Data access method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of data storage, and discloses a data access method and device, computer equipment and a storage medium, and the method comprises the steps: carrying out the timing statistics of the performance state information of a client under the condition that the client mounts a shared directory of a storage end to a local mounting point; for any client, under the condition that the performance state information of the client exceeds a preset threshold value, generating alarm information, and reporting the alarm information to a storage end, so that a user determines to-be-limited client information based on the alarm information of the storage end, and updates a blacklist of the storage end based on the to-be-limited client information; receiving a data access request sent by the client to the storage end; analyzing the data access request to obtain a target path of the data access request; and if the target path is in the directory access controlled list and the client identifier corresponding to the client is not in the white list, refusing the data access request. According to the invention, the data security of the storage end is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage, and in particular to a data access method, device, computer equipment and storage medium. Background Art

[0002] As an efficient file sharing technology, Network File System (NFS) allows different machines and operating systems to share files over the network. Due to its convenient deployment and simple maintenance, NFS has been widely used in Network Attached Storage (NAS) storage services, greatly facilitating users' need to access data at different times and locations.

[0003] In the related art, the directory in the NAS storage is exported through the NFS protocol, so that any client configured with the NFS service can connect to the NAS storage end through the network and access the data on the NAS storage end. In order to ensure the data security of the NAS storage end, a blacklist is set on the NAS storage end to restrict access to malicious clients.

[0004] However, this method of setting a blacklist on the NAS storage end is limited to the range of malicious clients known to users and cannot identify unknown malicious clients, resulting in low data security on the NAS storage end. Summary of the invention

[0005] In view of this, the present invention provides a data access method, apparatus, computer device and storage medium to solve the problem in the related art that unknown malicious clients cannot be identified, resulting in low data security on the NAS storage end.

[0006] In a first aspect, the present invention provides a data access method, the method comprising:

[0007] When the client mounts the shared directory of the storage end to the local mount point, regularly counting the performance status information of the client;

[0008] When the performance status information of the client exceeds a preset threshold, an alarm message is generated, and the alarm message is reported to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, and updates the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point;

[0009] Receiving a data access request to a storage end sent by the client;

[0010] Parsing the data access request to obtain a target path of the data access request;

[0011] Determine whether the target path is in a directory access controlled list, wherein the shared directories in the directory access controlled list are not allowed to be accessed;

[0012] If the target path is in the directory access controlled list, determine whether the client identifier of the client corresponding to the data access request is in the white list, wherein the clients in the white list are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end;

[0013] If the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected.

[0014] The data access method provided in this embodiment performs periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point. If the performance status information of any client exceeds the preset threshold, an alarm information is generated and reported to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, updates the blacklist of the storage end based on the client information to be restricted, receives the data access request to the storage end sent by the client, parses the data access request, obtains the target path of the data access request, determines whether the target path is in the directory access controlled list, and if the target path is in the directory access controlled list, determines whether the client identifier of the client corresponding to the data access request is in the whitelist; if the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected. By pre-identifying unknown malicious clients, the user determines the real malicious clients from the pre-identified unknown malicious clients, and adds the real malicious clients to the blacklist of the storage end, so that the malicious clients in the blacklist cannot mount the shared directory of the storage end to the local mount point, that is, cannot access the data of the storage end, thereby improving the data security of the storage end.

[0015] In an optional embodiment, the method further includes:

[0016] If the target path is not in the directory access controlled list, a corresponding operation is performed on the storage end based on the data access request.

[0017] The data access method provided in this embodiment can effectively prevent the client from accessing the controlled shared directory through the directory access controlled list, thereby reducing the risk of data leakage and malicious operation and ensuring the security of the storage end.

[0018] In an optional implementation, the periodically performing statistics on the performance status information of the client includes:

[0019] For any client, at least one of the following information is obtained periodically: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

[0020] The data access method provided in this embodiment obtains the performance status information of the client at regular intervals, understands the operating status of the client, promptly discovers the abnormality of the client, and realizes the pre-identification of unknown malicious clients. The user determines the real malicious clients from the pre-identified unknown malicious clients and adds the real malicious clients to the blacklist of the storage end, so that these malicious clients cannot access the data of the storage end, thereby improving the data security of the storage end.

[0021] In an optional implementation manner, when the performance status information of the client exceeds a preset threshold, generating alarm information includes:

[0022] When the number of handles opened by the client is greater than a preset handle opening threshold, obtaining the number of handles opened by multiple clients that mount the shared directory of the storage end to the local mount point;

[0023] Sort the clients according to the number of handles opened by the multiple clients from large to small;

[0024] Filter out a preset number of target clients that are ranked top;

[0025] Generate warning information based on the target client identifier corresponding to the target client;

[0026] When the number of input and output operations performed by the client on that day is greater than a preset operation threshold, and the amount of data accessed by the client on that day to the storage end is less than a preset data amount threshold, generating an alarm message based on the client identifier corresponding to the client;

[0027] When the connection status of the client is abnormal, generating alarm information based on the client identifier corresponding to the client;

[0028] When the connection status of the client is in a disconnected state for a first preset time period, generating an alarm message based on a client identifier corresponding to the client;

[0029] When the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period, an alarm message is generated based on a client identifier corresponding to the client.

[0030] The data access method provided in this embodiment monitors the performance status information of the client in real time, and generates an alarm message when the performance status information shows that the resource usage of the client exceeds a preset threshold, or the client is in an abnormal state, or the client is continuously in a disconnected state, or the client repeatedly switches between a normal state and a disconnected state, so that the user can determine the client identifier to be added to the blacklist of the storage end based on the alarm information, thereby identifying and blocking access to unknown malicious clients, making it impossible for these malicious clients to access the data on the storage end, thereby improving the data security of the storage end.

[0031] In an optional embodiment, the method further includes:

[0032] When the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, an alarm message is generated and reported to the storage end.

[0033] The data access method provided in this embodiment generates an alarm message when the number of clients mounting the shared directory of the storage end to the local mount point exceeds a preset connection threshold, so that the user can close some clients according to the alarm message to avoid affecting the normal operation of the business.

[0034] In an optional embodiment, the method further includes:

[0035] In response to a user's performance status information query operation, the performance status information of the client is sent to the storage end, so that the user can query the performance status information of the client from the storage end, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

[0036] The data access method provided in this embodiment allows the user to actively obtain the performance status information of the client, and update the blacklist of the storage end according to the performance status information of the client, thereby achieving the effect of timely discovering unknown malicious clients.

[0037] In an optional embodiment, the method further includes:

[0038] If the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request, an alarm message is generated and reported to the storage end.

[0039] The data access method provided in this embodiment, when the target path of the data access request is in the preset controlled access list but not in the white list, still performs corresponding operations on the storage end based on the data access request, that is, detects the client's access to the controlled directory, generates an alarm message, and enables the user to intervene immediately to avoid potential security threats or malicious behaviors.

[0040] In a second aspect, the present invention provides a data access device, the device comprising:

[0041] A statistics module, used for performing regular statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point;

[0042] A generating module, configured to generate alarm information when the performance status information of the client exceeds a preset threshold, and report the alarm information to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, and updates the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point;

[0043] A receiving module, used for receiving a data access request to a storage end sent by the client;

[0044] An acquisition module, used to parse the data access request and obtain a target path of the data access request;

[0045] A first determination module is used to determine whether the target path is in a directory access controlled list, wherein the shared directory in the directory access controlled list is not allowed to be accessed;

[0046] A second judgment module is used to judge whether the client identifier of the client corresponding to the data access request is in a white list if the target path is in the directory access controlled list, wherein the clients in the white list are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end;

[0047] The determination module is used to refuse to execute the data access request if the client identifier of the client corresponding to the data access request is not in the white list.

[0048] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the data access method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the data access method of the first aspect or any corresponding embodiment thereof.

[0050] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the data access method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 is a flow chart of a data access method according to an embodiment of the present invention;

[0053] Figure 2 is a schematic diagram of a structure for obtaining performance status information of a client and reporting alarm information according to an embodiment of the present invention;

[0054] Figure 3 is a flow chart of another data access method according to an embodiment of the present invention;

[0055] Figure 4 is a schematic diagram of processing a data access request according to an embodiment of the present invention;

[0056] Figure 5 is a structural block diagram of a data access device according to an embodiment of the present invention;

[0057] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0059] As an efficient file sharing technology, NFS allows different machines and different operating systems to share files over the network. Due to its convenient deployment, simple maintenance and easy use, NFS has been widely used in NAS storage services, greatly facilitating users' needs to access data at different times and locations.

[0060] In the related art, the directory in the NAS storage can be exported through the NFS protocol, so that any client configured with the NFS service can connect to the NAS storage end through the network and access the data on the NAS storage end. To ensure the data security of the NAS storage end, a blacklist and whitelist of the Internet Protocol (IP) is set in the NAS storage segment to block access by malicious clients, i.e. malicious client IPs.

[0061] However, this method of setting up a blacklist and whitelist on the NAS storage end to block malicious client IP access is limited by the malicious client IPs known to the user, and is unable to identify unknown malicious client IPs, resulting in the inability to timely block access to unknown malicious client IPs, resulting in low data security on the NAS storage end.

[0062] In addition, the NFS protocol does not provide effective identification and monitoring methods for the resource usage of clients connected to the NAS storage. It is possible that clients connected to the storage compete for resources with each other, or a single client occupies a large amount of system resources, making it impossible for other clients to use the system.

[0063] The embodiment of the present invention provides a data access method, which performs periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point, generates alarm information when the performance status information of the client exceeds a preset threshold, and reports the alarm information to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, updates the blacklist of the storage end based on the client information to be restricted, receives the data access request to the storage end sent by the client; parses the data access request to obtain the target path of the data access request; determines whether the target path is in the directory access controlled list; if the target path In the directory access controlled list, it is determined whether the client identifier of the client corresponding to the data access request is in the white list; if the client identifier of the client corresponding to the data access request is not in the white list, the data access request is refused to be executed, so as to issue an alarm based on the performance status information and realize the pre-identification of unknown malicious clients. The user determines the real malicious clients from the pre-identified unknown malicious clients and adds the real malicious clients to the blacklist of the storage end, so that the malicious clients in the blacklist cannot mount the shared directory of the storage end to the local mount point, that is, they cannot access the data on the storage end, thereby improving the data security of the storage end.

[0064] According to an embodiment of the present invention, a data access method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] In this embodiment, a data access method is provided, which can be used in the NFS protocol end. Figure 1 is a flow chart of a data access method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0066] Step S101, when the client mounts the shared directory of the storage end to the local mount point, the performance status information of the client is regularly counted.

[0067] The client mounts the shared directory of the storage end to the local mount point, which means that the client is not in the blacklist of the storage end and can mount the shared directory of the storage end. The storage end is a NAS storage end.

[0068] Figure 2 FIG. 1 is a schematic diagram of a structure for obtaining performance status information of a client and reporting alarm information according to an embodiment of the present invention. Figure 2As shown, the NFS protocol end is provided with a client monitoring module (stats_monitor), which is used to monitor the performance status information of the client, that is, to perform regular statistics on the performance status information of the client.

[0069] It should be noted that the NFS protocol side exists in the form of an NFS process on the NAS storage side. When the NFS process starts, the initialization of the client monitoring module is triggered, and a separate thread is created for it to independently complete the statistical work of the client's performance status information. Using an independent thread to implement the stats_montior module reduces the impact of the module on NFS performance.

[0070] When the client monitoring module is initialized, a timer is created to regularly trigger the statistical work of performance status information.

[0071] It should be noted that the shared directory of the storage end is exported to the NFS protocol end. After the client mounts the shared directory of the storage end to the local mount point, the client's client IP and other information will be sent to the storage end to inform the storage end that the client has completed the mount and record the client IP information in the cache of the NFS process.

[0072] Step S102, when the performance status information of the client exceeds a preset threshold, generates an alarm message, and reports the alarm message to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, and updates the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point.

[0073] When the NFS process is initialized, the client monitoring module creates a global map type structure client_stats_map that counts the performance status information of each client. The client_stats_map uses the client IP as the key value and the performance status information corresponding to the client IP as the real value, that is, value is a structure of performance status information statistics. After the client mounts the shared directory of the storage end to the local mount point, the performance status information of the client, that is, the IO status of the client, is recorded.

[0074] It should be noted that the client with the same IP address can mount multiple NFS shared directories at the same time. Therefore, the value in client_stats_map is an array of structures for performance status information statistics, which records the mount path of each client.

[0075] Among them, when the client mounts the shared directory of the storage end to the local mount point, that is, after the client mounts, the client IP corresponding to the client is synchronized to the NFS protocol process, and a corresponding entry is created in the client_stats_map to record the performance status information of the client.

[0076] like Figure 2 As shown, the NFS protocol end is also provided with an abnormal situation alarm module, which is used to generate an alarm message when the client monitoring module monitors that the performance status information of the client exceeds a preset threshold, and report the alarm message to the NFS protocol alarm module of the storage end, so that the user can determine the client information to be restricted based on the alarm information of the NFS protocol alarm module of the storage end, and update the blacklist of the storage end based on the client information to be restricted.

[0077] It can be understood that the NFS protocol end determines the suspicious malicious client based on the performance status information of the client, and reports the suspicious malicious client to the storage end in the form of an alarm message. The storage end prompts the user, allowing the user to determine the real malicious client from the suspicious malicious client, and add the real malicious client to the blacklist of the storage end, so that the clients in the blacklist cannot mount the shared directory and cannot access the data on the storage end.

[0078] Step S103: receiving a data access request to the storage end sent by the client.

[0079] In which, when the client mounts the shared directory of the storage end to the local mount point, the client can access data to the storage end and receive a data access request to the storage end sent by the client.

[0080] A data access request may be a read request (read IO) or a write request (write IO).

[0081] Step S104: parse the data access request to obtain the target path of the data access request.

[0082] After receiving the data access request, the data access request is parsed to obtain a target path of the data access request, where the target path includes a sender of the data access request and a target directory of the data access request.

[0083] Step S105, determining whether the target path is in the directory access controlled list.

[0084] Among them, the shared directories in the directory access control list are not allowed to be accessed. After obtaining the target path of the data access request, determining whether the target path is in the target access control list is essentially determining whether the target directory of the data access request is in the target access control list.

[0085] Step S106: If the target path is in the directory access controlled list, it is determined whether the client identifier of the client corresponding to the data access request is in the white list.

[0086] If the target path is in the directory access control list, that is, the target directory of the data access request is in the target access control list, it is necessary to further determine whether the client ID of the client corresponding to the data access request is in the white list. Among them, the clients in the white list are not restricted by the target access control list and are allowed to access all shared directories on the storage end. The client ID is the client IP, that is, the client corresponding to the client IP in the white list is not restricted by the directory access control list and can access the shared directories on the storage end.

[0087] It should be noted that the whitelist and directory access control list are preset by the user in the NFS service, and the whitelist and directory access control list will be loaded when the client monitoring module is initialized.

[0088] When users modify the whitelist and directory access control list later, they can restart the NFS service to make the modified whitelist and directory access control list take effect immediately. At the same time, the client monitoring module will reload the whitelist and directory access control list every 30 seconds (s), so that these two lists can take effect immediately.

[0089] It should be noted that, through inter-process communication, commands are used to modify the cache information in the NFS service, so as to add the newly added list content to the NFS process, trigger the disk, and update it locally.

[0090] Step S107: If the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected.

[0091] The sender of the data access request is the client corresponding to the data access request, the target path of the data access request is in the directory access control list, and the client identifier of the client corresponding to the data access request is not in the white list, indicating that the data access request is restricted by the directory access control list and cannot be executed, that is, the data access request is rejected. According to steps S104 to S107, access control to a specific directory is implemented within the NFS protocol end.

[0092] The data access method provided in this embodiment performs periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point. If the performance status information of any client exceeds the preset threshold, an alarm information is generated and reported to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, updates the blacklist of the storage end based on the client information to be restricted, receives the data access request to the storage end sent by the client, parses the data access request, obtains the target path of the data access request, determines whether the target path is in the directory access controlled list, and if the target path is in the directory access controlled list, determines whether the client identifier of the client corresponding to the data access request is in the whitelist; if the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected. By pre-identifying unknown malicious clients, the user determines the real malicious clients from the pre-identified unknown malicious clients, and adds the real malicious clients to the blacklist of the storage end, so that the malicious clients in the blacklist cannot mount the shared directory of the storage end to the local mount point, that is, cannot access the data of the storage end, thereby improving the data security of the storage end.

[0093] It can be understood that by performing periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point, the resource usage of the client connected to the storage end can be monitored, and then it can be determined based on the performance status information whether a single client occupies a large amount of system resources. If a single client occupies a large amount of system resources, causing other clients to be unable to use system resources, an alarm will be issued to enable the user to take corresponding measures, such as adding the client to the blacklist of the storage end, closing the connection of the client, etc., to solve the problem and improve system stability.

[0094] In this embodiment, a data access method is provided, which can be used in the NFS protocol end. Figure 3 is a flow chart of a data access method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0095] Step S301, when the client mounts the shared directory of the storage end to the local mount point, the performance status information of the client is regularly counted.

[0096] Specifically, the above step S301 includes:

[0097] Step S3011, for any client, periodically obtain at least one of the following information: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

[0098] It is understandable that the performance status information includes at least one of the following information: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

[0099] The structure of performance status information statistics includes the following members:

[0100] struct client_perf_stats{

[0101] string client_ip;

[0102] string source_share_name;

[0103] string target_share_name;

[0104] uint64_t status;

[0105] uint64_t iops_count_today;

[0106] uint64_t iops_count;

[0107] uint64_t bandwidth_count_today;

[0108] uint64_t bandwidth_count;

[0109] uint64_t last_check_time;

[0110] uint64_t offline_time;

[0111] uint64_t file_handle_count;

[0112] };

[0113] Among them, client_ip represents the IP of the connected client, that is, the client IP.

[0114] source_share_name indicates the export path of the NFS shared directory.

[0115] target_share_name indicates the mount point path of the NFS shared directory on the client.

[0116] Status indicates the current client connection status, including normal, offline, and alarm. A status field is added to each client entry, and the status field is status. When the client connection status is identified as normal, that is, the client can normally access the shared directory of the storage end, the connection status is determined to be normal. When the client connection status is identified as disconnected, the connection status is determined to be offline. When the client connection status is identified as abnormal, the connection status is determined to be alarm.

[0117] iops_count_today indicates the cumulative number of input and output operations performed by the current client on that day, and is cleared daily.

[0118] iops_count indicates the cumulative number of input and output operations performed by the current client.

[0119] bandwidth_count_today indicates the amount of data accessed by the current client on the storage device today. It can also be expressed as the accumulated bandwidth of the current client today, which is cleared daily.

[0120] bandwidth_count indicates the total amount of data currently accessed by the client to the storage device.

[0121] last_check_time indicates the time when the performance status information of the current client was last collected, accurate to milliseconds.

[0122] offline_time indicates the time when the current client enters offline state, i.e. disconnected state, accurate to milliseconds.

[0123] file_handle_count indicates the number of file descriptors opened by the current client, that is, the number of opened handles.

[0124] It can be understood that the performance status information includes information corresponding to members in the structure of the above performance status information statistics.

[0125] Figure 4 FIG. 1 is a schematic diagram of processing a data access request according to an embodiment of the present invention. Figure 4As shown, the NFS protocol end also includes an IO processing module for processing client data access requests, including read IO requests and write IO requests. After processing the client data access request, according to the client IP of the data access request source, the corresponding entry is found from client_stats_map, and the iops_count, iops_count_today, bandwidth_count, and bandwidth_count_today in the entry are accumulated to update the performance status information of the current client, so as to realize real-time statistics of the IO information of the current client, that is, statistics of the performance status information of the current client.

[0126] Step S302, when the performance status information of the client exceeds a preset threshold, generates an alarm message, and reports the alarm message to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, and updates the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point.

[0127] It should be noted that the NFS protocol end provides the client with performance status information monitoring and abnormal situation alarms. The NFS protocol alarm module on the storage end establishes a socket long connection with the abnormal situation alarm module on the NFS protocol end to obtain alarm information regularly.

[0128] In addition to client performance statistics, the stats_monitor module also adds performance status information monitoring and alarm functions. This function is triggered by a timer, traverses the client_stats_map, and actively reports the alarm information to the abnormal situation alarm module on the NFS protocol side. The abnormal situation alarm module on the NFS protocol side reports the alarm information to the NFS protocol alarm module on the storage side.

[0129] It should be noted that timers of different durations are used for monitoring and warning of different performance status information.

[0130] Specifically, the above step S302 includes:

[0131] Step S3021, when the number of handles opened by the client is greater than a preset handle opening threshold, the number of handles opened by multiple clients for mounting the shared directory of the storage end to the local mount point is obtained.

[0132] The Linux system sets a maximum number of handles that can be opened for each process. If the number of handles opened by the client is greater than the maximum number of handles that can be opened, the client cannot open the handle again.

[0133] The preset handle opening threshold is 50% of the maximum number of handles that can be opened. The timer counts the number of handles opened by the client every 5 seconds. When the number of handles opened by the client is greater than the preset handle opening threshold, the number of handles opened by multiple clients that mount the shared directory of the storage end to the local mount point is obtained.

[0134] Step S3022, sort the clients in descending order according to the number of handles opened by the multiple clients.

[0135] After obtaining the number of handles opened by multiple clients, the clients are sorted accordingly in descending order of the number of handles opened by the multiple clients.

[0136] Step S3023, filter out a preset number of target clients that are ranked high.

[0137] The preset number is set by a technician. For example, the preset number is 10, that is, the top 10 target clients are obtained.

[0138] Step S3024: Generate warning information based on the target client identifier corresponding to the target client.

[0139] The target client IP corresponding to the target client is added to the alarm information to generate the alarm information. The alarm information corresponding to the handle is reported to the NFS protocol alarm module of the storage end every 5 seconds, and the storage end prompts the user to view the alarm information. The user obtains the target client identifier in the alarm information based on the alarm information of the storage end, and determines the client information to be restricted based on the target client identifier.

[0140] It should be noted that the user can also selectively close the client to release the handle according to the target client identifier in the alarm information.

[0141] Step S3025, when the cumulative number of input and output operations performed by the client on that day is greater than the preset operation threshold, and the amount of data accessed by the client on that day is less than the preset data amount threshold, an alarm message is generated based on the client identifier corresponding to the client.

[0142] Among them, the timer counts the number of input and output operations performed by the client on that day and the amount of data accessed by the client on that day every 24 hours. If the number of input and output operations performed by the client on that day is greater than the preset operation threshold, and the amount of data accessed by the client on that day is less than the preset data volume threshold, the statistical information of the client is determined to be abnormal, and an alarm message with the client identifier of the client is generated. The alarm information is reported to the NFS protocol alarm module of the storage end every 24 hours. The storage end prompts the user to check the alarm information. The user obtains the target client identifier in the alarm information based on the alarm information of the storage end, and determines the client information to be restricted based on the target client identifier.

[0143] Among them, the preset operation threshold and the preset data volume threshold are set by technical personnel.

[0144] Step S3026: When the connection status of the client is abnormal, generate alarm information based on the client identifier corresponding to the client.

[0145] If the connection status of the client is abnormal, the client identifier corresponding to the client is added to the alarm information, and the alarm information is reported to the storage end.

[0146] Step S3027: When the connection status of the client is in a disconnected state for a first preset time period, an alarm message is generated based on the client identifier corresponding to the client.

[0147] The first preset time period is set by a technician. For example, the first preset time period is 24 hours. If the connection status of the client is disconnected for 24 hours, an alarm message is generated based on the client identifier corresponding to the client, that is, the client IP, and the alarm message is reported to the storage end, so that the user can determine the client IP to be added to the blacklist of the storage end based on the alarm message, and close the connection of the malicious client in time to avoid hidden risks.

[0148] It should be noted that if the client's connection status is disconnected for 24 consecutive hours, the client's entry will be cleared from client_stats_map, and this action is completed by the timer of the client monitoring module. Disconnected for 24 consecutive hours means that the client has not performed any input and output (IO) operations for 24 consecutive hours.

[0149] It should be further explained that when the client triggers the unmounting process of the shared directory, the NFS protocol end clears the entry of the client from the client_stats_map when receiving the data packet of the client unmounting the shared directory.

[0150] Step S3028: When the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period, an alarm message is generated based on a client identifier corresponding to the client.

[0151] Among them, if the connection status of a client is repeatedly in a normal state and a disconnected state within a second preset time period, the client is determined to be an abnormal client, and an alarm message is generated based on the client identifier corresponding to the client, that is, the client IP, and the alarm message is reported to the storage end.

[0152] It should be noted that the second preset time period is set by a technician and is not specifically limited here. For example, the second preset time period may be 5 minutes.

[0153] That is, if a client repeatedly connects and disconnects within 5 minutes, the client is determined to be an abnormal client, marked as an abnormal client, and an alarm is reported.

[0154] It should be noted that the number of repeated connections and disconnections needs to exceed a preset number threshold. For example, the preset number threshold may be 3 times.

[0155] Step S303: Receive a data access request from the client to the storage end. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0156] Step S304: parse the data access request to obtain the target path of the data access request. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0157] Step S305: Determine whether the target path is in the directory access control list. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0158] Step S306: If the target path is in the directory access controlled list, determine whether the client identifier of the client corresponding to the data access request is in the whitelist. Figure 1 Step S106 of the illustrated embodiment will not be described in detail here.

[0159] Step S307: If the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected. Figure 1 Step S107 of the illustrated embodiment will not be described in detail here.

[0160] The data access method provided in this embodiment obtains the performance status information of the client at regular intervals, understands the operating status of the client, promptly discovers the abnormality of the client, and realizes the pre-identification of unknown malicious clients. The user determines the real malicious clients from the pre-identified unknown malicious clients and adds the real malicious clients to the blacklist of the storage end, so that these malicious clients cannot access the data of the storage end, thereby improving the data security of the storage end.

[0161] It also helps users adjust business distribution and improve performance and resource utilization. For example, when the bandwidth of a legitimate client is too high, it means that a large number of businesses are concentrated on one client, which may be limited by the performance of the client itself and cannot bring into play the true performance of the NFS protocol. The data access method of this embodiment enables the NFS protocol end to bring into play its true performance.

[0162] The data access method provided in this embodiment monitors the performance status information of the client in real time, and generates an alarm message when the performance status information shows that the resource usage of the client exceeds a preset threshold, or the client is in an abnormal state, or the client is continuously in a disconnected state, or the client repeatedly switches between a normal state and a disconnected state, so that the user can determine the client identifier to be added to the blacklist of the storage end based on the alarm information, thereby identifying and blocking access to unknown malicious clients, making it impossible for these malicious clients to access the data on the storage end, thereby improving the data security of the storage end and ensuring the normal operation of the business.

[0163] By implementing performance status information monitoring, alarms, and active reporting of alarm information within the NFS protocol end, it is easy to obtain real-time performance status information. Compared with obtaining NFS alarm information from the outside, it reduces the time consumption in the alarm reporting process, and the alarm information is obtained more timely and more stable, which improves performance.

[0164] In some optional implementations, the data access method further includes:

[0165] Step a1: If the target path is not in the directory access controlled list, a corresponding operation is performed on the storage end based on the data access request.

[0166] Among them, if the target path is not in the directory access controlled list, it means that the data access request can be executed, and then the corresponding operation is performed on the storage end based on the data access request.

[0167] The data access method provided in this embodiment can effectively prevent the client from accessing the controlled shared directory through the directory access controlled list, thereby reducing the risk of data leakage and malicious operation and ensuring the security of the storage end.

[0168] In some optional implementations, the data access method further includes:

[0169] Step b1: when the number of clients mounting the shared directory of the storage end to the local mounting point exceeds a preset connection threshold, an alarm message is generated and reported to the storage end.

[0170] The number of clients that mount the shared directory of the storage end to the local mount point is counted every 5 seconds. If the number of clients that mount the shared directory of the storage end to the local mount point exceeds the preset connection threshold, an alarm message is generated and reported to the storage end, so that the user can determine whether to appropriately close the mounting of some clients based on the alarm information of the storage end.

[0171] The data access method provided in this embodiment generates an alarm message when the number of clients mounting the shared directory of the storage end to the local mount point exceeds a preset connection threshold, so that the user can close some clients according to the alarm message to avoid affecting the normal operation of the business.

[0172] In some optional implementations, the data access method further includes:

[0173] Step c1, in response to the user's performance status information query operation, sends the client's performance status information to the storage end, so that the user can query the client's performance status information from the storage end, determine the client information to be restricted based on the client's performance status information, and update the blacklist of the storage end based on the client information to be restricted.

[0174] Among them, based on client_stats_map, the NFS service has the ability to view the performance status information of each client. Users can actively query the performance status information of each client, including the IO status of each client, the number of open handles, etc.

[0175] When a user queries the performance status information of a client, the client monitoring module of the NFS protocol end establishes a socket short connection with the performance statistics information query module of the storage end, so that the storage end can obtain the performance status information in real time. The client monitoring module of the NFS protocol end sends the performance status information of the client to the performance statistics information query module of the storage end, so that the user can query the performance status information of the client from the module, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

[0176] It should be noted that users can also close the mounting of some clients based on the queried client performance status information and their own needs.

[0177] The data access method provided in this embodiment allows the user to actively obtain the performance status information of the client, understand the client's operating conditions and connection status in detail, and update the blacklist of the storage end according to the client's performance status information, thereby achieving the effect of timely discovering unknown malicious clients.

[0178] In some optional implementations, the data access method further includes:

[0179] Step d1: If the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request, an alarm message is generated and reported to the storage end.

[0180] Among them, the target path of the data access request is in the directory access controlled list but not in the whitelist, but the corresponding operation is performed on the storage end based on the data access request, indicating that a system failure has occurred. An alarm message is generated and reported to the storage end so that the user can determine and resolve the failure based on the alarm information.

[0181] It should be noted that the user can add the client IP to the whitelist to skip the check. That is, if the client IP is in the whitelist, there is no need to count the performance status information of the client corresponding to the client IP, and the data access request sent by the client is directly executed.

[0182] The data access method provided in this embodiment, when the target path of the data access request is in the preset controlled access list but not in the white list, still performs corresponding operations on the storage end based on the data access request, that is, detects the client's access to the controlled directory, generates an alarm message, and enables the user to intervene immediately to avoid potential security threats or malicious behaviors.

[0183] In some optional implementations, the data access method further includes:

[0184] In response to the connection establishment request of the client, a client identifier corresponding to the client is obtained. If the client identifier is not within the preset network segment, an alarm message is generated and reported to the storage end.

[0185] Among them, the user sets a preset network segment on the NFS protocol end, and the client IP outside the network segment refuses to connect to the NFS protocol end. If the client outside the network segment abnormally initiates a connection establishment request, an alarm information is generated based on the client IP of the client, and the alarm information is reported to the storage end so that the user can take corresponding measures based on the alarm information.

[0186] The data access method provided in this embodiment can limit the connection to the NFS service to only clients from a specific network area by setting a preset network segment, thereby reducing the risk of unauthorized access. When a client from a non-preset network segment attempts to connect, the system will immediately generate an alarm message, which helps to quickly identify potential security threats.

[0187] In some optional implementations, the NFS protocol end reports the alarm information to the storage end. After receiving the alarm information, the storage end can send the alarm information to the user's corresponding mailbox via email, so that the user can determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted.

[0188] After receiving the alarm information, the storage end can also display the alarm information through a system pop-up window so that the user can receive the alarm information in time, determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted.

[0189] After receiving the alarm information, the storage end can also send the alarm information to the user through the instant messaging tool.

[0190] The data access method provided in this embodiment sends alarm information to users via email, system pop-up window or instant messaging tool, ensuring that users can receive the alarm information as soon as possible, updates the blacklist of the storage end according to the alarm information, and promptly blocks malicious clients from accessing data on the storage end, thereby ensuring data security on the storage end.

[0191] In this embodiment, a data access device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0192] This embodiment provides a data access device, such as Figure 5 As shown, including:

[0193] The statistics module 501 is used to perform periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point.

[0194] Generation module 502 is used to generate alarm information when the performance status information of the client exceeds a preset threshold, and report the alarm information to the storage end, so that the user can determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point.

[0195] The receiving module 503 is used to receive a data access request sent by the client to the storage end.

[0196] The acquisition module 504 is used to parse the data access request and obtain the target path of the data access request.

[0197] The first determination module 505 is used to determine whether the target path is in the directory access controlled list, wherein the shared directories in the directory access controlled list are not allowed to be accessed.

[0198] The second judgment module 506 is used to determine whether the client identifier of the client corresponding to the data access request is in the white list if the target path is in the directory access controlled list, wherein the clients in the white list are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end.

[0199] The determination module 507 is configured to refuse to execute the data access request if the client identifier of the client corresponding to the data access request is not in the whitelist.

[0200] In some optional implementations, the data access device further includes:

[0201] The execution unit is used to execute a corresponding operation on the storage end based on the data access request if the target path is not in the directory access controlled list.

[0202] In some optional implementations, the statistics module 501 includes:

[0203] The first acquisition unit is used to periodically acquire at least one of the following information for any client: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

[0204] In some optional implementations, the generating module 502 includes:

[0205] The second acquisition unit is used to acquire the number of handles opened by multiple clients for mounting the shared directory of the storage end to the local mount point when the number of handles opened by the client is greater than a preset handle opening threshold.

[0206] The first sorting unit is used to sort the clients in descending order according to the number of handles opened by the multiple clients.

[0207] The screening unit is used to screen out a preset number of target clients that are ranked high.

[0208] The first generating unit is used to generate warning information based on a target client identifier corresponding to the target client.

[0209] The second generating unit is used to generate an alarm message based on the client identifier corresponding to the client when the cumulative number of input and output operations performed by the client on that day is greater than a preset operation threshold and the amount of data accessed by the client on the storage end on that day is less than a preset data amount threshold.

[0210] The third generating unit is used to generate alarm information based on the client identifier corresponding to the client when the connection status of the client is abnormal.

[0211] The fourth generating unit is used to generate alarm information based on the client identifier corresponding to the client when the connection status of the client is in the disconnected state for a first preset time period.

[0212] The fifth generating unit is used to generate alarm information based on the client identifier corresponding to the client when the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period.

[0213] In some optional implementations, the data access device further includes:

[0214] The sixth generating unit is used to generate alarm information and report the alarm information to the storage end when the number of clients mounting the shared directory of the storage end to the local mounting point exceeds a preset connection threshold.

[0215] In some optional implementations, the data access device further includes:

[0216] The first sending unit is used to send the performance status information of the client to the storage end in response to the user's performance status information query operation, so that the user can query the performance status information of the client from the storage end, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

[0217] In some optional implementations, the data access device further includes:

[0218] The seventh generating unit is used to generate an alarm message and report the alarm message to the storage end if the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request.

[0219] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0220] The data access device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0221] The embodiment of the present invention also provides a computer device having the above Figure 5 The data access device shown.

[0222] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 601, memory 602, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other, and can be installed on a common mainboard or installed in other ways as required. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 601 is taken as an example.

[0223] The processor 601 may be a central processing unit, a network processor or a combination thereof. The processor 601 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0224] The memory 602 stores instructions executable by at least one processor 601 , so that the at least one processor 601 executes the method shown in the above embodiment.

[0225] The memory 602 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 602 may optionally include a memory remotely arranged relative to the processor 601, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0226] The memory 602 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 602 may also include a combination of the above types of memory.

[0227] The computer device also includes a communication interface 603, which is used for the computer device to communicate with other devices or a communication network.

[0228] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0229] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0230] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A data access method, characterized in that: The method comprises: When the client mounts the shared directory of the storage end to the local mount point, regularly counting the performance status information of the client; When the performance status information of the client exceeds a preset threshold, an alarm message is generated, and the alarm message is reported to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, and updates the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point; Receiving a data access request to a storage end sent by the client; Parsing the data access request to obtain a target path of the data access request; Determine whether the target path is in a directory access controlled list, wherein the shared directories in the directory access controlled list are not allowed to be accessed; If the target path is in the directory access controlled list, determine whether the client identifier of the client corresponding to the data access request is in the white list, wherein the clients in the white list are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end; If the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected.

2. The method according to claim 1, characterized in that The method further comprises: If the target path is not in the directory access controlled list, a corresponding operation is performed on the storage end based on the data access request.

3. The method according to claim 1, characterized in that The periodically counting the performance status information of the client includes: For any client, at least one of the following information is obtained periodically: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

4. The method according to claim 1, characterized in that When the performance status information of the client exceeds a preset threshold, generating alarm information includes: When the number of handles opened by the client is greater than a preset handle opening threshold, obtaining the number of handles opened by multiple clients that mount the shared directory of the storage end to the local mount point; Sort the clients according to the number of handles opened by the multiple clients from large to small; Filter out a preset number of target clients that are ranked top; Generate warning information based on the target client identifier corresponding to the target client; When the number of input and output operations performed by the client on that day is greater than a preset operation threshold, and the amount of data accessed by the client on that day to the storage end is less than a preset data amount threshold, generating an alarm message based on the client identifier corresponding to the client; When the connection status of the client is abnormal, generating alarm information based on the client identifier corresponding to the client; When the connection status of the client is in a disconnected state for a first preset time period, generating an alarm message based on a client identifier corresponding to the client; When the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period, alarm information is generated based on a client identifier corresponding to the client.

5. The method according to claim 1, characterized in that The method further comprises: When the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, an alarm message is generated and reported to the storage end.

6. The method according to claim 1, characterized in that The method further comprises: In response to a user's performance status information query operation, the performance status information of the client is sent to the storage end, so that the user can query the performance status information of the client from the storage end, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

7. The method according to claim 1, characterized in that The method further comprises: If the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request, an alarm message is generated and reported to the storage end.

8. A data access device, characterized in that: The device comprises: A statistics module, used for performing regular statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point; A generating module, configured to generate alarm information when the performance status information of the client exceeds a preset threshold, and report the alarm information to the storage end, so that the user determines the client information to be restricted based on the alarm information of the storage end, and updates the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point; A receiving module, used for receiving a data access request to a storage end sent by the client; An acquisition module, used to parse the data access request and obtain a target path of the data access request; A first determination module is used to determine whether the target path is in a directory access controlled list, wherein the shared directory in the directory access controlled list is not allowed to be accessed; A second judgment module is used to judge whether the client identifier of the client corresponding to the data access request is in a white list if the target path is in the directory access controlled list, wherein the clients in the white list are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end; The determination module is used to refuse to execute the data access request if the client identifier of the client corresponding to the data access request is not in the white list.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the data access method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the data access method according to any one of claims 1 to 7.

Images