Data processing method of distributed database based on Kerberos authentication

Abstract

The invention provides a data processing method and device of a distributed database based on Kerberos authentication, equipment and a storage medium, and can be applied to the technical field of distributed database storage. The data processing method of the distributed database based on Kerberos authentication comprises the following steps: in response to a received data processing instruction sent by a client, determining a target external service related to the data processing instruction; according to the target external service, a target key object is determined from a key storage system, and the key storage system is deployed at a preset data node of a distributed database; acquiring target attribute information from the target key object, and acquiring a target file from the target key object under the condition that a file of which the attribute information is the target attribute information is not searched from the preset directory; storing the target file in a preset directory; and accessing the target external service by using the target file so as to carry out data processing through the target external service.

Description

Technical Field

[0001] The present invention relates to the field of distributed database storage technology, and more specifically to a distributed database data processing method, device, equipment, medium and program product based on Kerberos authentication when accessing external services. Background Art

[0002] With the development of distributed systems and database technology, in order to improve the computing and storage performance of the database and expand more abundant data sources, functions such as multi-computing nodes, storage and computing separation, and external data loading have emerged. Kerberos is an identity authentication protocol based on symmetric key technology. It is mainly used for identity authentication in computer networks and is widely used in databases and big data components. Its feature is that users only need to enter authentication information once to access other external data products with the authorization ticket (TGT) obtained through authentication. Therefore, if a distributed database wants to access other data products, support for Kerberos authentication is essential.

[0003] The traditional Kerberos authentication method requires first deploying the Kerberos configuration file and Keytab file on the database node, and then completing the Kerberos authentication through the command line or interface, etc. However, due to the large number of database nodes in the distributed database, the manual deployment method is inefficient. Summary of the invention

[0004] In view of the above problems, the present invention provides a data processing method, apparatus, device, medium and program product for a distributed database based on Kerberos authentication.

[0005] According to a first aspect of the present invention, there is provided a data processing method for a distributed database based on Kerberos authentication, comprising: in response to receiving a data processing instruction issued by a client, determining a target external service related to the data processing instruction; determining a target key object from a key storage system according to the target external service, wherein the key storage system is deployed at a preset data node of the distributed database, and the target key object includes information related to the Kerberos authentication of the target external service; obtaining target attribute information from the target key object, and obtaining a target file from the target key object if a file whose attribute information is the target attribute information is not found in a preset directory; storing the target file in the preset directory; and accessing the target external service using the target file to facilitate data processing through the target external service.

[0006] According to an embodiment of the present invention, the above-mentioned determining the target key object from the key storage system according to the above-mentioned target external service includes: determining the target access object corresponding to the above-mentioned target external service according to the above-mentioned target external service; obtaining the target key object identifier from the above-mentioned target access object; calling the first interface to access the above-mentioned key storage system; and determining the above-mentioned target key object from the above-mentioned key storage system according to the above-mentioned target key object identifier.

[0007] According to an embodiment of the present invention, the above-mentioned use of the above-mentioned target file to access the above-mentioned target external service includes: calling the second interface to access the Kerberos authentication server; using the above-mentioned target file to interact with the above-mentioned Kerberos authentication server to obtain the authority authentication information sent by the above-mentioned Kerberos authentication server, wherein the above-mentioned authority authentication information includes identity information with access rights to the above-mentioned target external service; and based on the above-mentioned target access object, using the above-mentioned authority authentication information to access the above-mentioned target external service.

[0008] According to an embodiment of the present invention, the above-mentioned use of the above-mentioned target file to interact with the above-mentioned Kerberos authentication server to obtain the authority authentication information sent by the above-mentioned Kerberos authentication server includes: obtaining identity information from the above-mentioned target file; sending the above-mentioned identity information to the above-mentioned Kerberos authentication server to obtain the identity authentication information returned by the above-mentioned Kerberos authentication server; caching the above-mentioned identity authentication information; sending the above-mentioned identity authentication information to the above-mentioned Kerberos authentication server to obtain the authority authentication information of the above-mentioned Kerberos authentication server for the above-mentioned identity authentication information.

[0009] According to an embodiment of the present invention, the above method also includes: when it is determined that historical identity authentication information is stored in the cache, determining whether the above historical identity authentication information is valid based on the current time and the validity period of the above historical identity authentication information; when it is determined that the above historical identity authentication information is valid, using the above historical identity authentication information as the above identity authentication information, so as to interact with the above Kerberos authentication server using the above identity authentication information to obtain the above authority authentication information; when it is determined that the above historical identity authentication information is not stored in the above cache, sending the above identity information to the above Kerberos authentication server to obtain the identity authentication information returned by the above Kerberos authentication server.

[0010] According to an embodiment of the present invention, the target key object identifier includes a first target key object identifier and a second target key object identifier, the target key object includes a first target key object and a second target key object, the target file includes a first target file and a second target file, and determining the target key object from the key storage system according to the target key object identifier includes: determining the first target key object from the key storage system according to the first target key object identifier, wherein the first target key object includes the first target file, and the first target file includes configuration information related to Kerberos authentication; and determining the second target key object from the key storage system according to the second target key object identifier, wherein the second target key object includes the second target file, and the second target file includes key information related to Kerberos authentication of the target external service.

[0011] According to an embodiment of the present invention, the above-mentioned preset directory includes a first preset directory and a second preset directory, and the above-mentioned storing the above-mentioned target file in the above-mentioned preset directory includes: storing the above-mentioned first target file in the above-mentioned first preset directory to deploy the Kerberos authentication server; and storing the above-mentioned second target file in the above-mentioned second preset directory.

[0012] The second aspect of the present invention provides a data processing device for a distributed database based on Kerberos authentication, comprising: a service determination module, for determining a target external service related to the data processing instruction in response to receiving a data processing instruction issued by a client; a key determination module, for determining a target key object from a key storage system according to the target external service, wherein the key storage system is deployed at a preset data node of the distributed database, and the target key object includes information related to the Kerberos authentication of the target external service; a file acquisition module, for acquiring target attribute information from the target key object, and acquiring a target file from the target key object if a file whose attribute information is the target attribute information is not found in a preset directory; a file storage module, for storing the target file in the preset directory; a service access module, for accessing the target external service using the target file, so as to facilitate data processing through the target external service.

[0013] A third aspect of the present invention provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present invention further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the above method.

[0015] The fifth aspect of the present invention also provides a computer program product, including a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0016] According to an embodiment of the present invention, a key storage system is used to store Kerberos authentication files in the form of key objects, which facilitates the management of Kerberos authentication files. When an execution node needs to access an external service, the target file is obtained from the target key object and automatically stored, thereby avoiding manual deployment of files, thereby improving deployment efficiency. In addition, verification of target attribute information is added before storing the target file, reducing unnecessary network transmission and file system operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0018] Figure 1 An application scenario diagram of a distributed database data processing method, apparatus, device, medium, and program product based on Kerberos authentication according to an embodiment of the present invention is shown.

[0019] Figure 2 A flow chart of a data processing method of a distributed database based on Kerberos authentication according to an embodiment of the present invention is shown.

[0020] Figure 3 A flowchart of accessing a target external service according to a specific embodiment of the present invention is shown.

[0021] Figure 4 A flowchart of obtaining authority authentication information according to a specific embodiment of the present invention is shown.

[0022] Figure 5 A structural block diagram of a data processing device for a distributed database based on Kerberos authentication according to an embodiment of the present invention is shown.

[0023] Figure 6 A block diagram of an electronic device suitable for implementing a data processing method of a distributed database based on Kerberos authentication according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0024] Below, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of concepts of the present invention.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] Since there are a large number of database nodes in the distributed database, the manual deployment of Kerberos files faces the problem of difficulty in multi-node deployment. And since different external services correspond to different Kerberos files, as the number of different Kerberos files increases, the management and deployment of Kerberos files becomes increasingly difficult. The present invention uses key objects to store Kerberos files, which are stored in the distributed database in the form of metadata. When a database node needs to access an external service, the key object is used to automatically deploy the Kerberos files required for Kerberos authentication in the database node. And by adding verification of the Kerberos file before deploying the file, downloading of duplicate Kerberos files is avoided.

[0029] An embodiment of the present invention provides a data processing method for a distributed database based on Kerberos authentication. In response to receiving a data processing instruction issued by a client, a target external service related to the data processing instruction is determined; according to the target external service, a target key object is determined from a key storage system, wherein the key storage system is deployed at a preset data node of the distributed database, and the target key object includes information related to the Kerberos authentication of the target external service; target attribute information is obtained from the target key object, and when a file identical to the target attribute information is not searched in a preset directory, a target file is obtained from the target key object; the target file is stored in a preset directory; and the target external service is accessed using the target file to facilitate data processing through the target external service.

[0030] Figure 1 An application scenario diagram of a distributed database data processing method, apparatus, device, medium, and program product based on Kerberos authentication according to an embodiment of the present invention is shown.

[0031] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 110, a distributed database 120, a Kerberos authentication server 130, and an external server 140, wherein the distributed database 120 includes a first database node 121 and a second database node 122. The network 110 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, the distributed database 120, the Kerberos authentication server 130, and the external server 140. The network 110 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0032] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the distributed database 120 through the network 110 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0033] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0034] The distributed database 120 may be a database server that provides data storage and computing services, may perform data processing on received user requests and other data, and may feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0035] The Kerberos authentication server 130 may be a server that provides Kerberos authentication, and is used to authenticate an authentication subject and send authentication information to the authentication subject.

[0036] The external server 140 can be a server that provides various services, and can perform data processing on the data processing requests sent by the first database node 121 and the second database node 122, such as storing data, deleting data, modifying data, querying data, migrating data, and cloud computing, and return the processing results to the first database node 121 and the second database node 122.

[0037] It should be noted that the data processing method of the distributed database based on Kerberos authentication provided in the embodiment of the present invention can generally be executed by the first database node 121 or the second database node 122. Accordingly, the data processing device of the distributed database based on Kerberos authentication provided in the embodiment of the present invention can generally be set in the first database node 121 or the second database node 122. The data processing method of the distributed database based on Kerberos authentication provided in the embodiment of the present invention can also be executed by a server or server cluster that is different from the first database node 121 and the second database node 122 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103, the Kerberos authentication server 130, the external server 140 and / or the first database node 121 and the second database node 122. Correspondingly, the data processing device of the distributed database based on Kerberos authentication provided in the embodiment of the present invention can also be set in a server or server cluster that is different from the first database node 121 and the second database node 122 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103, the Kerberos authentication server 130, the external server 140 and / or the first database node 121 and the second database node 122.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, database nodes, Kerberos servers and external servers in the embodiment is only for illustration. According to the implementation requirements, there can be any number of terminal devices, networks, database nodes, Kerberos servers and external servers.

[0039] Figure 2 A flow chart of a data processing method of a distributed database based on Kerberos authentication according to an embodiment of the present invention is shown.

[0040] like Figure 2 As shown, the data processing method of the distributed database based on Kerberos authentication in this embodiment includes operations S210 to S250.

[0041] In operation S210 , in response to receiving a data processing instruction issued by a client, a target external service related to the data processing instruction is determined.

[0042] According to an embodiment of the present invention, a user of a distributed database can issue a data processing instruction through a client, and a coordination node in the distributed database receives the data processing instruction and forwards the data processing instruction to an execution node capable of processing the data processing instruction. The data processing method of a distributed database based on Kerberos authentication of the present invention can be executed by an execution node in the distributed database.

[0043] According to an embodiment of the present invention, in response to receiving a data processing instruction, the execution node determines a target external service related to the data processing instruction from the data processing instruction.

[0044] According to an embodiment of the present invention, since the execution node may rely on external services when processing the data processing instruction, the relevant target external service can be determined according to the data processing instruction. The target external service can be other databases that require Kerberos authentication or big data components that require Kerberos authentication, and there is no restriction on this.

[0045] In operation S220, a target key object is determined from the key storage system according to the target external service.

[0046] According to an embodiment of the present invention, the key storage system is deployed on a preset data node of a distributed database. Specifically, the preset data node may be the same as the execution node, or may be another data node different from the execution node.

[0047] According to an embodiment of the present invention, there are multiple key objects in the key storage system, and the key objects include information related to Kerberos authentication of external services. Each key object may correspond to one external service or multiple external services.

[0048] According to an embodiment of the present invention, the target key object includes information related to the Kerberos authentication of the target external service. Specifically, the target key object can be determined from the key storage system using the key object name corresponding to the target external service.

[0049] In operation S230, target attribute information is obtained from the target key object, and when no file having attribute information equal to the target attribute information is found in the preset directory, a target file is obtained from the target key object.

[0050] According to an embodiment of the present invention, a key object may include attribute information and a file, wherein the attribute information may be attribute information of the file, such as the file's authority, owner, referrer, and message digest (Message Digest Algorithm 5, MD5), etc.

[0051] According to an embodiment of the present invention, the preset directory may be a directory in the execution node for storing files required for Kerberos authentication. The target file may be a file required for Kerberos authentication corresponding to the target external service. Specifically, the target file may include a configuration file and a key (Keytab) file for Kerberos authentication. The configuration file may include the environment required for Kerberos authentication, etc., for the configuration of the Kerberos authentication server. The Keytab file may include the key required for the execution node to perform Kerberos authentication corresponding to the target external service.

[0052] According to an embodiment of the present invention, after the execution node obtains the target data information from the target key object, it searches for the target attribute information in the preset directory, and if it is determined that the target attribute information is not found, it is determined that the target file is not stored in the preset directory, and the target file is obtained from the target key object. Specifically, the target attribute information may be the MD5 value of the target file.

[0053] In operation S240, the target file is stored in a preset directory.

[0054] According to an embodiment of the invention, after obtaining the target file from the target key object, the target file may be stored in a preset directory.

[0055] According to an embodiment of the present invention, when the execution node determines that a file with the same target attribute information is searched from a preset directory, it does not obtain the target file from the target key object, thereby reducing unnecessary network transmission and file system operations.

[0056] In operation S250, a target external service is accessed using the target file to facilitate data processing through the target external service.

[0057] According to an embodiment of the present invention, when the execution node determines that the target file is stored in the preset directory, the target external service can be accessed using the target file. Specifically, the target file can be used for Kerberos authentication, and when the target external service determines that the execution node passes the Kerberos authentication, the execution node is given access rights.

[0058] According to an embodiment of the present invention, after determining that Kerberos authentication has been passed, the execution node can perform data processing together with the target external service according to the data processing instruction. For example, data can be obtained from the target external service and stored in the execution node.

[0059] According to an embodiment of the present invention, a key storage system is used to store Kerberos authentication files in the form of key objects, which facilitates the management of Kerberos authentication files. When an execution node needs to access an external service, the target file is obtained from the target key object and automatically stored, thereby avoiding manual deployment of files, thereby improving deployment efficiency. In addition, verification of target attribute information is added before storing the target file, reducing unnecessary network transmission and file system operations.

[0060] According to an embodiment of the present invention, before executing the data processing method of a distributed database based on Kerberos authentication, it also includes: creating corresponding Kerberos files for multiple external services in a preset path; for each Kerberos file, obtaining the Kerberos file from the preset path, and creating a key object for the Kerberos file.

[0061] According to an embodiment of the present invention, a key object is created for a Kerberos file, including: in response to receiving a key object creation instruction, obtaining permission information of the Kerberos file, and calculating an MD5 value based on the file content of the Kerberos file; generating attribute information based on the permission information and the MD5 value; obtaining a key object identifier from the key object creation instruction; and generating a key object based on the key object identifier, the attribute information and the Kerberos file.

[0062] According to an embodiment of the present invention, when creating a key object for a Kerberos file, a database administrator can implement key object creation through a structured query language (SQL) statement to operate the Kerberos file in a preset path. Specifically, the SQL statement for creating a key object can be create secret "key object identifier" from file "preset path".

[0063] According to an embodiment of the present invention, after creating a key object, the key object can be stored in a key storage system by calling an interface, so that an execution node in a distributed database can obtain the key object from the key storage system.

[0064] According to an embodiment of the present invention, a target key object is determined from a key storage system according to a target external service, including: determining a target access object corresponding to the target external service according to the target external service; obtaining a target key object identifier from the target access object; calling a first interface to access the key storage system; and determining the target key object from the key storage system according to the target key object identifier.

[0065] According to an embodiment of the present invention, the target access object can be used to encapsulate the execution node's access and operation to the target external service. Specifically, the target access object can include a call interface of the target external service, and the execution node implements interaction with the target external service through the interface.

[0066] According to an embodiment of the present invention, the target key object identifier is pre-referenced to the target access object by a database administrator. Specifically, the existing access object can be specified to reference the target key object identifier in a SQL manner.

[0067] According to an embodiment of the present invention, since the execution node will access external services through an access object, the present invention references the corresponding key object identifier in the access object. When the execution node needs to access the external service, the corresponding target key object is directly obtained from the key storage system according to the key object identifier referenced in the access object, without the need to interact with the key storage system through a coordination node, thereby saving computing resources.

[0068] According to an embodiment of the present invention, the first interface may be an interface for accessing the key storage system. Since the key storage system may be deployed on other data nodes different from the execution node, the execution node needs to access the key storage system by calling the first interface.

[0069] According to an embodiment of the present invention, since the key object has a pre-configured key object identifier, the corresponding target key object can be searched in the key storage system according to the target key object identifier. Specifically, the execution node can send a request for obtaining the target key object to the key storage system through the first interface, wherein the request includes the target key identifier; after receiving the request, the key storage system obtains the target key object identifier from the request, and searches for the target key object according to the target key object identifier; after finding the target key object, the key storage system sends the target key object to the execution node through the first interface.

[0070] According to an embodiment of the present invention, by referencing the target key object identifier in the target access object, the execution node can directly use the target key object referenced in the target access object when accessing an external service to obtain the corresponding target key object from the key storage system, thereby improving the efficiency of Kerberos file deployment.

[0071] According to an embodiment of the present invention, determining a target key object from a key storage system according to a target key object identifier includes: determining a first target key object from the key storage system according to a first target key object identifier; and determining a second target key object from the key storage system according to a second target key object identifier.

[0072] According to an embodiment of the present invention, the target key object identifier includes a first target key object identifier and a second target key object identifier, the target key object includes a first target key object and a second target key object, and the target file includes a first target file and a second target file.

[0073] According to an embodiment of the present invention, the first target key object includes a first target file, and the first target file includes configuration information related to Kerberos authentication. Specifically, the first target file may be a Kerberos configuration file, such as krb5.conf.

[0074] According to an embodiment of the present invention, the second target key object includes a second target file, and the second target file includes key information related to Kerberos authentication of the target external service. Specifically, the second target file can be a key file, such as a Keytab file.

[0075] According to an embodiment of the present invention, since the Kerberos file includes a configuration file and a Keytab file, the first target key object identifier and the second target object identifier can be referenced simultaneously in the target access object so that the coordination node can obtain the corresponding first target key object and the second target key object respectively.

[0076] According to the embodiment of the present invention, the first target key object and the second target key object are respectively obtained through the first target key object identifier and the second target key object identifier, thereby improving efficiency.

[0077] According to an embodiment of the present invention, storing a target file in a preset directory includes: storing a first target file in a first preset directory to deploy a Kerberos authentication server; and storing a second target file in a second preset directory.

[0078] Usually, during manual deployment, configuration files are stored in the directory by default. Therefore, users who do not have access to the / etc directory cannot obtain the configuration files. In addition, since different configuration files have the same file name and are stored in the / etc directory at the same time, file name conflicts will occur and it is not conducive to the management of multiple different configuration files.

[0079] According to an embodiment of the present invention, when a distributed database is deployed, the default path is overwritten by setting the environment variable KRB5_CONFIG, and the configuration file is stored in a user-specified directory, thereby avoiding the permission problem of the user being unable to access the / etc directory and facilitating the management of the configuration file.

[0080] According to an embodiment of the present invention, the preset directory includes a first preset directory and a second preset directory, wherein the first preset directory is used to store a first target file, ie, a configuration file, and the second preset directory is used to store a second target file, ie, a Keytab file.

[0081] According to an embodiment of the present invention, when the configuration file and the Keytab file are stored in a preset directory, different suffixes may be added to the configuration file and the Keytab file, respectively. Specifically, a .conf suffix is ​​added to the configuration file, and a .Keytab suffix is ​​added to the Keytab file.

[0082] According to an embodiment of the present invention, since the configuration file includes the configuration information and environment information required by the Kerberos authentication server, the Kerberos authentication server can be deployed on the execution node by storing the configuration file in the first preset directory.

[0083] According to the embodiment of the present invention, the first target file and the second target file are stored in the first preset directory and the second preset directory respectively, which facilitates management.

[0084] According to an embodiment of the present invention, using a target file to access a target external service includes: calling a second interface to access a Kerberos authentication server; using the target file to interact with the Kerberos authentication server to obtain authority authentication information sent by the Kerberos authentication server; and based on the target access object, using the authority authentication information to access the target external service.

[0085] According to an embodiment of the present invention, the second interface can be used to access the Kerberos authentication server. Specifically, the execution node can send an authentication request to the Kerberos authentication server through the second interface, and the Kerberos authentication service sends authentication information to the execution node through the second interface.

[0086] According to an embodiment of the present invention, after storing the target file in the execution node, the execution node can use the target file to interact with the Kerberos authentication server. The Kerberos authentication server authenticates the execution node based on the identity information and key information in the target file and returns the authentication result.

[0087] According to an embodiment of the present invention, the authority authentication information includes identity information having access rights to the target external service, and is used to prove to the target external service that the execution node has access rights. Specifically, the authority authentication information may be a service ticket (ST).

[0088] According to an embodiment of the present invention, after the execution node obtains the permission authentication information, it can access the target external service based on the target access object. Specifically, the execution node can send the permission authentication information to the target external service through the target external service access interface provided in the target access object, and the target external service authenticates the execution node according to the permission authentication information, and opens the access rights for the execution node when it is determined that the execution node has passed the authentication, so that the execution node can perform data processing according to the data processing instruction.

[0089] According to the embodiment of the present invention, the authority authentication information is obtained after the target file is authenticated, and the access to the target external service is achieved through the target access object, thereby improving the processing efficiency.

[0090] Figure 3 A flowchart of accessing a target external service according to a specific embodiment of the present invention is shown.

[0091] like Figure 3 As shown, accessing the target external service includes operations S310 to S370.

[0092] In operation S310 , the execution node sends an authentication request to a Kerberos authentication server.

[0093] According to an embodiment of the present invention, the authentication request may include identity information of the execution node.

[0094] In operation S320, the Kerberos authentication server authenticates the execution node.

[0095] In operation S330, the Kerberos authentication server sends authority authentication information to the execution node.

[0096] In operation S340 , the execution node sends permission authentication information to the target external service.

[0097] In operation S350, the target external server authenticates the execution node.

[0098] In operation S360, the target external server sends the authority granting information to the execution node.

[0099] According to an embodiment of the present invention, the permission granting information may be used to indicate that the target server is granted access rights to the target external server.

[0100] In operation S370, the execution node accesses the target external server.

[0101] According to an embodiment of the present invention, a target file is used to interact with a Kerberos authentication server to obtain permission authentication information sent by the Kerberos authentication server, including: obtaining identity information from the target file; sending identity information to the Kerberos authentication server to obtain identity authentication information returned by the Kerberos authentication server; caching the identity authentication information; sending identity authentication information to the Kerberos authentication server to obtain permission authentication information for the identity authentication information from the Kerberos authentication server.

[0102] According to an embodiment of the present invention, since the target file stores identity information that can be used to access the target external service, the execution node can obtain the identity information from the target file and use the identity information to obtain access rights to the target external service.

[0103] According to an embodiment of the present invention, when the execution node implements authentication by interacting with the Kerberos authentication server, identity information can be sent to the Kerberos authentication server through the first interface, and the Kerberos authentication server authenticates the identity information. If the authentication passes, the identity authentication information is sent to the execution node through the first interface.

[0104] According to an embodiment of the present invention, the identity authentication information indicates that the execution node has the authority to obtain the authority authentication information. Specifically, the identity authentication information may be a Ticket Granting Ticket (TGT).

[0105] According to an embodiment of the present invention, since the identity authentication information has a long validity period, after receiving the identity authentication information sent by the Kerberos authentication server, the execution node can store the identity authentication information in the cache. The next time the target external service needs to be accessed, the identity authentication information can be directly used for authentication to obtain the authority authentication information.

[0106] According to an embodiment of the present invention, after receiving the identity authentication information sent by the Kerberos authentication server, the execution node may send the identity authentication information to the Kerberos authentication server through the first interface to obtain the authority authentication information.

[0107] According to an embodiment of the present invention, by caching the identity authentication information, when the execution node accesses the target external server again, the identity authentication information can be directly obtained from the cache, thereby improving the authentication efficiency.

[0108] According to an embodiment of the present invention, the method for obtaining authority authentication information also includes: when it is determined that historical identity authentication information is stored in the cache, determining whether the historical identity authentication information is valid based on the current time and the validity period of the historical identity authentication information; when it is determined that the historical identity authentication information is valid, using the historical identity authentication information as identity authentication information, so as to interact with the Kerberos authentication server using the identity authentication information to obtain authority authentication information.

[0109] According to an embodiment of the present invention, when there is corresponding historical identity authentication information in the execution node, the historical identity authentication information can be used to obtain the authority authentication information. However, since the identity authentication information has a certain validity period, the validity of the historical identity authentication information needs to be verified before using it.

[0110] According to an embodiment of the present invention, when determining the validity period of historical identity authentication information, whether the historical identity authentication information is valid can be determined by determining whether the current moment is within the validity period of the historical identity authentication information. If the current moment is within the validity period, it means that the historical identity authentication information is valid; if the current moment is not within the validity period, it means that the historical identity authentication information is invalid.

[0111] According to an embodiment of the present invention, when it is determined that the historical identity authentication information is invalid, the historical identity authentication information can be refreshed to extend the validity period of the historical identity authentication information. When it is indeed impossible to refresh the historical identity authentication information, it is determined that the historical identity authentication information is completely invalid.

[0112] According to an embodiment of the present invention, when it is determined that no historical identity authentication information is stored in the cache, the identity information is sent to the Kerberos authentication server to obtain the identity authentication information returned by the Kerberos authentication server.

[0113] According to the embodiment of the present invention, the authentication processing efficiency is improved by interacting with the Kerberos authentication server using the historical identity authentication information stored in the cache.

[0114] Figure 4 A flowchart of obtaining authority authentication information according to a specific embodiment of the present invention is shown.

[0115] like Figure 4 As shown, obtaining authority authentication information includes operations S401 to S408.

[0116] In operation S401, a target external service is determined.

[0117] In operation S402, it is determined whether the cache stores historical identity authentication information corresponding to the target external service. If it is determined that the cache does not store historical identity authentication information corresponding to the target external service, operation S403 is performed, otherwise operation S407 is performed.

[0118] In operation S403, a target key object corresponding to the target external service is determined.

[0119] In operation S404, according to the target attribute information in the target key object, it is determined whether a file identical to the target attribute information is stored in the preset directory. If it is determined that no file identical to the target attribute information is stored in the preset directory, operation S405 is performed, otherwise operation S406 is performed.

[0120] In operation S405, the target file in the target key object is stored in a preset directory.

[0121] In operation S406, authentication is performed using the target file to obtain identity authentication information.

[0122] In operation S407, the historical identity authentication information is used as the identity authentication information.

[0123] In operation S408, the authority authentication information is obtained using the identity authentication information.

[0124] Based on the above-mentioned distributed database data processing method based on Kerberos authentication, the present invention also provides a distributed database data processing device based on Kerberos authentication. Figure 5 The device is described in detail.

[0125] Figure 5 A structural block diagram of a data processing device for a distributed database based on Kerberos authentication according to an embodiment of the present invention is shown.

[0126] like Figure 5 As shown, the data processing device 500 of the distributed database based on Kerberos authentication in this embodiment includes a service determination module 510 , a key determination module 520 , a file acquisition module 530 , a file storage module 540 and a service access module 550 .

[0127] The service determination module 510 is used to determine the target external service related to the data processing instruction in response to receiving the data processing instruction sent by the client. In one embodiment, the service determination module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0128] The key determination module 520 is used to determine a target key object from a key storage system according to a target external service, wherein the key storage system is deployed in a preset data node of a distributed database, and the target key object includes information related to Kerberos authentication of the target external service. In one embodiment, the key determination module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0129] The file acquisition module 530 is used to obtain target attribute information from the target key object, and to obtain the target file from the target key object if no file with attribute information equal to the target attribute information is found in the preset directory. In one embodiment, the file acquisition module 530 can be used to perform the operation S230 described above, which will not be described in detail here.

[0130] The file storage module 540 is used to store the target file in a preset directory. In one embodiment, the file storage module 540 can be used to perform the operation S240 described above, which will not be described in detail here.

[0131] The service access module 550 is used to access the target external service using the target file, so as to perform data processing through the target external service. In one embodiment, the service access module 550 can be used to perform the operation S250 described above, which will not be described in detail here.

[0132] According to an embodiment of the present invention, the key determination module 520 includes an object determination submodule, an identification acquisition submodule, a storage access submodule and a key determination submodule.

[0133] The object determination submodule is used to determine the target access object corresponding to the target external service according to the target external service.

[0134] The identification acquisition submodule is used to obtain the target key object identification from the target access object.

[0135] The storage access submodule is used to call the first interface to access the key storage system.

[0136] The key determination submodule is used to determine the target key object from the key storage system according to the target key object identifier.

[0137] According to an embodiment of the present invention, the service access module 550 further includes an authentication access submodule, a permission acquisition submodule and a service access submodule.

[0138] The authentication access submodule is used to call the second interface to access the Kerberos authentication server.

[0139] The permission acquisition submodule is used to interact with the Kerberos authentication server using the target file to obtain the permission authentication information sent by the Kerberos authentication server, wherein the permission authentication information includes the identity information having the target external service access right.

[0140] The service access submodule is used to access the target external service based on the target access object and using the permission authentication information.

[0141] According to an embodiment of the present invention, the authority acquisition submodule includes an identity acquisition unit, an identity sending unit, an authentication cache unit and an authentication sending unit.

[0142] The identity acquisition unit is used to acquire identity information from a target file.

[0143] The identity sending unit is used to send identity information to the Kerberos authentication server to obtain identity authentication information returned by the Kerberos authentication server.

[0144] The authentication cache unit is used to cache identity authentication information.

[0145] The authentication sending unit is used to send identity authentication information to the Kerberos authentication server to obtain authority authentication information from the Kerberos authentication server for the identity authentication information.

[0146] According to an embodiment of the present invention, the authority acquisition submodule further includes a validity determination unit, a authority acquisition unit and an authentication acquisition unit.

[0147] The validity determination unit is used to determine whether the historical identity authentication information is valid according to the current time and the validity period of the historical identity authentication information when it is determined that the historical identity authentication information is stored in the cache.

[0148] The authority acquisition unit is used to use the historical identity authentication information as the identity authentication information when determining that the historical identity authentication information is valid, so as to interact with the Kerberos authentication server using the identity authentication information to obtain the authority authentication information.

[0149] The authentication acquisition unit is used to send identity information to a Kerberos authentication server when it is determined that no historical identity authentication information is stored in the cache, so as to obtain the identity authentication information returned by the Kerberos authentication server.

[0150] According to an embodiment of the present invention, the target key object identifier includes a first target key object identifier and a second target key object identifier, the target key object includes a first target key object and a second target key object, and the target file includes a first target file and a second target file.

[0151] According to an embodiment of the present invention, the key determination submodule includes a first determination unit and a second determination unit.

[0152] The first determining unit is used to determine a first target key object from a key storage system according to a first target key object identifier, wherein the first target key object includes a first target file, and the first target file includes configuration information related to Kerberos authentication.

[0153] The second determining unit is used to determine the second target key object from the key storage system according to the second target key object identifier, wherein the second target key object includes a second target file, and the second target file includes key information related to Kerberos authentication of the target external service.

[0154] According to an embodiment of the present invention, the preset directory includes a first preset directory and a second preset directory.

[0155] According to an embodiment of the present invention, the file storage module 540 includes a first storage submodule and a second storage submodule.

[0156] The first storage submodule is used to store the first target file in a first preset directory to deploy the Kerberos authentication server.

[0157] The second storage submodule is used to store the second target file in a second preset directory.

[0158] According to an embodiment of the present invention, any multiple modules of the service determination module 510, the key determination module 520, the file acquisition module 530, the file storage module 540 and the service access module 550 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the service determination module 510, the key determination module 520, the file acquisition module 530, the file storage module 540 and the service access module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the service determination module 510, the key determination module 520, the file acquisition module 530, the file storage module 540 and the service access module 550 may be at least partially implemented as a computer program module, which may perform a corresponding function when executed.

[0159] Figure 6 A block diagram of an electronic device suitable for implementing a data processing method of a distributed database based on Kerberos authentication according to an embodiment of the present invention is shown.

[0160] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present invention includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0161] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0162] According to an embodiment of the present invention, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0163] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0164] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0165] The embodiment of the present invention also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the data processing of the distributed database based on Kerberos authentication provided by the embodiment of the present invention.

[0166] The computer program executes the above functions defined in the system / device of the embodiment of the present invention when it is executed by the processor 601. According to the embodiment of the present invention, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0167] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0168] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present invention are performed. According to the embodiment of the present invention, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0169] According to an embodiment of the present invention, the program code for executing the computer program provided by the embodiment of the present invention can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0170] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0171] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present invention may be combined and / or combined in various ways, even if such combinations and / or combinations are not explicitly described in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features described in the various embodiments of the present invention may be combined and / or combined in various ways. All of these combinations and / or combinations fall within the scope of the present invention.

[0172] The embodiments of the present invention are described above. However, these embodiments are only for the purpose of illustration, and are not intended to limit the scope of the present invention. Although each embodiment is described above, it does not mean that the measures in each embodiment cannot be used in combination advantageously. Without departing from the scope of the present invention, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present invention.

Claims

1. A data processing method for a distributed database based on Kerberos authentication, characterized in that: The method comprises: In response to receiving a data processing instruction issued by a client, determining a target external service associated with the data processing instruction; According to the target external service, determining a target key object from a key storage system, wherein the key storage system is deployed in a preset data node of a distributed database, and the target key object includes information related to Kerberos authentication of the target external service; Acquire target attribute information from the target key object, and if no file with attribute information equal to the target attribute information is found in the preset directory, acquire the target file from the target key object; Storing the target file in the preset directory; The target external service is accessed using the target file, so as to perform data processing through the target external service.

2. The method according to claim 1, characterized in that The step of determining a target key object from a key storage system according to the target external service includes: According to the target external service, determining a target access object corresponding to the target external service; Obtaining a target key object identifier from the target access object; Calling a first interface to access the key storage system; and The target key object is determined from the key storage system according to the target key object identifier.

3. The method according to claim 2, characterized in that The using the target file to access the target external service includes: Call the second interface to access the Kerberos authentication server; Using the target file to interact with the Kerberos authentication server, obtaining permission authentication information sent by the Kerberos authentication server, wherein the permission authentication information includes identity information having access rights to the target external service; and Based on the target access object, the target external service is accessed using the authority authentication information.

4. The method according to claim 3, characterized in that The step of utilizing the target file to interact with the Kerberos authentication server to obtain the authority authentication information sent by the Kerberos authentication server includes: Obtaining identity information from the target file; Sending the identity information to the Kerberos authentication server to obtain identity authentication information returned by the Kerberos authentication server; Cache the identity authentication information; The identity authentication information is sent to the Kerberos authentication server to obtain authority authentication information for the identity authentication information from the Kerberos authentication server.

5. The method according to claim 4, characterized in that The method further comprises: In the case where it is determined that historical identity authentication information is stored in the cache, determining whether the historical identity authentication information is valid according to the current time and the validity period of the historical identity authentication information; In the case where it is determined that the historical identity authentication information is valid, the historical identity authentication information is used as the identity authentication information, so as to interact with the Kerberos authentication server using the identity authentication information to obtain the authority authentication information; When it is determined that the historical identity authentication information is not stored in the cache, the identity information is sent to the Kerberos authentication server to obtain the identity authentication information returned by the Kerberos authentication server.

6. The method according to claim 2, characterized in that The target key object identifier includes a first target key object identifier and a second target key object identifier, the target key object includes a first target key object and a second target key object, the target file includes a first target file and a second target file, and determining the target key object from the key storage system according to the target key object identifier includes: Determining a first target key object from the key storage system according to the first target key object identifier, wherein the first target key object includes the first target file, and the first target file includes configuration information related to Kerberos authentication; and According to the second target key object identifier, a second target key object is determined from the key storage system, wherein the second target key object includes the second target file, and the second target file includes key information related to Kerberos authentication of the target external service.

7. The method according to claim 6, characterized in that The preset directory includes a first preset directory and a second preset directory, and storing the target file in the preset directory includes: storing the first target file in the first preset directory to deploy a Kerberos authentication server; and The second target file is stored in the second preset directory.

8. A data processing device for a distributed database based on Kerberos authentication, characterized in that: The device comprises: A service determination module, configured to determine a target external service related to a data processing instruction in response to receiving the data processing instruction issued by the client; A key determination module, configured to determine a target key object from a key storage system according to the target external service, wherein the key storage system is deployed in a preset data node of a distributed database, and the target key object includes information related to Kerberos authentication of the target external service; A file acquisition module, used to acquire target attribute information from the target key object, and acquire a target file from the target key object if no file with attribute information equal to the target attribute information is found in a preset directory; A file storage module, used for storing the target file in the preset directory; The service access module is used to access the target external service using the target file, so as to perform data processing through the target external service.

9. An electronic device, comprising: one or more processors; a memory for storing one or more programs, It is characterized in that when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the method according to any one of claims 1 to 7.

Images