Intelligent computing proprietary cloud security operation system

Abstract

The invention relates to the technical field of server systems, in particular to an intelligent computing proprietary cloud security operation system, which comprises an access point configuration module for acquiring access point information for a to-be-managed cloud platform and configuring access point management information; the service splitting module is used for extracting service related information from the to-be-managed cloud platform; and the environment partition module is used for performing partition control on the to-be-managed cloud platform according to the access point management information and the service related information. Aiming at the problem that an intelligent computing system in the prior art lacks a management and control mechanism, the scheme provides a universal intelligent computing proprietary cloud safety operation system which is used for analyzing a deployed intelligent computing proprietary cloud, determining the connection condition and the operation service condition of a plurality of network access points in the intelligent computing proprietary cloud, and improving the safety of the intelligent computing proprietary cloud. The intelligent computing proprietary cloud is reconfigured according to the importance degree of the access point and the importance degree of the service, so that the security of the intelligent computing proprietary cloud is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of server systems, and in particular to an intelligent computing proprietary cloud security operation system. Background Art

[0002] Intelligent computing dedicated cloud, also known as intelligent computing center, refers to the use of large-scale heterogeneous computing resources, including general computing power (CPU) and intelligent computing power (GPU, FPGA, ASIC, etc.), mainly for artificial intelligence applications (such as artificial intelligence deep learning model development, model training and model reasoning and other scenarios) to provide the required computing power, data and algorithm facilities. Compared with traditional data centers, intelligent computing centers can meet more targeted needs, as well as larger computing volume and faster computing speed, and provide AI computing power for various vertical industry scenarios such as large model training reasoning, autonomous driving, AIGC, etc. Users access the intelligent computing center through the Internet and deploy models. The management center schedules computing power according to business needs and provides network support.

[0003] In the prior art, there are management systems for such intelligent computing centers. For example, Chinese patent CN202410313766.9 discloses an active queue management algorithm based on a P4 programmable switch, including the following steps: Step 1: Copy the message and distinguish between business messages and control messages, Step 2: Select a queue, Step 3: Update the queue length and calculate the average queue length, Step 4: Match the discard probability with the average queue length, Step 5: Store the discard probability in the inlet pipe, Step 6: Distinguish between admitted traffic and non-admitted traffic, Step 7: Discard non-admitted traffic according to probability, decouple the congestion detection and feedback mechanisms of queue management, generate control messages through replication, implement congestion detection by business messages, and implement feedback on the discard probability by control messages, which not only ensures the normal forwarding of business messages, but also realizes fine-grained feedback.

[0004] However, during the actual implementation process, the inventors found that such technical solutions usually only focus on the scheduling process of computing power and networks, and lack a security control mechanism for intelligent computing systems. In particular, intelligent computing systems may deploy AI applications from multiple manufacturers during application, which may lead to advanced threats such as data leakage and model theft during large model training. Summary of the invention

[0005] In view of the above-mentioned problems existing in the prior art, a smart computing private cloud security operation system is now provided.

[0006] The specific technical solutions are as follows:

[0007] A smart computing proprietary cloud security operation system, comprising:

[0008] An access point configuration module, which collects access point information for the cloud platform to be managed and configures access point management information;

[0009] A service splitting module, wherein the service splitting module extracts service related information from the cloud platform to be managed;

[0010] An environment partitioning module, wherein the environment partitioning module is connected to the access point configuration module and the service splitting module respectively, and the environment partitioning module performs partition control on the cloud platform to be managed according to the access point management information and the service related information.

[0011] On the other hand, the access point configuration module includes:

[0012] An access point acquisition module, which reads the data interface of the cloud platform to be managed and determines the network connection to which each data interface points;

[0013] An access point determination module, the access point determination module is connected to the access point acquisition module, and the access point determination module determines the network area to which each network connection points;

[0014] A network policy configuration module, wherein the network policy configuration module is connected to the access point identification module, and the network policy configuration module configures the access point management information according to the network area.

[0015] On the other hand, the access point acquisition module includes:

[0016] An interface reading module, the interface reading module obtains an interface document of the cloud platform to be managed and obtains a plurality of interfaces to be identified from the interface document;

[0017] An interface classification module, the interface classification module is connected to the interface reading module, and the interface classification module determines whether the interface to be determined is an internal interface or an external interface according to the object pointed to by the interface to be determined;

[0018] A network connection extraction module is connected to the interface classification module, and the network connection extraction module extracts access links from the external interface to determine the network connection.

[0019] On the other hand, the access point identification module includes:

[0020] An address classification module, wherein the address classification module classifies the network connection to obtain a URL type access address and an IP type access address;

[0021] A network segment identification module, the network segment identification module is connected to the address classification module, and the network segment identification module classifies the IP class access address to distinguish between an external network IP address and an internal network IP address;

[0022] A region marking module, wherein the region marking module is connected to the address classification module and the network segment identification module respectively, and the region marking module marks the Internet region, the extranet region and the intranet region as the network region according to the URL class access address, the external network IP address and the internal network IP address.

[0023] On the other hand, the network policy configuration module includes:

[0024] An access rule configuration module, wherein the access rule configuration module configures corresponding access rules according to the network area;

[0025] A partition configuration module is used to configure an accessible file area for the network area.

[0026] On the other hand, the service splitting module includes:

[0027] A service reading module, wherein the service reading module extracts service information from the cloud platform to be managed;

[0028] A parameter extraction module, the parameter extraction module is connected to the service reading module, and the parameter extraction module extracts related parameters according to the service information;

[0029] An importance determination module is connected to the parameter extraction module, and determines the importance of the corresponding service according to the service information and the associated parameters, and generates the service related information.

[0030] On the other hand, the parameter extraction module comprises:

[0031] A process name reading module, wherein the process name reading module determines the process name that the service will create according to the service information;

[0032] A process name comparison module is connected to the process name reading module, and the process name comparison module marks the process name according to the important process index to determine the important process.

[0033] On the other hand, the environment partition module includes:

[0034] An access point partitioning module, wherein the access point partitioning module configures access point partitions according to the access point management information;

[0035] A service partitioning module, wherein the service partitioning module configures service partitions according to the service related information;

[0036] A mapping module, wherein the mapping module is connected to the access point partition module and the service partition module respectively, and the mapping module configures the data transmission relationship between the access point partition and the service partition and between the service partitions respectively.

[0037] The above technical solution has the following advantages or beneficial effects:

[0038] In response to the problem that the intelligent computing system in the existing technology lacks a management and control mechanism, this solution provides a universal intelligent computing private cloud security operation system, which is used to analyze the deployed intelligent computing private cloud, determine the connection status and running service status of multiple network access points in the intelligent computing private cloud, and reconfigure the intelligent computing private cloud according to the importance of the access points and the importance of the services, thereby improving the security of the intelligent computing private cloud. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The embodiments of the present invention will be described more fully with reference to the attached drawings, which are provided for illustration and description only and are not intended to limit the scope of the present invention.

[0040] Figure 1 is an overall schematic diagram of an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of an access point configuration module in an embodiment of the present invention;

[0042] Figure 3 Schematic diagram of an access point acquisition module in an embodiment of the present invention;

[0043] Figure 4 Schematic diagram of an access point identification module in an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of a network policy configuration module in an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of a service splitting module in an embodiment of the present invention;

[0046] Figure 7 Schematic diagram of a parameter extraction module in an embodiment of the present invention;

[0047] Figure 8 Schematic diagram of a service partition module in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0050] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but they are not intended to limit the present invention.

[0051] The present invention comprises:

[0052] A smart computing proprietary cloud security operation system, such as Figure 1 As shown, including:

[0053] Access point configuration module 1, access point configuration module 1 collects access point information for the cloud platform to be managed and configures access point management information;

[0054] Service splitting module 2, the service splitting module 2 extracts service related information from the management cloud platform;

[0055] The environment partitioning module 3 is connected to the access point configuration module 1 and the service splitting module 2 respectively, and the environment partitioning module 3 performs partition control on the management cloud platform according to the access point management information and service related information.

[0056] Specifically, in response to the problem that the intelligent computing system in the prior art lacks a management and control mechanism, this solution provides a universal intelligent computing private cloud security operation system for analyzing the deployed intelligent computing private cloud, determining the connection status of multiple network access points in the intelligent computing private cloud through the access point configuration module 1, and determining the running service status through the service splitting module 2. The environment partitioning module 3 reconfigures the intelligent computing private cloud according to the importance of the access point and the importance of the service, thereby improving the security of the intelligent computing private cloud.

[0057] During the implementation process, the above-mentioned intelligent computing private cloud security operation system is mainly configured as a software implementation in computer equipment, such as a server. The cloud platform to be managed is a deployed intelligent computing private cloud, which is used to run the artificial intelligence models required by external users, and usually provides some network interfaces for users to access and use. The cloud platform to be managed itself has a corresponding computer cluster and central control system, and also includes a storage array. Access point management information is network access point information collected for the cloud platform to be managed, including internal interfaces and external interfaces. Under normal circumstances, according to the needs of different models running on the platform, there may only be local access needs and external access needs, so access points with different confidentiality levels need to be partitioned and isolated. Service-related information refers to the services and threads that will be created according to different models during the operation of the cloud platform to be managed. According to the importance of different models, the models can be virtualized, partitioned, stored, and memory isolated.

[0058] In one embodiment, Figure 2 As shown, the access point configuration module 1 includes:

[0059] The access point acquisition module 11 reads the data interface of the cloud platform to be managed and determines the network connection to which each data interface points;

[0060] An access point determination module 12, the access point determination module 12 is connected to the access point acquisition module 11, and the access point determination module 12 determines the network area to which each network connection points;

[0061] The network policy configuration module 13 is connected to the access point identification module 12, and the network policy configuration module 13 configures access point management information according to the network area.

[0062] Specifically, in order to achieve better management of access points, in this embodiment, the data interface of the cloud platform to be managed is first read through the access point acquisition module 11, and the network connection pointed to by each data interface is determined. The data interface (API) is an interface that the external application will call during work, and can be accessed through specific messages and output data can be obtained. The associated network connection can be extracted by reading the work log. Then, the access point determination module 12 determines the network area pointed to by each network connection, that is, whether it points to an external network or performs a local loopback on the cloud platform or only performs internal access. On this basis, the network policy configuration module 13 configures the access point management information according to the network area.

[0063] In one embodiment, Figure 3 As shown, the access point acquisition module 11 includes:

[0064] The interface reading module 11 obtains the interface document of the cloud platform to be managed and obtains a plurality of interfaces to be identified from the interface document;

[0065] The interface classification module 12 is connected to the interface reading module 11, and the interface classification module 12 determines whether the interface to be determined is an internal interface or an external interface according to the object pointed to by the interface to be determined;

[0066] The network connection extraction module 13 is connected to the interface classification module 12, and the network connection extraction module 13 extracts access links from external interfaces to determine network connections.

[0067] Specifically, in order to achieve a better interface identification effect, in this embodiment, the interface reading module 11 obtains the interface document of the cloud platform to be managed, and then determines the paragraph corresponding to the interface definition by semantic recognition, thereby finding multiple interfaces to be identified. Then, the interface to be identified and the associated description information are input into the interface classification module 12. The interface classification module 12 determines whether the interface to be identified is an internal interface or an external interface within the model according to the object pointed to by the interface to be identified, and then eliminates the internal data interface that is only used for jumping within the model. Finally, the network connection extraction module 13 obtains the access link for the external interface by searching the access log to determine the network connection.

[0068] In one embodiment, Figure 4 As shown, the access point determination module 12 includes:

[0069] An address classification module 121, the address classification module 121 classifies network connections to obtain URL-type access addresses and IP-type access addresses;

[0070] A network segment identification module 122, the network segment identification module 122 is connected to the address classification module 121, and the network segment identification module 122 classifies the IP class access address to distinguish between an external network IP address and an internal network IP address;

[0071] The area marking module 123 is connected to the address classification module 121 and the network segment identification module 122 respectively. The area marking module 123 marks the Internet area, the extranet area and the intranet area as the network area according to the URL class access address, the external network IP address and the internal network IP address.

[0072] Specifically, in order to achieve better time identification of network areas, in this embodiment, the address classification module 121 first classifies the network connection by whether the character string contains numbers of specific rules to obtain the URL type access address and the IP type access address. For the URL type access address, since it must be mapped through the DNS, it can be directly defined as the address of the Internet area. For the IP type access address, the network segment identification module 122 classifies the IP type access address based on the address rules to distinguish it into an external network IP address and an internal network IP address. Finally, the area marking module 123 marks the Internet area, the extranet area and the intranet area as the network area according to the URL type access address, the external network IP address and the internal network IP address.

[0073] In one embodiment, Figure 5 As shown, the network policy configuration module 13 includes:

[0074] An access rule configuration module 131, the access rule configuration module 131 configures corresponding access rules according to the network area;

[0075] The partition configuration module 132 configures the accessible file areas for the network areas.

[0076] Specifically, in order to achieve a better partition management effect, in this embodiment, corresponding virtual network cards are configured for different access points, and a one-to-one correspondence between virtual network cards and access points is established through the data stack. On this basis, the access rule configuration module 131 configures the corresponding access rules according to the network area, points the data packets of different network addresses to the specific virtual network card for single-line transmission, and the partition configuration module 132 configures the accessible file area for the network area. During operation, the model will be set in a virtualized container to access a specific file partition, and the inflow and outflow of data will be forwarded to the specific virtual network card through the data stack, and forwarded to the specific network area, thereby realizing cross-zone management.

[0077] In one embodiment, Figure 6 As shown, the service splitting module 2 includes:

[0078] A service reading module 21, which extracts service information from the cloud platform to be managed;

[0079] A parameter extraction module 22, the parameter extraction module 22 is connected to the service reading module 21, and the parameter extraction module 22 extracts related parameters according to the service information;

[0080] The importance judgment module 23 is connected to the parameter extraction module 22. The importance judgment module 23 determines the importance of the corresponding service according to the service information and the associated parameters, and generates service related information.

[0081] Specifically, in order to achieve the distinction between services, in this embodiment, first, the service reading module 21 extracts service information from the management cloud platform, and then the parameter extraction module 22 extracts associated parameters for the service information, that is, the priority of the service at runtime, other associated services, accessed file types and importance to the system. Finally, the importance judgment module 23 determines the importance of the corresponding service based on the service information and associated parameters, and generates service-related information.

[0082] In one embodiment, Figure 7 As shown, the parameter extraction module 2 includes:

[0083] A process name reading module 22, which determines the process name that the service will create based on the service information;

[0084] The process name comparison module 23 is connected to the process name reading module 22. The process name comparison module 23 marks the process name according to the important process index to determine the important process.

[0085] Specifically, in order to determine the importance of a service, in this embodiment, the process name reading module 22 is first used to determine the process name that the service will create based on the service information. Then, the process name comparison module 23 marks the process name according to the important process index to determine important processes, such as system-level processes and processes associated with other services, so as to determine important services.

[0086] In one embodiment, Figure 8 As shown, the environment partition module 3 includes:

[0087] An access point partitioning module 31, the access point partitioning module 31 configures access point partitions according to access point management information;

[0088] A service partitioning module 32, the service partitioning module 32 configures service partitions according to service related information;

[0089] The mapping module 33 is connected to the access point partitioning module 31 and the service partitioning module 32 respectively, and the mapping module 33 configures the data transmission relationship between the access point partition and the service partition, and between the service partitions respectively.

[0090] Specifically, after determining the above information, in the environment partitioning module 3, the access point partition is configured according to the access point management information through the access point partitioning module 31, and the service partition is configured according to the service related information through the service partitioning module 32. Finally, in response to the mutual calling requirements between services, the mapping module 33 configures the data transmission relationship between the access point partition and the service partition, and between the service partitions.

[0091] The above are only preferred embodiments of the present invention, and are not intended to limit the implementation methods and protection scope of the present invention. Those skilled in the art should be aware that all solutions obtained by equivalent substitutions and obvious changes made using the description and illustrations of the present invention should be included in the protection scope of the present invention.

Claims

1. A smart computing private cloud security operation system, characterized in that: include: An access point configuration module, which collects access point information for the cloud platform to be managed and configures access point management information; A service splitting module, wherein the service splitting module extracts service related information from the cloud platform to be managed; An environment partitioning module, wherein the environment partitioning module is connected to the access point configuration module and the service splitting module respectively, and the environment partitioning module performs partition control on the cloud platform to be managed according to the access point management information and the service related information.

2. The intelligent computing private cloud security operation system according to claim 1, characterized in that: The access point configuration module includes: An access point acquisition module, which reads the data interface of the cloud platform to be managed and determines the network connection to which each data interface points; An access point determination module, the access point determination module is connected to the access point acquisition module, and the access point determination module determines the network area to which each network connection points; A network policy configuration module, wherein the network policy configuration module is connected to the access point identification module, and the network policy configuration module configures the access point management information according to the network area.

3. The intelligent computing private cloud security operation system according to claim 2 is characterized in that: The access point acquisition module includes: An interface reading module, the interface reading module obtains an interface document of the cloud platform to be managed and obtains a plurality of interfaces to be identified from the interface document; An interface classification module, the interface classification module is connected to the interface reading module, and the interface classification module determines whether the interface to be determined is an internal interface or an external interface according to the object pointed to by the interface to be determined; A network connection extraction module is connected to the interface classification module, and the network connection extraction module extracts access links from the external interface to determine the network connection.

4. The intelligent computing private cloud security operation system according to claim 2, characterized in that: The access point identification module comprises: An address classification module, wherein the address classification module classifies the network connection to obtain a URL type access address and an IP type access address; A network segment identification module, the network segment identification module is connected to the address classification module, and the network segment identification module classifies the IP class access address to distinguish between an external network IP address and an internal network IP address; A region marking module, wherein the region marking module is connected to the address classification module and the network segment identification module respectively, and the region marking module marks the Internet region, the extranet region and the intranet region as the network region according to the URL class access address, the external network IP address and the internal network IP address.

5. The intelligent computing private cloud security operation system according to claim 2, characterized in that: The network policy configuration module includes: An access rule configuration module, wherein the access rule configuration module configures corresponding access rules according to the network area; A partition configuration module is used to configure an accessible file area for the network area.

6. The intelligent computing private cloud security operation system according to claim 1, characterized in that: The service splitting module includes: A service reading module, wherein the service reading module extracts service information from the cloud platform to be managed; A parameter extraction module, the parameter extraction module is connected to the service reading module, and the parameter extraction module extracts related parameters according to the service information; An importance determination module is connected to the parameter extraction module, and determines the importance of the corresponding service according to the service information and the associated parameters, and generates the service related information.

7. The intelligent computing private cloud security operation system according to claim 6, characterized in that: The parameter extraction module comprises: A process name reading module, wherein the process name reading module determines the process name that the service will create according to the service information; A process name comparison module is connected to the process name reading module, and the process name comparison module marks the process name according to the important process index to determine the important process.

8. The intelligent computing private cloud security operation system according to claim 1, characterized in that: The environment partition module includes: An access point partitioning module, wherein the access point partitioning module configures access point partitions according to the access point management information; A service partitioning module, wherein the service partitioning module configures service partitions according to the service related information; A mapping module, wherein the mapping module is connected to the access point partition module and the service partition module respectively, and the mapping module configures the data transmission relationship between the access point partition and the service partition and between the service partitions respectively.

Images