Data access method, device, computer equipment and storage medium

Abstract

The present invention relates to the field of data storage technology, and discloses a data access method, apparatus, computer equipment, and storage medium. The method includes: when a client mounts a shared directory of a storage end to a local mount point, regularly performing statistics on the performance status information of the client; for any client, when the performance status information of the client exceeds a preset threshold, generating an alarm message, reporting the alarm message to the storage end, so that the user can determine the information of the client to be restricted based on the alarm information of the storage end, and updating the blacklist of the storage end based on the information of the client to be restricted; receiving a data access request to the storage end sent by the client; parsing the data access request to obtain the target path of the data access request; if the target path is in the directory access controlled list and the client identifier corresponding to the client is not in the whitelist, then rejecting the data access request. The present invention improves the data security of the storage end.

Description

Technical Field

[0001] The present invention relates to the field of data storage technology, and in particular to a data access method, device, computer equipment and storage medium. Background Art

[0002] The Network File System (NFS) is an efficient file-sharing technology that allows files to be shared across different machines and operating systems over a network. Due to its ease of deployment and maintenance, NFS has been widely used in Network Attached Storage (NAS) storage services, greatly facilitating user access to data at any time and location.

[0003] In related technologies, directories in NAS storage are exported using the NFS protocol, allowing any client configured with NFS services to connect to the NAS storage over the network and access data on the NAS storage. To ensure data security on the NAS storage, a blacklist is set up on the NAS storage to restrict access to malicious clients.

[0004] However, this method of setting a blacklist on the NAS storage side is limited to the range of malicious clients known to the user and cannot identify unknown malicious clients, resulting in low data security on the NAS storage side. Summary of the Invention

[0005] In view of this, the present invention provides a data access method, apparatus, computer device and storage medium to solve the problem in the related art that unknown malicious clients cannot be identified, resulting in low data security on the NAS storage end.

[0006] In a first aspect, the present invention provides a data access method, the method comprising:

[0007] When the client mounts the shared directory of the storage end to the local mount point, regularly performing statistics on the performance status information of the client;

[0008] When the performance status information of the client exceeds a preset threshold, an alarm is generated and reported to the storage end, so that the user can determine information of clients to be restricted based on the alarm information of the storage end, and update a blacklist of the storage end based on the information of clients to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point;

[0009] Receiving a data access request to a storage end sent by the client;

[0010] Parsing the data access request to obtain a target path of the data access request;

[0011] Determine whether the target path is in a directory access control list, wherein shared directories in the directory access control list are not allowed to be accessed;

[0012] If the target path is in the directory access controlled list, determining whether the client identifier of the client corresponding to the data access request is in a whitelist, wherein clients in the whitelist are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end;

[0013] If the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected.

[0014] The data access method provided in this embodiment performs periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point. If the performance status information of any client exceeds a preset threshold, an alarm is generated and reported to the storage end, so that the user can determine the information of the client to be restricted based on the alarm information of the storage end, update the blacklist of the storage end based on the information of the client to be restricted, receive a data access request sent by the client to the storage end, parse the data access request, obtain the target path of the data access request, determine whether the target path is in the directory access control list, and if the target path is in the directory access control list, determine whether the client identifier of the client corresponding to the data access request is in the whitelist; if the client identifier of the client corresponding to the data access request is not in the whitelist, refuse to execute the data access request. By pre-identifying unknown malicious clients, the user determines the real malicious clients from the pre-identified unknown malicious clients, and adds the real malicious clients to the blacklist of the storage end, so that the malicious clients in the blacklist cannot mount the shared directory of the storage end to the local mount point, that is, cannot access the data of the storage end, thereby improving the data security of the storage end.

[0015] In an optional embodiment, the method further includes:

[0016] If the target path is not in the directory access controlled list, a corresponding operation is performed on the storage end based on the data access request.

[0017] The data access method provided in this embodiment can effectively prevent clients from accessing controlled shared directories through the directory access control list, thereby reducing the risks of data leakage and malicious operations and ensuring the security of the storage end.

[0018] In an optional implementation, the periodically collecting statistics on the performance status information of the client includes:

[0019] For any client, at least one of the following information is obtained periodically: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on the storage end on that day, and the number of handles opened by the client.

[0020] The data access method provided in this embodiment obtains the performance status information of the client at regular intervals, understands the operating status of the client, promptly discovers the abnormality of the client, and realizes the pre-identification of unknown malicious clients. The user determines the real malicious clients from the pre-identified unknown malicious clients and adds the real malicious clients to the blacklist of the storage end, so that these malicious clients cannot access the data of the storage end, thereby improving the data security of the storage end.

[0021] In an optional implementation, when the performance status information of the client exceeds a preset threshold, generating alarm information includes:

[0022] When the number of handles opened by the client is greater than a preset handle opening threshold, obtaining the number of handles opened by multiple clients for mounting the shared directory of the storage end to the local mount point;

[0023] Sort the clients in descending order of the number of handles opened by the clients;

[0024] Filter out a preset number of target clients that are ranked top;

[0025] generating alarm information based on a target client identifier corresponding to the target client;

[0026] generating an alarm message based on the client identifier corresponding to the client when the cumulative number of input and output operations performed by the client on that day is greater than a preset operation threshold and the amount of data accessed by the client on that day to the storage end is less than a preset data amount threshold;

[0027] When the connection status of the client is abnormal, generating an alarm message based on the client identifier corresponding to the client;

[0028] When the connection status of the client is in a disconnected state for a continuous first preset time period, generating an alarm message based on the client identifier corresponding to the client;

[0029] When the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period, an alarm message is generated based on the client identifier corresponding to the client.

[0030] The data access method provided in this embodiment monitors the performance status information of the client in real time, and generates an alarm message when the performance status information shows that the resource usage of the client exceeds a preset threshold, or the client is in an abnormal state, or the client is continuously in a disconnected state, or the client repeatedly switches between a normal state and a disconnected state, so that the user can determine the client identifier to be added to the blacklist of the storage end based on the alarm information, thereby realizing the identification and access blocking of unknown malicious clients, making these malicious clients unable to access the data of the storage end, and improving the data security of the storage end.

[0031] In an optional embodiment, the method further includes:

[0032] When the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, an alarm message is generated and reported to the storage end.

[0033] The data access method provided in this embodiment generates an alarm message when the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, so that the user can close some clients according to the alarm message to avoid affecting the normal operation of the business.

[0034] In an optional embodiment, the method further includes:

[0035] In response to the user's performance status information query operation, the performance status information of the client is sent to the storage end, so that the user can query the performance status information of the client from the storage end, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

[0036] The data access method provided in this embodiment allows the user to actively obtain the performance status information of the client and update the blacklist of the storage end according to the performance status information of the client, thereby achieving the effect of timely discovering unknown malicious clients.

[0037] In an optional embodiment, the method further includes:

[0038] If the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request, an alarm message is generated and reported to the storage end.

[0039] The data access method provided in this embodiment performs corresponding operations on the storage end based on the data access request when the target path of the data access request is in the preset controlled access list but not in the white list. That is, the access of the client to the controlled directory is detected, and an alarm message is generated, so that the user can intervene immediately to avoid potential security threats or malicious behaviors.

[0040] In a second aspect, the present invention provides a data access device, comprising:

[0041] A statistics module, configured to periodically collect statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point;

[0042] a generating module, configured to generate an alarm message when the performance status information of the client exceeds a preset threshold, and report the alarm message to the storage end, so that the user can determine information of clients to be restricted based on the alarm information of the storage end, and update a blacklist of the storage end based on the information of clients to be restricted, wherein clients in the blacklist cannot mount a shared directory of the storage end to a local mount point;

[0043] A receiving module, configured to receive a data access request from the client to the storage end;

[0044] An acquisition module, configured to parse the data access request and obtain a target path of the data access request;

[0045] A first determination module is configured to determine whether the target path is in a directory access control list, wherein shared directories in the directory access control list are not allowed to be accessed;

[0046] A second judgment module is configured to, if the target path is in the directory access controlled list, determine whether the client identifier of the client corresponding to the data access request is in a whitelist, wherein clients in the whitelist are not restricted by the target access controlled list and are allowed to access all shared directories of the storage end;

[0047] The determination module is configured to refuse to execute the data access request if the client identifier of the client corresponding to the data access request is not in the whitelist.

[0048] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the data access method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the data access method of the first aspect or any corresponding embodiment thereof.

[0050] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the data access method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in related technologies, the following briefly introduces the drawings required for use in the specific embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 is a flow chart of a data access method according to an embodiment of the present invention;

[0053] Figure 2 2 is a schematic diagram of a structure for obtaining performance status information of a client and reporting alarm information according to an embodiment of the present invention;

[0054] Figure 3 is a flow chart of another data access method according to an embodiment of the present invention;

[0055] Figure 4 is a schematic diagram of processing a data access request according to an embodiment of the present invention;

[0056] Figure 5 is a structural block diagram of a data access device according to an embodiment of the present invention;

[0057] Figure 6 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0059] As an efficient file sharing technology, NFS allows files to be shared across different machines and operating systems over a network. Due to its ease of deployment, maintenance, and ease of use, NFS has been widely used in NAS storage services, greatly facilitating user access to data at any time and location.

[0060] In related technologies, directories in NAS storage can be exported using the NFS protocol, allowing any client configured with the NFS service to connect to the NAS storage and access data. To ensure data security on the NAS storage, blacklists and whitelists of Internet Protocol (IP) addresses are set up in the NAS storage segment to block access from malicious clients, i.e., malicious client IP addresses.

[0061] However, this method of setting up a blacklist and whitelist on the NAS storage side to block access from malicious client IPs is limited to the malicious client IPs known to the user and cannot identify unknown malicious client IPs, resulting in the inability to timely block access from unknown malicious client IPs, resulting in low data security on the NAS storage side.

[0062] In addition, the NFS protocol does not provide effective identification and monitoring methods for the resource usage of clients connected to the NAS storage. Clients connected to the storage may compete for resources with each other, and a single client may occupy a large amount of system resources, making it impossible for other clients to use the system.

[0063] An embodiment of the present invention provides a data access method, which performs periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point, generates alarm information when the performance status information of the client exceeds a preset threshold, and reports the alarm information to the storage end, so that the user can determine the information of the client to be restricted based on the alarm information of the storage end, update the blacklist of the storage end based on the information of the client to be restricted, receive the data access request sent by the client to the storage end; parse the data access request to obtain the target path of the data access request; determine whether the target path is in the directory access controlled list; if the target path is In the directory access controlled list, it is determined whether the client identifier of the client corresponding to the data access request is in the white list; if the client identifier of the client corresponding to the data access request is not in the white list, the data access request is refused to be executed, so as to issue an alarm based on the performance status information and realize the pre-identification of unknown malicious clients. The user determines the real malicious clients from the pre-identified unknown malicious clients and adds the real malicious clients to the blacklist of the storage end, so that the malicious clients in the blacklist cannot mount the shared directory of the storage end to the local mount point, that is, they cannot access the data of the storage end, thereby improving the data security of the storage end.

[0064] According to an embodiment of the present invention, a data access method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] In this embodiment, a data access method is provided, which can be used on the NFS protocol side. Figure 1 is a flow chart of a data access method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0066] Step S101 : When the client mounts the shared directory of the storage end to the local mount point, the performance status information of the client is regularly counted.

[0067] The client mounts the shared directory on the storage side to the local mount point, indicating that the client is not in the blacklist on the storage side and can mount the shared directory on the storage side. The storage side is a NAS storage side.

[0068] Figure 2 FIG. 1 is a schematic diagram of a structure for obtaining performance status information of a client and reporting alarm information according to an embodiment of the present invention. Figure 2As shown, the NFS protocol end is provided with a client monitoring module (stats_monitor), which is used to monitor the performance status information of the client, that is, to perform regular statistics on the performance status information of the client.

[0069] It's important to note that the NFS protocol exists as an NFS process on the NAS storage system. When the NFS process starts, it triggers the initialization of the client monitoring module, creating a separate thread for it to independently complete client performance statistics. Implementing the stats_monitor module using a separate thread reduces its impact on NFS performance.

[0070] When the client monitoring module is initialized, a timer is created to regularly trigger the statistical work of performance status information.

[0071] It should be noted that the shared directory of the storage end is exported to the NFS protocol end. After the client mounts the shared directory of the storage end to the local mount point, the client's client IP and other information will be sent to the storage end to inform the storage end that the client has completed the mount and record the client IP information in the cache of the NFS process.

[0072] Step S102: When the performance status information of the client exceeds a preset threshold, an alarm message is generated and reported to the storage end, so that the user can determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point.

[0073] When the NFS process initializes, the client monitoring module creates a global map-type structure called client_stats_map to collect statistics on each client's performance status. This map uses the client IP address as the key and the performance status information corresponding to the client IP address as the value. In other words, the value is a structure containing performance status statistics. After the client mounts the shared directory on the storage side to the local mount point, the client's performance status information, i.e., the client's IO status, is recorded.

[0074] It should be noted that a client with the same IP address can mount multiple NFS shared directories at the same time. Therefore, the value in client_stats_map is an array of structures for performance status information statistics, which records the mount path of each client.

[0075] Among them, when the client mounts the shared directory of the storage end to the local mount point, that is, after the client mounts, the client IP corresponding to the client is synchronized to the NFS protocol process, and a corresponding entry is created in the client_stats_map to record the performance status information of the client.

[0076] like Figure 2 As shown, the NFS protocol end is also provided with an abnormal situation alarm module, which is used to generate an alarm message when the client monitoring module monitors that the performance status information of the client exceeds a preset threshold, and report the alarm message to the NFS protocol alarm module of the storage end, so that the user can determine the client information to be restricted based on the alarm information of the NFS protocol alarm module of the storage end, and update the blacklist of the storage end based on the client information to be restricted.

[0077] It can be understood that the NFS protocol end determines the suspicious malicious client based on the performance status information of the client, and reports the suspicious malicious client to the storage end in the form of an alarm message. The storage end prompts the user, so that the user can identify the real malicious client from the suspicious malicious client, and add the real malicious client to the blacklist of the storage end, so that the clients in the blacklist cannot mount the shared directory and cannot access the data on the storage end.

[0078] Step S103: receiving a data access request to the storage end sent by the client.

[0079] In the case where the client mounts the shared directory of the storage end to the local mount point, the client can access data on the storage end and receive a data access request to the storage end sent by the client.

[0080] A data access request may be a read request (read IO) or a write request (write IO).

[0081] Step S104: parse the data access request to obtain the target path of the data access request.

[0082] After receiving the data access request, the data access request is parsed to obtain a target path of the data access request, where the target path includes a sender of the data access request and a target directory of the data access request.

[0083] Step S105: determine whether the target path is in the directory access control list.

[0084] After obtaining the target path of the data access request, determining whether the target path is in the target access control list is essentially determining whether the target directory of the data access request is in the target access control list.

[0085] Step S106: If the target path is in the directory access controlled list, it is determined whether the client identifier of the client corresponding to the data access request is in the white list.

[0086] If the target path is on the directory access control list (that is, the target directory of the data access request is on the target access control list), it is necessary to determine whether the client ID of the client corresponding to the data access request is on the whitelist. Clients on the whitelist are not restricted by the target access control list and are allowed to access all shared directories on the storage device. The client ID is the client IP address. In other words, clients corresponding to client IP addresses on the whitelist are not restricted by the directory access control list and can access shared directories on the storage device.

[0087] It should be noted that the whitelist and directory access control list are preset by the user in the NFS service, and the whitelist and directory access control list will be loaded when the client monitoring module is initialized.

[0088] If you subsequently modify the whitelist and directory access control list, you can restart the NFS service to make the modified whitelist and directory access control list take effect immediately. At the same time, the client monitoring module will reload the whitelist and directory access control list every 30 seconds so that the two lists can take effect immediately.

[0089] It should be noted that through inter-process communication, commands are used to modify the cache information in the NFS service to add the newly added list content to the NFS process, trigger the disk write, and update it locally.

[0090] Step S107: If the client identifier of the client corresponding to the data access request is not in the whitelist, the data access request is rejected.

[0091] The sender of the data access request is the client corresponding to the data access request. The target path of the data access request is in the directory access control list. The client identifier of the client corresponding to the data access request is not in the whitelist. This indicates that the data access request is restricted by the directory access control list and cannot be executed. In other words, the data access request is rejected. According to steps S104 to S107, access control for a specific directory is implemented within the NFS protocol end.

[0092] The data access method provided in this embodiment performs periodic statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point. If the performance status information of any client exceeds a preset threshold, an alarm is generated and reported to the storage end, so that the user can determine the information of the client to be restricted based on the alarm information of the storage end, update the blacklist of the storage end based on the information of the client to be restricted, receive a data access request sent by the client to the storage end, parse the data access request, obtain the target path of the data access request, determine whether the target path is in the directory access control list, and if the target path is in the directory access control list, determine whether the client identifier of the client corresponding to the data access request is in the whitelist; if the client identifier of the client corresponding to the data access request is not in the whitelist, refuse to execute the data access request. By pre-identifying unknown malicious clients, the user determines the real malicious clients from the pre-identified unknown malicious clients, and adds the real malicious clients to the blacklist of the storage end, so that the malicious clients in the blacklist cannot mount the shared directory of the storage end to the local mount point, that is, cannot access the data of the storage end, thereby improving the data security of the storage end.

[0093] It can be understood that by performing periodic statistics on the client's performance status information when the client mounts the shared directory of the storage end to the local mount point, the resource usage of the client connected to the storage end can be monitored, and then it can be determined based on the performance status information whether a single client occupies a large amount of system resources. If a single client occupies a large amount of system resources, causing other clients to be unable to use system resources, an alarm will be issued, allowing the user to take corresponding measures, such as adding the client to the blacklist of the storage end, closing the client's connection, etc., to solve the problem and improve system stability.

[0094] In this embodiment, a data access method is provided, which can be used on the NFS protocol side. Figure 3 is a flow chart of a data access method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0095] Step S301 : When the client mounts the shared directory of the storage end to the local mount point, the performance status information of the client is regularly counted.

[0096] Specifically, the above step S301 includes:

[0097] Step S3011, for any client, regularly obtain at least one of the following information: the client's connection status, the number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

[0098] It is understandable that the performance status information includes at least one of the client's connection status, the cumulative number of input and output operations performed by the client that day, the amount of data accessed by the client on the storage end that day, and the number of handles opened by the client.

[0099] The structure of performance status information statistics includes the following members:

[0100] struct client_perf_stats{

[0101] string client_ip;

[0102] string source_share_name;

[0103] string target_share_name;

[0104] uint64_t status;

[0105] uint64_t iops_count_today;

[0106] uint64_t iops_count;

[0107] uint64_t bandwidth_count_today;

[0108] uint64_t bandwidth_count;

[0109] uint64_t last_check_time;

[0110] uint64_t offline_time;

[0111] uint64_t file_handle_count;

[0112] };

[0113] Among them, client_ip represents the IP address of the connecting client, that is, the client IP address.

[0114] source_share_name indicates the export path of the NFS shared directory.

[0115] target_share_name indicates the mount point path of the NFS shared directory on the client.

[0116] Status indicates the current client connection status, including normal, offline, and alarm. A status field is added to each client entry. If the client's connection status is normal, meaning the client can access the shared directory on the storage device, the connection status is determined to be normal. If the client's connection status is disconnected, the connection status is determined to be offline. If the client's connection status is abnormal, the connection status is determined to be alarm.

[0117] iops_count_today indicates the cumulative number of input and output operations performed by the current client on the current day and is cleared daily.

[0118] iops_count indicates the cumulative number of input and output operations performed by the current client.

[0119] bandwidth_count_today indicates the amount of data accessed by the current client on the storage device that day. It can also be expressed as the accumulated bandwidth of the current client that day, which is cleared daily.

[0120] bandwidth_count indicates the total amount of data currently accessed by the client to the storage device.

[0121] last_check_time indicates the time when the performance status information of the current client was last collected, accurate to milliseconds.

[0122] offline_time indicates the time when the current client enters the offline state, that is, the disconnected state, accurate to milliseconds.

[0123] file_handle_count indicates the number of file descriptors opened by the current client, that is, the number of opened handles.

[0124] It can be understood that the performance status information includes information corresponding to members in the structure of the above performance status information statistics.

[0125] Figure 4 FIG. 1 is a schematic diagram of processing a data access request according to an embodiment of the present invention. Figure 4As shown, the NFS protocol client also includes an IO processing module for handling client data access requests, including read and write IO requests. After processing the client's data access request, the module finds the corresponding entry in the client_stats_map based on the client IP address of the data access request source. The module then accumulates the iops_count, iops_count_today, bandwidth_count, and bandwidth_count_today values ​​in the entry to update the current client's performance status information, thus achieving real-time IO statistics for the current client, and thus, performance statistics for the current client.

[0126] Step S302: When the performance status information of the client exceeds a preset threshold, an alarm message is generated and reported to the storage end, so that the user can determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point.

[0127] It should be noted that the NFS protocol end provides the client's performance status information monitoring and abnormal situation alarm. The NFS protocol alarm module on the storage end establishes a socket long connection with the abnormal situation alarm module on the NFS protocol end to obtain alarm information regularly.

[0128] In addition to performing client performance statistics, the stats_monitor module also adds performance status information monitoring and alarm functions. This function is triggered by a timer, traverses the client_stats_map, and actively reports alarm information to the abnormal situation alarm module on the NFS protocol side. The abnormal situation alarm module on the NFS protocol side reports the alarm information to the NFS protocol alarm module on the storage side.

[0129] It should be noted that timers of different durations are used for monitoring and alarming different performance status information.

[0130] Specifically, the above step S302 includes:

[0131] Step S3021: When the number of handles opened by the client is greater than a preset handle opening threshold, the number of handles opened by multiple clients for mounting the shared directory of the storage end to the local mount point is obtained.

[0132] The Linux system sets a maximum number of open handles for each process. If the number of handles opened by a client exceeds the maximum number of open handles, the client cannot open more handles.

[0133] The preset handle opening threshold is 50% of the maximum number of openable handles. A timer counts the number of handles opened by clients every 5 seconds. When the number of handles opened by clients exceeds the preset handle opening threshold, the timer obtains the number of handles opened by multiple clients that mount the shared directory on the storage side to the local mount point.

[0134] Step S3022: sort the clients in descending order of the number of handles opened by the clients.

[0135] After obtaining the number of handles opened by multiple clients, the clients are sorted accordingly in descending order of the number of handles opened by the multiple clients.

[0136] Step S3023: Filter out a preset number of target clients that are ranked high.

[0137] The preset number is set by a technician. For example, the preset number is 10, that is, the top 10 target clients are obtained.

[0138] Step S3024: Generate warning information based on the target client identifier corresponding to the target client.

[0139] The target client IP address corresponding to the target client is added to the alarm information to generate an alarm message. The alarm information corresponding to the handle is reported to the NFS protocol alarm module on the storage side every 5 seconds, and the storage side prompts the user to check the alarm information. Based on the alarm information on the storage side, the user obtains the target client ID in the alarm information and determines the client information to be restricted based on the target client ID.

[0140] It should be noted that the user can also selectively close the client to release the handle according to the target client identifier in the alarm information.

[0141] Step S3025: When the cumulative number of input and output operations performed by the client on the day is greater than the preset operation threshold, and the amount of data accessed by the client on the day is less than the preset data amount threshold, an alarm message is generated based on the client identifier corresponding to the client.

[0142] Among them, the timer counts the number of input and output operations performed by the client on the day and the amount of data accessed by the client on the storage end every 24 hours. If the number of input and output operations performed by the client on the day is greater than the preset operation threshold, and the amount of data accessed by the client on the day is less than the preset data volume threshold, the statistical information of the client is determined to be abnormal, and an alarm message with the client identifier of the client is generated. The alarm information is reported to the NFS protocol alarm module of the storage end every 24 hours. The storage end prompts the user to check the alarm information. The user obtains the target client identifier in the alarm information based on the alarm information of the storage end, and determines the client information to be restricted based on the target client identifier.

[0143] Among them, the preset operation threshold and the preset data volume threshold are set by technical personnel.

[0144] Step S3026: When the connection status of the client is abnormal, an alarm message is generated based on the client identifier corresponding to the client.

[0145] If the connection status of the client is abnormal, the client identifier corresponding to the client is added to the alarm information, and the alarm information is reported to the storage end.

[0146] Step S3027: When the connection status of the client is in the disconnected state for a first preset time period, an alarm message is generated based on the client identifier corresponding to the client.

[0147] The first preset time period is set by a technician. For example, the first preset time period is 24 hours. If the client's connection status is disconnected for 24 consecutive hours, an alarm message is generated based on the client identifier corresponding to the client, i.e., the client IP address. The alarm message is reported to the storage end, so that the user can determine the client IP address to be added to the blacklist of the storage end based on the alarm message, and promptly close the connection of the malicious client to avoid hidden risks.

[0148] It should be noted that if a client's connection status is disconnected for 24 consecutive hours, the client's entry will be cleared from the client_stats_map. This action is completed by the timer of the client monitoring module. 24 consecutive hours of disconnection means that the client has not performed any input or output (IO) operations for 24 consecutive hours.

[0149] It should be further explained that when the client triggers the shared directory unmounting process, the NFS protocol end clears the entry of the client from the client_stats_map when receiving the client unmounting shared directory data packet.

[0150] Step S3028: When the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period, an alarm message is generated based on the client identifier corresponding to the client.

[0151] Among them, if the connection status of a client is repeatedly in a normal state and a disconnected state within a second preset time period, the client is determined to be an abnormal client, and an alarm message is generated based on the client identifier corresponding to the client, that is, the client IP, and the alarm message is reported to the storage end.

[0152] It should be noted that the second preset time period is set by a technician and is not specifically limited herein. For example, the second preset time period may be 5 minutes.

[0153] That is, if a client repeatedly connects and disconnects within 5 minutes, the client is determined to be an abnormal client, marked as an abnormal client, and an alarm is reported.

[0154] It should be noted that the number of repeated connections and disconnections must exceed a preset threshold number of times. For example, the preset threshold number of times may be 3 times.

[0155] Step S303: Receive a data access request from the client to the storage end. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0156] Step S304: Parse the data access request to obtain the target path of the data access request. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0157] Step S305: Determine whether the target path is in the directory access control list. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0158] Step S306: If the target path is in the directory access control list, it is determined whether the client identifier of the client corresponding to the data access request is in the whitelist. Figure 1 Step S106 of the illustrated embodiment will not be described in detail here.

[0159] Step S307: If the client ID of the client corresponding to the data access request is not in the whitelist, the data access request is rejected. Figure 1 Step S107 of the illustrated embodiment will not be described in detail here.

[0160] The data access method provided in this embodiment obtains the performance status information of the client at regular intervals, understands the operating status of the client, promptly discovers the abnormality of the client, and realizes the pre-identification of unknown malicious clients. The user determines the real malicious clients from the pre-identified unknown malicious clients and adds the real malicious clients to the blacklist of the storage end, so that these malicious clients cannot access the data of the storage end, thereby improving the data security of the storage end.

[0161] It also helps users adjust business distribution and improve performance and resource utilization. For example, when the bandwidth of a legitimate client is too high, it means that a large amount of business is concentrated on one client, which may be limited by the performance of the client itself and cannot bring out the true performance of the NFS protocol. The data access method of this embodiment enables the NFS protocol end to bring out its true performance.

[0162] The data access method provided in this embodiment monitors the performance status information of the client in real time, and generates an alarm message when the performance status information shows that the resource usage of the client exceeds a preset threshold, or the client is in an abnormal state, or the client is continuously in a disconnected state, or the client repeatedly switches between a normal state and a disconnected state, so that the user can determine the client identifier to be added to the blacklist of the storage end based on the alarm information, thereby realizing the identification and access blocking of unknown malicious clients, making it impossible for these malicious clients to access the data of the storage end, thereby improving the data security of the storage end and ensuring the normal operation of the business.

[0163] By implementing performance status monitoring, alarms, and proactive reporting within the NFS protocol, real-time performance status information is easily accessible. Compared to obtaining NFS alarm information externally, this reduces the time consumption during alarm reporting, ensures more timely and stable alarm information acquisition, and improves performance.

[0164] In some optional implementations, the data access method further includes:

[0165] Step a1: If the target path is not in the directory access control list, a corresponding operation is performed on the storage end based on the data access request.

[0166] If the target path is not in the directory access control list, it means that the data access request can be executed, and then a corresponding operation is performed on the storage end based on the data access request.

[0167] The data access method provided in this embodiment can effectively prevent clients from accessing controlled shared directories through the directory access control list, thereby reducing the risks of data leakage and malicious operations and ensuring the security of the storage end.

[0168] In some optional implementations, the data access method further includes:

[0169] Step b1: When the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, an alarm message is generated and reported to the storage end.

[0170] The system counts the number of clients that have mounted a shared directory on the storage side to a local mount point every 5 seconds. If the number of clients that have mounted a shared directory on the storage side to a local mount point exceeds a preset connection threshold, an alarm is generated and reported to the storage side, allowing the user to determine whether to disable mounting for some clients based on the alarm information on the storage side.

[0171] The data access method provided in this embodiment generates an alarm message when the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, so that the user can close some clients according to the alarm message to avoid affecting the normal operation of the business.

[0172] In some optional implementations, the data access method further includes:

[0173] Step c1, in response to the user's performance status information query operation, sends the client's performance status information to the storage end, so that the user can query the client's performance status information from the storage end, determines the client information to be restricted based on the client's performance status information, and updates the blacklist of the storage end based on the client information to be restricted.

[0174] Among them, based on client_stats_map, the NFS service has the ability to view the performance status information of each client. Users can actively query the performance status information of each client, including each client's IO status, the number of open handles, etc.

[0175] When a user queries a client's performance status information, the NFS client monitoring module establishes a short socket connection with the storage-side performance statistics query module, allowing the storage-side to obtain the performance status information in real time. The NFS client monitoring module sends the client's performance status information to the storage-side performance statistics query module, allowing the user to query the client's performance status information from the module. Based on the client's performance status information, the module determines the client information to be restricted, and updates the storage-side blacklist based on the client information to be restricted.

[0176] It should be noted that users can also close the mounting of some clients based on the performance status information of the clients queried and their own needs.

[0177] The data access method provided in this embodiment allows users to actively obtain the client's performance status information, understand the client's operating status and connection status in detail, and update the storage end's blacklist based on the client's performance status information, thereby achieving the effect of timely discovering unknown malicious clients.

[0178] In some optional implementations, the data access method further includes:

[0179] Step d1: If the target path of the data access request is in the directory access control list but not in the whitelist, and a corresponding operation is performed on the storage end based on the data access request, an alarm message is generated and reported to the storage end.

[0180] Among them, the target path of the data access request is in the directory access controlled list but not in the whitelist, but the corresponding operation is performed on the storage end based on the data access request, indicating that a system failure has occurred, an alarm information is generated and reported to the storage end so that the user can determine and resolve the failure based on the alarm information.

[0181] It should be noted that users can add the client IP to the whitelist to skip the check. That is, if the client IP is in the whitelist, there is no need to count the performance status information of the client corresponding to the client IP, and the data access request sent by the client is directly executed.

[0182] The data access method provided in this embodiment performs corresponding operations on the storage end based on the data access request when the target path of the data access request is in the preset controlled access list but not in the white list. That is, the access of the client to the controlled directory is detected, and an alarm message is generated, so that the user can intervene immediately to avoid potential security threats or malicious behaviors.

[0183] In some optional implementations, the data access method further includes:

[0184] In response to the connection establishment request of the client, a client identifier corresponding to the client is obtained. If the client identifier is not within the preset network segment, an alarm message is generated and reported to the storage end.

[0185] Among them, the user sets a preset network segment on the NFS protocol end, and the client IP outside the network segment refuses to connect to the NFS protocol end. If the client outside the network segment abnormally initiates a connection establishment request, an alarm information is generated based on the client IP of the client, and the alarm information is reported to the storage end so that the user can take corresponding measures based on the alarm information.

[0186] The data access method provided in this embodiment restricts NFS service connections to only clients from a specific network area by setting a preset network segment, thereby reducing the risk of unauthorized access. When a client from a non-preset network segment attempts to connect, the system immediately generates an alert, helping to quickly identify potential security threats.

[0187] In some optional implementations, the NFS protocol end reports the alarm information to the storage end. After receiving the alarm information, the storage end can send the alarm information to the user's corresponding mailbox via email, so that the user can determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted.

[0188] After receiving the alarm information, the storage end can also display the alarm information through a system pop-up window so that the user can receive the alarm information in time, determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted.

[0189] After receiving the alarm information, the storage end can also send the alarm information to the user through the instant messaging tool.

[0190] The data access method provided in this embodiment sends alarm information to users via email, system pop-up window or instant messaging tool, ensuring that users can receive the alarm information in the first time, update the blacklist of the storage end according to the alarm information, and promptly block malicious clients from accessing data on the storage end, thereby ensuring data security on the storage end.

[0191] In this embodiment, a data access device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments. The details that have been described will not be repeated here. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0192] This embodiment provides a data access device, such as Figure 5 As shown, including:

[0193] The statistics module 501 is used to periodically collect statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point.

[0194] Generation module 502 is used to generate alarm information when the performance status information of the client exceeds a preset threshold, and report the alarm information to the storage end, so that the user can determine the client information to be restricted based on the alarm information of the storage end, and update the blacklist of the storage end based on the client information to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point.

[0195] The receiving module 503 is configured to receive a data access request from a client to a storage device.

[0196] The acquisition module 504 is used to parse the data access request and obtain the target path of the data access request.

[0197] The first determination module 505 is configured to determine whether the target path is in a directory access control list, wherein the shared directories in the directory access control list are not allowed to be accessed.

[0198] The second judgment module 506 is used to determine whether the client identifier of the client corresponding to the data access request is in the white list if the target path is in the directory access control list, wherein the clients in the white list are not restricted by the target access control list and are allowed to access all shared directories of the storage end.

[0199] The determination module 507 is configured to refuse to execute the data access request if the client identifier of the client corresponding to the data access request is not in the whitelist.

[0200] In some optional implementations, the data access device further includes:

[0201] The execution unit is configured to execute a corresponding operation on the storage end based on the data access request if the target path is not in the directory access control list.

[0202] In some optional implementations, the statistics module 501 includes:

[0203] The first acquisition unit is used to periodically obtain at least one of the following information for any client: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on that day, and the number of handles opened by the client.

[0204] In some optional implementations, the generating module 502 includes:

[0205] The second acquisition unit is used to acquire the number of handles opened by multiple clients for mounting the shared directory of the storage end to the local mount point when the number of handles opened by the client is greater than a preset handle opening threshold.

[0206] The first sorting unit is used to sort the clients in descending order according to the number of handles opened by the multiple clients.

[0207] The screening unit is used to screen out a preset number of target clients that are ranked high.

[0208] The first generating unit is configured to generate alarm information based on a target client identifier corresponding to the target client.

[0209] The second generating unit is used to generate an alarm message based on the client identifier corresponding to the client when the cumulative number of input and output operations performed by the client on the day is greater than a preset operation threshold and the amount of data accessed by the client on the storage end on the day is less than a preset data amount threshold.

[0210] The third generating unit is configured to generate alarm information based on a client identifier corresponding to the client when the connection status of the client is abnormal.

[0211] The fourth generating unit is configured to generate an alarm message based on a client identifier corresponding to the client when the connection status of the client is in a disconnected state for a continuous first preset time period.

[0212] The fifth generating unit is configured to generate an alarm message based on a client identifier corresponding to the client when the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period.

[0213] In some optional implementations, the data access device further includes:

[0214] The sixth generating unit is configured to generate an alarm message and report the alarm message to the storage end when the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold.

[0215] In some optional implementations, the data access device further includes:

[0216] The first sending unit is used to send the performance status information of the client to the storage end in response to the user's performance status information query operation, so that the user can query the performance status information of the client from the storage end, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

[0217] In some optional implementations, the data access device further includes:

[0218] The seventh generating unit is used to generate an alarm message and report the alarm message to the storage end if the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request.

[0219] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0220] The data access device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0221] The embodiment of the present invention also provides a computer device having the above Figure 5 The data access device shown.

[0222] See also Figure 6 , Figure 6 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 601, memory 602, and the interface for connecting each component, including a high-speed interface and a low-speed interface. Each component utilizes different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instruction executed in the computer device, including being stored in the memory or on the memory to display the graphic information of the GUI on an external input / output device (such as, being coupled to the display device of the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides the necessary operation of part (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 601 is taken as an example.

[0223] Processor 601 may be a central processing unit, a network processor, or a combination thereof. Processor 601 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0224] The memory 602 stores instructions that can be executed by at least one processor 601, so as to enable the at least one processor 601 to execute the method shown in the above embodiment.

[0225] The memory 602 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 602 may optionally include a memory remotely located relative to the processor 601, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0226] The memory 602 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 602 may also include a combination of the above types of memory.

[0227] The computer device further includes a communication interface 603 for the computer device to communicate with other devices or a communication network.

[0228] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0229] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0230] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A data access method, characterized in that: The method comprises: When the client mounts the shared directory of the storage end to the local mount point, regularly performing statistics on the performance status information of the client; When the performance status information of the client exceeds a preset threshold, an alarm is generated and reported to the storage end, so that the user can determine information of clients to be restricted based on the alarm information of the storage end, and update a blacklist of the storage end based on the information of clients to be restricted, wherein the clients in the blacklist cannot mount the shared directory of the storage end to the local mount point; Receiving a data access request to a storage end sent by the client; Parsing the data access request to obtain a target path of the data access request; Determine whether the target path is in a directory access control list, wherein shared directories in the directory access control list are not allowed to be accessed; If the target path is in the directory access controlled list, determining whether the client identifier of the client corresponding to the data access request is in a whitelist, wherein clients in the whitelist are not restricted by the directory access controlled list and are allowed to access all shared directories of the storage end; If the client identifier of the client corresponding to the data access request is not in the whitelist, refusing to execute the data access request; The periodically performing statistics on the performance status information of the client includes: For any client, at least one of the following information is obtained periodically: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on the storage end on that day, and the number of handles opened by the client.

2. The method according to claim 1, characterized in that The method further comprises: If the target path is not in the directory access controlled list, a corresponding operation is performed on the storage end based on the data access request.

3. The method according to claim 1, characterized in that When the performance status information of the client exceeds a preset threshold, generating alarm information includes: When the number of handles opened by the client is greater than a preset handle opening threshold, obtaining the number of handles opened by multiple clients for mounting the shared directory of the storage end to the local mount point; Sort the clients in descending order of the number of handles opened by the clients; Filter out a preset number of target clients that are ranked top; generating alarm information based on a target client identifier corresponding to the target client; generating an alarm message based on the client identifier corresponding to the client when the cumulative number of input and output operations performed by the client on that day is greater than a preset operation threshold and the amount of data accessed by the client on that day to the storage end is less than a preset data amount threshold; When the connection status of the client is abnormal, generating an alarm message based on the client identifier corresponding to the client; When the connection status of the client is in a disconnected state for a continuous first preset time period, generating an alarm message based on the client identifier corresponding to the client; When the connection status of the client is repeatedly in a normal state and a disconnected state within a second preset time period, an alarm message is generated based on the client identifier corresponding to the client.

4. The method according to claim 1, wherein The method further comprises: When the number of clients that mount the shared directory of the storage end to the local mount point exceeds a preset connection threshold, an alarm message is generated and reported to the storage end.

5. The method according to claim 1, wherein The method further comprises: In response to the user's performance status information query operation, the performance status information of the client is sent to the storage end, so that the user can query the performance status information of the client from the storage end, determine the client information to be restricted based on the performance status information of the client, and update the blacklist of the storage end based on the client information to be restricted.

6. The method according to claim 1, wherein The method further comprises: If the target path of the data access request is in the directory access controlled list but not in the white list, and a corresponding operation is performed on the storage end based on the data access request, an alarm message is generated and reported to the storage end.

7. A data access device, characterized in that: The device comprises: A statistics module, configured to periodically collect statistics on the performance status information of the client when the client mounts the shared directory of the storage end to the local mount point; a generating module, configured to generate an alarm message when the performance status information of the client exceeds a preset threshold, and report the alarm message to the storage end, so that the user can determine information of clients to be restricted based on the alarm information of the storage end, and update a blacklist of the storage end based on the information of clients to be restricted, wherein clients in the blacklist cannot mount a shared directory of the storage end to a local mount point; A receiving module, configured to receive a data access request from the client to the storage end; An acquisition module, configured to parse the data access request and obtain a target path of the data access request; A first determination module is configured to determine whether the target path is in a directory access control list, wherein shared directories in the directory access control list are not allowed to be accessed; A second judgment module is configured to judge whether the client identifier of the client corresponding to the data access request is in a whitelist if the target path is in the directory access controlled list, wherein clients in the whitelist are not restricted by the directory access controlled list and are allowed to access all shared directories of the storage end; a determination module, configured to refuse to execute the data access request if the client identifier of the client corresponding to the data access request is not in the whitelist; Statistics modules include: The first acquisition unit is used to periodically obtain at least one of the following information for any client: the connection status of the client, the cumulative number of input and output operations performed by the client on that day, the amount of data accessed by the client on the storage end on that day, and the number of handles opened by the client.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the data access method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the data access method according to any one of claims 1 to 6.

Images