

[0105] A person skilled in the art can understand that all or part of the steps of the embodiment of the computing task network isolation method for the above-mentioned intelligent computing center can be completed by hardware related to program instructions, and the program can be stored in a readable medium.

[0106] The embodiment of the present invention further provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned Figure 1 The corresponding steps in the embodiment of the computing power task network isolation method of the intelligent computing center can achieve the same technical effect. To avoid repetition, they are not repeated here. The storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0107] The embodiment of the present invention also provides a computer program product, including computer instructions, which can achieve the above-mentioned Figure 1 Any step in the corresponding intelligent computing center computing power task network isolation method embodiment can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0108] The terms "first", "second" etc. in the embodiments of the present invention are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. In addition, the terms "include" and "have" and any variation thereof are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment. In addition, "and / or" is used in the present application to represent at least one of the connected objects, such as A and / or B and / or C, indicating that A alone, B alone, C alone, and A and B all exist, B and C all exist, A and C all exist, and 7 situations in which A, B and C all exist.

[0109] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0110] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a second terminal device, etc.) to execute the methods of each embodiment of the present application.

[0111] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for isolating computing task networks in an intelligent computing center, wherein the intelligent computing center includes multiple virtual subnets, characterized in that: The method comprises: Step S1: obtaining a target network policy corresponding to the computing task, wherein the target network policy includes an address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets; Step S2: perform access configuration on the target virtual subnet based on the target network policy, wherein the access configuration is used to enable the target virtual subnet to access the at least one virtual subnet through the address, and the target virtual subnet is a virtual subnet among the multiple virtual subnets that includes the computing task.

2. The method according to claim 1, characterized in that The step S1 comprises: Step S11, obtaining an initial network policy and an address of the at least one virtual subnet, wherein the initial network policy is a network policy pre-configured when creating the target virtual subnet; Step S12: Adjust the initial network policy to an address that allows access to the at least one virtual subnet to obtain the target network policy.

3. The method according to claim 1, characterized in that The step S2 comprises: Step S21, monitoring events of the target virtual subnet; Step S22: When an event of creating a network port in the target virtual subnet is monitored, access configuration is performed on the target virtual subnet based on the target network policy configuration.

4. The method according to claim 3, characterized in that The step S22 comprises: Step S221, performing access configuration on the target virtual subnet based on the target network policy through the target function; The target function is an Internet Protocol IP table rule, an Open Virtual Switch OVS flow table, an IP virtual server or an extended Berkeley Packet Filter eBPF hook.

5. The method according to any one of claims 1 to 4, characterized in that The address of the at least one virtual subnet includes the address of the virtual router of the intelligent computing center, the virtual router is communicatively connected with the virtual switch of the intelligent computing center, and the virtual switch is used to access the public network.

6. The method according to claim 5, characterized in that The target virtual subnet includes at least one container or virtual machine in the intelligent computing center, and the at least one container or virtual machine is used to undertake the computing task. The at least one container or virtual machine accesses the public network through a virtual network card channel, and the virtual network card channel includes the virtual router and the virtual switch.

7. A computing task network isolation device for an intelligent computing center, the intelligent computing center comprising a plurality of virtual subnets, characterized in that: The device comprises: An acquisition module, used to acquire a target network policy corresponding to the computing task, wherein the target network policy includes an address of at least one virtual subnet that the computing task is allowed to access, and the at least one virtual subnet is a subnet among multiple virtual subnets; A configuration module is used to configure access to the target virtual subnet based on the target network policy, wherein the access configuration is used to enable the target virtual subnet to access at least one virtual subnet through the address, and the target virtual subnet is a virtual subnet among the multiple virtual subnets that includes the computing task.

8. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the computing power task network isolation method of the intelligent computing center as described in any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the computing power task network isolation method of the intelligent computing center as described in any one of claims 1 to 6.

10. A computer program product, characterized in that It includes computer instructions, which, when executed by a processor, implement the steps of the computing power task network isolation method of the intelligent computing center as described in any one of claims 1 to 6.

Images