Distributed cloud monitoring system and data monitoring method

Abstract

The invention relates to a distributed cloud monitoring system and a data monitoring method. Comprising a control plane platform, a plurality of first gateway devices and a data plane platform, the data plane platform comprises a plurality of data centers, and the plurality of first gateway devices and the plurality of data centers are in one-to-one correspondence. And each data center comprises a plurality of user equipment, second gateway equipment in one-to-one correspondence with the plurality of user equipment, and control plane equipment. According to the method, the confidentiality and the integrity of data are guaranteed, the stability and the safety of the system are also remarkably enhanced, the credibility and the protection capability of network communication are ensured, and zero-trust safety is realized.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a distributed cloud monitoring system and a data monitoring method. Background Art

[0002] In the current era of digital transformation, enterprises are constantly seeking more efficient and flexible ways to develop, deploy and manage applications. Cloud native technology came into being in this context. Its features such as containerization, microservice architecture, continuous delivery and dynamic orchestration make service implementation more convenient and quickly become the core of modern software development and IT operations. Under this framework, distributed cloud scenarios, due to their significant advantages in cluster management across multiple nodes and geographical locations, combine the advantages of containerization technology with the flexibility of cloud computing, and provide strong support for enterprises to cope with complex and dynamic market demands, especially in large enterprise projects. In distributed cloud scenarios, deploying a monitoring system is a key link to ensure system performance, reliability and security.

[0003] However, there are many challenges in deploying monitoring infrastructure in distributed cloud scenarios, especially in terms of security. There are many nodes in distributed cloud scenarios, resulting in complex network links. These complexities make it easy for network attackers to forge and tamper with data through links, and then attack the monitoring system, causing losses to the enterprise. Therefore, ensuring the security of the monitoring infrastructure and preventing network attacks are key challenges that must be taken seriously when deploying distributed cloud monitoring systems. Summary of the invention

[0004] Based on this, it is necessary to provide a distributed cloud monitoring system and data monitoring method that can prevent network attacks in response to the above technical problems.

[0005] In a first aspect, the present application provides a distributed cloud monitoring system, including a control plane platform, a plurality of first gateway devices and a data plane platform, the data plane platform including a plurality of data centers, the plurality of first gateway devices corresponding to the plurality of data centers one-to-one, each data center including a plurality of user devices, a second gateway device corresponding to the plurality of user devices one-to-one, and a control plane device; wherein;

[0006] After the user device is used to collect monitoring data, it performs security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted and the obtained first encrypted data is sent to the corresponding second gateway device;

[0007] The second gateway device is used to perform security authentication with a target control plane device included in the data center to which it belongs, and after the security authentication is passed, send the first encrypted data to the target control plane device;

[0008] The target control plane device is used to decrypt the first encrypted data to obtain the first decrypted data, filter the first decrypted data to obtain the data to be transmitted; perform security authentication on the first target gateway device corresponding to the data center, encrypt the data to be transmitted after the security authentication is passed, and send the obtained second encrypted data to the first target gateway device;

[0009] The first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform;

[0010] The control plane platform is used to decrypt the second encrypted data to obtain second decrypted data, and perform data integration based on the second decrypted data.

[0011] In one of the embodiments, each user device includes an application and a first security agent;

[0012] The application is used to collect monitoring data and report the monitoring data to the first security agent;

[0013] The first security agent is used to perform security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device.

[0014] In one of the embodiments, the control plane device included in each data center includes: a second security agent and a first monitoring alarm toolkit;

[0015] The second security agent is used to decrypt the first encrypted data to obtain first decrypted data, and send the first decrypted data to the first monitoring alarm toolkit;

[0016] The first monitoring alarm toolkit is used to filter out the first decrypted data according to a preset index filtering rule to obtain the data to be transmitted.

[0017] In one of the embodiments, the first monitoring alarm toolkit is further used to determine whether to add a target tag to the first decrypted data according to a preset aggregation logic;

[0018] If the judgment result is yes, a target tag is added to the first decrypted data, and aggregation processing is performed on all decrypted data to which the target tag is added.

[0019] In one of the embodiments, the control plane platform includes: a third security agent and a second monitoring alert toolkit;

[0020] The third security agent is used to decrypt the second encrypted data to obtain second decrypted data, and send the second decrypted data to the second monitoring alarm toolkit;

[0021] The second monitoring alarm toolkit is used for performing data integration based on the second decrypted data.

[0022] In one of the embodiments, the second monitoring alarm toolkit is further used to store the second decrypted data in a database.

[0023] In a second aspect, the present application further provides a data monitoring method, which is applied to a user device, wherein the user device includes an application and a first security agent; the method includes:

[0024] The application collects monitoring data and reports the monitoring data to the first security agent;

[0025] The first security agent performs security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device to instruct the second gateway device to perform security authentication with the target control plane device included in the data center to which it belongs. After the security authentication is passed, the first encrypted data is sent to the target control plane device; to instruct the target control plane device to decrypt the first encrypted data to obtain first decrypted data, and filter the first decrypted data to obtain data to be transmitted; to perform security authentication with the first target gateway device corresponding to the data center to which it belongs, and after the security authentication is passed, the data to be transmitted is encrypted, and the obtained second encrypted data is sent to the first target gateway device; to instruct the first target gateway device to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform; to instruct the control plane platform to decrypt the second encrypted data to obtain second decrypted data, and perform data integration based on the second decrypted data.

[0026] In a third aspect, the present application further provides a data monitoring method, which is applied to a control plane device, wherein the control plane device includes a second security agent and a first monitoring alarm toolkit; the method includes:

[0027] The second security agent decrypts the first encrypted data from the second gateway device to obtain first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit;

[0028] The first monitoring alarm toolkit filters the first decrypted data according to a preset index filtering rule to obtain data to be transmitted;

[0029] The second security agent performs security authentication with the first target gateway device corresponding to the data center to which it belongs. After the security authentication is passed, the data to be transmitted is encrypted, and the obtained second encrypted data is sent to the first target gateway device; to instruct the first target gateway device to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform; to instruct the control plane platform to decrypt the second encrypted data, obtain second decrypted data, and perform data integration based on the second decrypted data.

[0030] In a fourth aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the data monitoring method provided in the second or third aspect is implemented.

[0031] In a fifth aspect, the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the data monitoring method provided in the second or third aspect is implemented.

[0032] The above-mentioned distributed cloud monitoring system and data monitoring method include a control plane platform, a plurality of first gateway devices and a data plane platform, the data plane platform includes a plurality of data centers, the plurality of first gateway devices correspond to the plurality of data centers one by one, each data center includes a plurality of user devices, a second gateway device corresponding to the plurality of user devices one by one, and a control plane device; wherein: the user device is used to collect monitoring data, and then perform security authentication with the corresponding second gateway device, after the security authentication is passed, the monitoring data is encrypted, and the obtained first encrypted data is sent to the corresponding second gateway device; the second gateway device is used to perform security authentication with the target control plane device contained in the data center to which it belongs, and after the security authentication is passed, Afterwards, the first encrypted data is sent to the target control plane device; the target control plane device is used to decrypt the first encrypted data to obtain the first decrypted data, filter the first decrypted data, and obtain the data to be transmitted; the first target gateway device corresponding to the data center is securely authenticated, and after the security authentication is passed, the data to be transmitted is encrypted, and the second encrypted data obtained is sent to the first target gateway device; the first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform; the control plane platform is used to decrypt the second encrypted data to obtain the second decrypted data, and perform data integration based on the second decrypted data. Throughout the process, from the perspective of the sender or the receiver, the attacker can only see the encrypted data and cannot obtain the plaintext data unless he can obtain the encryption key. In addition, on the control plane, the attacker must pass strict identity authentication to access the corresponding data. This mechanism not only ensures the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensures the credibility and protection capabilities of network communication, and realizes zero-trust security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 An architectural diagram of a distributed cloud monitoring system in one embodiment;

[0035] Figure 2 It is an architecture diagram of a distributed cloud monitoring system in another embodiment;

[0036] Figure 3 It is an architecture diagram of a distributed cloud monitoring system in yet another embodiment;

[0037] Figure 4 It is an architecture diagram of a distributed cloud monitoring system in yet another embodiment;

[0038] Figure 5 It is an architecture diagram of a distributed cloud monitoring system in yet another embodiment;

[0039] Figure 6 A schematic diagram of a data monitoring method in one embodiment;

[0040] Figure 7 FIG. 4 is a flow chart of a data monitoring method in another embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0042] In an exemplary embodiment, Figure 1 As shown, a distributed cloud monitoring system is provided, including a control plane platform, a plurality of first gateway devices and a data plane platform, the data plane platform includes a plurality of data centers, the plurality of first gateway devices correspond to the plurality of data centers one-to-one, each data center includes a plurality of user devices, a second gateway device corresponding to the plurality of user devices one-to-one, and a control plane device; wherein; after the user device is used to collect monitoring data, it performs security authentication with the corresponding second gateway device, after the security authentication is passed, the monitoring data is encrypted, and the obtained first encrypted data is sent to the corresponding second gateway device; the second gateway device is used to perform security authentication with the target control plane device contained in the data center to which it belongs, after the security authentication is passed After that, the first encrypted data is sent to the target control plane device; the target control plane device is used to decrypt the first encrypted data to obtain the first decrypted data, filter the first decrypted data to obtain the data to be transmitted; the first target gateway device corresponding to the data center to which it belongs performs security authentication, and after the security authentication is passed, the data to be transmitted is encrypted, and the obtained second encrypted data is sent to the first target gateway device; the first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform; the control plane platform is used to decrypt the second encrypted data to obtain the second decrypted data, and perform data integration based on the second decrypted data.

[0043] Optionally, the embodiments of the present application focus on possible attackers inside and outside the distributed cloud, including but not limited to infected nodes lurking in the data center and external network adversaries who can access the public service ports open to the outside world by the control plane. These attackers conduct reconnaissance by monitoring messages in public network channels to intercept or tamper with the monitoring data therein. This causes the control plane to misjudge and operate the application or node expansion and contraction, etc., causing serious damage to production activities.

[0044] It should be noted that: Figure 1 In the example, the data plane platform includes two data centers, and each data center includes two user devices. The number of data centers can be greater, the number of user devices included in the data center can be greater, and the number of user devices included in each data center can be different. Figure 1 The data plane platform and the control plane device are used to display or make decisions on the reported data.

[0045] Optionally, the monitoring data may include application online status, application CPU usage, application memory usage, etc. The application here may be a pod in the open source container orchestration system Kubernetes.

[0046] The assumption in the embodiments of this application that the system and network traffic within the data center are trustworthy is not true. To solve this problem, any terminal traffic outside the host range is encrypted and authenticated. This approach effectively prevents attackers from eavesdropping on data, masquerading attacks, and replay attacks. By providing a zero-trust security solution, this solution greatly improves the overall security factor of the distributed cloud, thereby ensuring the security and reliability of the distributed cloud environment. Among them, for Figure 1 Any user device in can report monitoring data in the following way: after the user device collects the monitoring data, it performs security authentication with the corresponding second gateway device. For example, it can use the encryption protocol (Transport Layer Security, TLS for short) to perform security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted using the encryption key obtained during the security authentication process to obtain the first encrypted data, and the first encrypted data is sent to the corresponding second gateway device. This encryption method can shrink the network attack surface to the endpoint node device, that is, the security level of the application and physical device.

[0047] Optionally, TLS 1.3 can be used for security authentication with the corresponding second gateway device. Compared with TLS 1.2, the handshake process of TLS 1.3 reduces the number of round trips (usually only one round trip is required), removes support for insecure algorithms, simplifies the protocol, and improves security and performance. The encryption key generated when TLS is used for security authentication is a symmetric key.

[0048] Among them, since no third party can be trusted, the certificate used by TLS is not issued by a recognized CA organization, but is issued by the distributed cloud itself.

[0049] Among them, after the second gateway device receives the first encrypted data, it performs security authentication with the target control plane device included in the data center to which it belongs. Exemplarily, an encryption protocol (Transport Layer Security, TLS for short) can be used to perform security authentication with the target control plane device included in the data center to which it belongs. After the security authentication is passed, the first encrypted data is sent to the target control plane device.

[0050] After receiving the first encrypted data, the target control plane device uses the encryption key obtained in the security authentication process to decrypt the first encrypted data to obtain first decrypted data, and filters the first decrypted data according to the pre-set indicator filtering rules to obtain the data to be transmitted.

[0051] Exemplarily, the administrator of the data center can pre-configure indicator filtering rules, which include some less useful monitoring indicators. After the target control plane device decrypts and obtains the first decrypted data, it searches whether the first decrypted data contains data under these monitoring indicators. If so, these data are deleted. This can ensure that the control plane platform only receives relevant indicator data, thereby avoiding the transmission of irrelevant data and significantly reducing the link load.

[0052] Optionally, at the control plane device node, the administrator can choose to continue reporting the data to a higher-level control plane, where it can also be consumed.

[0053] Among them, after obtaining the data to be transmitted, the target control plane device performs security authentication with the first target gateway device corresponding to the data center to which it belongs. Exemplarily, an encryption protocol (Transport Layer Security, TLS for short) can be used to perform security authentication with the first target gateway device corresponding to the data center to which it belongs. After the security authentication is passed, the encryption key obtained during the security authentication process is used to encrypt the data to be transmitted to obtain second encrypted data, and the second encrypted data is sent to the first target gateway device.

[0054] Among them, after the first target gateway device receives the second encrypted data, it performs security authentication with the control plane platform. For example, the encryption protocol (Transport Layer Security, referred to as TLS) can be used to perform security authentication with the control plane platform. After the security authentication is passed, the second encrypted data is sent to the control plane platform; the control plane platform uses the encryption key obtained during the security authentication process to decrypt the second encrypted data, obtain the second decrypted data, and perform data integration based on the second decrypted data. So far, from point to surface, the monitoring data in each data center of the entire distributed cloud has been collected. In the whole process, all traffic across various hardware devices (endpoints) is encrypted. Unless the attacker has a way to crack the TLS handshake process, all data is safe and reliable. In the overall control plane, the data reported by each data center can be further aggregated, and then the data can be consumed through grafana or based on other strategies.

[0055] In the above embodiment, a distributed cloud monitoring system is provided, including a control plane platform, a plurality of first gateway devices and a data plane platform, the data plane platform includes a plurality of data centers, the plurality of first gateway devices correspond to the plurality of data centers one by one, each data center includes a plurality of user devices, a second gateway device corresponding to the plurality of user devices one by one, and a control plane device; wherein; the user device is used to collect monitoring data, and then perform security authentication with the corresponding second gateway device, after the security authentication is passed, the monitoring data is encrypted, and the obtained first encrypted data is sent to the corresponding second gateway device; the second gateway device is used to perform security authentication with the target control plane device contained in the data center to which it belongs, and after the security authentication is passed, After passing, the first encrypted data is sent to the target control plane device; the target control plane device is used to decrypt the first encrypted data to obtain the first decrypted data, filter the first decrypted data, and obtain the data to be transmitted; the first target gateway device corresponding to the data center is securely authenticated, and after the security authentication is passed, the data to be transmitted is encrypted, and the second encrypted data obtained is sent to the first target gateway device; the first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform; the control plane platform is used to decrypt the second encrypted data to obtain the second decrypted data, and perform data integration based on the second decrypted data. Throughout the process, from the perspective of the sender or the receiver, the attacker can only see the encrypted data and cannot obtain the plaintext data unless he can obtain the encryption key. In addition, on the control plane, the attacker must pass strict identity authentication to access the corresponding data. This mechanism not only ensures the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensures the credibility and protection capabilities of network communications, and realizes zero-trust security.

[0056] In some embodiments, see Figure 2 As shown, each user device includes an application and a first security agent; the application is used to collect monitoring data and report the monitoring data to the first security agent; the first security agent is used to perform security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device.

[0057] Optionally, the application can be a pod in the open source container orchestration system Kubernetes.

[0058] The application may detect its own online status, the occupancy of the central processing unit (CPU), the occupancy of the memory, etc. as monitoring data, and report the monitoring data to a first security agent.

[0059] Among them, after the first security agent receives the monitoring data, it uses the encryption protocol (Transport Layer Security, abbreviated as TLS) to perform security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device.

[0060] In the above embodiment, a first security agent is configured in the user equipment. The first security agent can be used to perform security authentication with the next-hop hardware device, thereby improving the stability and security of the system.

[0061] In some embodiments, see Figure 3 As shown, the control plane equipment included in each data center includes: a second security agent and a first monitoring alarm toolkit; the second security agent is used to decrypt the first encrypted data to obtain first decrypted data, and send the first decrypted data to the first monitoring alarm toolkit; the first monitoring alarm toolkit is used to filter out the first decrypted data according to pre-set indicator filtering rules to obtain data to be transmitted.

[0062] Among them, the second security agent can be used to perform security authentication with the previous hop hardware device (second gateway device). After the security authentication is passed, the second security agent receives the first encrypted data from the previous hop hardware device, decrypts the first encrypted data based on the encryption key obtained in the security authentication process, obtains the first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit. Since the data is encrypted during the transmission from the first security agent to the second security agent, the attacker cannot eavesdrop on any monitoring data.

[0063] Optionally, the first monitoring alarm toolkit can also consume the data reported by each user device by periodically pulling the data from the second security agent. The first monitoring alarm toolkit can be Prometheus. Prometheus itself supports data encryption and decryption through self-signed certificates. Therefore, there is no need to worry about attackers reading monitoring data through externally exposed interfaces at this control node. Prometheus also has powerful data clipping and aggregation capabilities, which can effectively optimize the transmission and storage efficiency of monitoring data. For example, the data reported by all user devices in the same access zone (AZ) can be aggregated, and some useless monitoring indicators can be filtered out to avoid high link network load.

[0064] Optionally, the pre-set index filtering rules include useless monitoring indicators configured by the administrator. The first monitoring alarm tool searches whether the first decrypted data contains data under these monitoring indicators, and if so, deletes the data, thereby avoiding the transmission of irrelevant data and significantly reducing the link load.

[0065] In the above embodiment, a second security agent is configured in the control plane device, and the first security agent can be used to perform security authentication with the previous hop hardware device and the next hop hardware device, which can improve the stability and security of the system.

[0066] In some embodiments, the monitoring alarm toolkit is also used to determine whether to add a target tag to the first decrypted data according to a preset aggregation logic; if the judgment result is yes, add a target tag to the first decrypted data and perform aggregation processing on all decrypted data with the target tag added.

[0067] Exemplarily, the pre-set aggregation logic may be to aggregate all data with certain characteristics. In this case, after obtaining the first decrypted data, the first monitoring alarm toolkit may determine whether the first decrypted data has the above characteristics. If so, it is determined that a target tag needs to be added to the first decrypted data; the target tag is added to the first decrypted data, and all decrypted data with the target tag added are aggregated, and the obtained aggregated data is displayed for viewing by the operation and maintenance personnel.

[0068] Exemplarily, the pre-set aggregation logic can be for aggregating data from the same AZ. In this case, after obtaining the first decrypted data, the first monitoring alarm toolkit can determine which AZ the first decrypted data comes from, use the identifier corresponding to the AZ as the target tag, add the target tag to the first decrypted data, and aggregate all decrypted data with the target tag added, thereby achieving aggregation of data from the same AZ.

[0069] In the above embodiment, the first monitoring alarm toolkit is also used to determine whether to add a target tag to the first decrypted data according to the pre-set aggregation logic; if the judgment result is yes, the target tag is added to the first decrypted data, and all decrypted data with the target tag added are aggregated. This enables the control plane to display and analyze monitoring data in a higher dimension. This method not only simplifies the data management process, but also improves the operability and visualization level of the monitoring system. In addition, the operation and maintenance personnel can more comprehensively understand and monitor the overall operation status of the system, so as to promptly discover potential problems and make optimization adjustments.

[0070] In some embodiments, see Figure 4 As shown, the control plane platform includes: a third security agent and a second monitoring alarm toolkit; the third security agent is used to decrypt the second encrypted data, obtain second decrypted data, and send the second decrypted data to the second monitoring alarm toolkit; the second monitoring alarm toolkit is used to perform data integration based on the second decrypted data.

[0071] Optionally, the first monitoring alert toolkit may be Prometheus.

[0072] Among them, the third security agent can be used to perform security authentication with the previous-hop hardware device (first gateway device). After the security authentication is passed, the third security agent receives the second encrypted data from the previous-hop hardware device, decrypts the second encrypted data based on the encryption key obtained in the security authentication process, obtains the second decrypted data, and sends the second decrypted data to the second monitoring alarm toolkit.

[0073] Optionally, the second monitoring alarm toolkit performs data integration based on the second decrypted data to obtain large-scale data, and displays the large-scale data for operation and maintenance personnel to view.

[0074] In the above embodiment, a third security agent is configured in the control plane platform. The third security agent can be used to perform security authentication with the previous hop hardware device and the next hop hardware device, thereby improving the stability and security of the system.

[0075] In some embodiments, the second monitoring alarm toolkit is further used to store the second decrypted data into a database to form historical monitoring data of the corresponding user device for future viewing and data statistics.

[0076] In some embodiments, see Figure 5 As shown, a distributed cloud monitoring system is provided, including a control plane platform, multiple first gateway devices and a data plane platform, the data plane platform includes multiple data centers, multiple first gateway devices correspond to multiple data centers one by one, each data center includes multiple user devices, second gateway devices corresponding to multiple user devices one by one, and control plane devices; each user device includes an application and a first security agent; the control plane device included in each data center includes: a second security agent and a first monitoring alarm toolkit; the control plane platform includes: a third security agent and a second monitoring alarm toolkit. The application is used to collect monitoring data and report the monitoring data to the first security agent; the first security agent is used to perform security authentication with the corresponding second gateway device, and after the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device. The second gateway device is used to perform security authentication with the second security agent in the target control plane device included in the data center to which it belongs. After the security authentication is passed, the first encrypted data is sent to the second security agent. The second security agent is used to decrypt the first encrypted data to obtain the first decrypted data, and send the first decrypted data to the first monitoring alarm toolkit; the first monitoring alarm toolkit is used to filter the first decrypted data according to the pre-set indicator filtering rules to obtain the data to be transmitted, and return the data to be transmitted to the second security agent. The second security agent performs security authentication with the first target gateway device corresponding to the data center to which it belongs. After the security authentication is passed, the data to be transmitted is encrypted and the obtained second encrypted data is sent to the first target gateway device; the first target gateway device is used to perform security authentication with the third security agent in the control plane platform. After the security authentication is passed, the second encrypted data is sent to the third security agent. The third security agent is used to decrypt the second encrypted data to obtain the second decrypted data, and send the second decrypted data to the second monitoring alarm toolkit; the second monitoring alarm toolkit is used to perform data integration based on the second decrypted data.

[0077] In some embodiments, see Figure 6 As shown, a data monitoring method is provided, which is applied to a user device, wherein the user device includes an application and a first security agent; the method includes:

[0078] Step 601: The application collects monitoring data and reports the monitoring data to the first security agent.

[0079] The monitoring data may include application online status, application usage of the central processing unit (CPU), application usage of memory, and the like.

[0080] Step 602: The first security agent performs security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device.

[0081] Among them, after the second gateway device receives the first encrypted data, it performs security authentication with the target control plane device included in the data center to which it belongs, and after the security authentication is passed, the first encrypted data is sent to the target control plane device; after the target control plane device receives the first encrypted data, it decrypts the first encrypted data to obtain the first decrypted data, and filters the first decrypted data to obtain the data to be transmitted; the first target gateway device corresponding to the data center performs security authentication, and after the security authentication is passed, it encrypts the data to be transmitted, and sends the obtained second encrypted data to the first target gateway device. After the first target gateway device receives the second encrypted data, it performs security authentication with the control plane platform, and after the security authentication is passed, it sends the second encrypted data to the control plane platform; after the control plane platform receives the second encrypted data, it decrypts the second encrypted data to obtain the second decrypted data, and performs data integration based on the second decrypted data. Please refer to the aforementioned embodiment for the detailed process, which will not be repeated here.

[0082] In the above data monitoring method, no matter from the sender or receiver's perspective, the attacker can only see the encrypted data and cannot obtain the plaintext data unless he can obtain the encryption key. In addition, on the control plane, the attacker must pass strict identity authentication to access the corresponding data. This mechanism not only ensures the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensuring the credibility and protection capabilities of network communications.

[0083] In some embodiments, see Figure 7 As shown, a data monitoring method is provided, which is applied to a control plane device, wherein the control plane device includes a second security agent and a first monitoring alarm toolkit; the method includes:

[0084] Step 701: The second security agent decrypts the first encrypted data from the second gateway device to obtain first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit.

[0085] Step 702: The first monitoring alarm toolkit filters the first decrypted data according to a preset index filtering rule to obtain data to be transmitted.

[0086] Step 703: The second security agent performs security authentication with the first target gateway device corresponding to the data center to which it belongs. After the security authentication is passed, the data to be transmitted is encrypted and the obtained second encrypted data is sent to the first target gateway device.

[0087] After receiving the second encrypted data, the first target gateway device performs security authentication with the control plane platform, and after passing the security authentication, sends the second encrypted data to the control plane platform; after receiving the second encrypted data, the control plane platform decrypts the second encrypted data to obtain the second decrypted data, and performs data integration based on the second decrypted data. The detailed process is referred to the aforementioned embodiment, which will not be repeated here.

[0088] In the above data monitoring method, no matter from the sender or receiver's perspective, the attacker can only see the encrypted data and cannot obtain the plaintext data unless he can obtain the encryption key. In addition, on the control plane, the attacker must pass strict identity authentication to access the corresponding data. This mechanism not only ensures the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensuring the credibility and protection capabilities of network communications.

[0089] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0090] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, Figure 6 or Figure 7 Data monitoring method shown.

[0091] In one embodiment, a computer-readable storage medium is provided on which a computer program is stored. When the computer program is executed by a processor, Figure 6 or Figure 7 Data monitoring method shown.

[0092] In one embodiment, a computer program product is provided, comprising a computer program, which when executed by a processor implements Figure 6 or Figure 7 Data monitoring method shown.

[0093] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0094] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0095] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A distributed cloud monitoring system, characterized in that: It includes a control plane platform, a plurality of first gateway devices and a data plane platform, wherein the data plane platform includes a plurality of data centers, the plurality of first gateway devices correspond to the plurality of data centers one by one, and each data center includes a plurality of user devices, a second gateway device corresponding to the plurality of user devices one by one, and a control plane device; in; After the user device collects the monitoring data, it performs security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted and the obtained first encrypted data is sent to the corresponding second gateway device; The second gateway device is used to perform security authentication with a target control plane device included in the data center to which it belongs, and after the security authentication is passed, send the first encrypted data to the target control plane device; The target control plane device is used to decrypt the first encrypted data to obtain first decrypted data, and filter the first decrypted data to obtain data to be transmitted; Perform security authentication on a first target gateway device corresponding to the data center, encrypt the data to be transmitted after the security authentication is passed, and send the obtained second encrypted data to the first target gateway device; The first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is passed, send the second encrypted data to the control plane platform; The control plane platform is used to decrypt the second encrypted data to obtain second decrypted data, and perform data integration based on the second decrypted data.

2. The system according to claim 1, characterized in that Each user device includes an application and a first security agent; The application is used to collect monitoring data and report the monitoring data to the first security agent; The first security agent is used to perform security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device.

3. The system according to claim 1, characterized in that The control plane equipment contained in each data center includes: a second security agent and a first monitoring alarm toolkit; The second security agent is used to decrypt the first encrypted data to obtain first decrypted data, and send the first decrypted data to the first monitoring alarm toolkit; The first monitoring alarm toolkit is used to filter the first decrypted data according to a preset index filtering rule to obtain the data to be transmitted.

4. The system according to claim 3, characterized in that The first monitoring alarm toolkit is further used to determine whether to add a target tag to the first decrypted data according to a preset aggregation logic; If the judgment result is yes, a target tag is added to the first decrypted data, and aggregation processing is performed on all decrypted data added with the target tag.

5. The system according to claim 1, characterized in that The control plane platform includes: a third security agent and a second monitoring alarm toolkit; The third security agent is used to decrypt the second encrypted data to obtain second decrypted data, and send the second decrypted data to the second monitoring alarm toolkit; The second monitoring alarm toolkit is used for performing data integration based on the second decrypted data.

6. The system according to claim 5, characterized in that The second monitoring alarm toolkit is further used to store the second decrypted data in a database.

7. A data monitoring method, characterized in that: Applied to a user device, the user device includes an application and a first security agent; the method includes: The application collects monitoring data and reports the monitoring data to the first security agent; The first security agent performs security authentication with the corresponding second gateway device, and after the security authentication is passed, encrypts the monitoring data based on the encryption key obtained in the security authentication process, and sends the obtained first encrypted data to the corresponding second gateway device to instruct the second gateway device to perform security authentication with the target control plane device included in the data center to which it belongs, and after the security authentication is passed, sends the first encrypted data to the target control plane device; instructing the target control plane device to decrypt the first encrypted data to obtain first decrypted data, and filtering the first decrypted data to obtain data to be transmitted; Perform security authentication on a first target gateway device corresponding to the data center, encrypt the data to be transmitted after the security authentication is passed, and send the obtained second encrypted data to the first target gateway device; To instruct the first target gateway device to perform security authentication with the control plane platform, and after the security authentication is passed, send the second encrypted data to the control plane platform; to instruct the control plane platform to decrypt the second encrypted data to obtain second decrypted data, and perform data integration based on the second decrypted data.

8. A data monitoring method, characterized in that: Applied to a control plane device, the control plane device comprising a second security agent and a first monitoring alarm toolkit; in; The second security agent decrypts the first encrypted data from the second gateway device to obtain first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit; The first monitoring alarm toolkit filters the first decrypted data according to a preset index filtering rule to obtain data to be transmitted; The second security agent performs security authentication with the first target gateway device corresponding to the data center to which it belongs, and after the security authentication is passed, encrypts the data to be transmitted, and sends the obtained second encrypted data to the first target gateway device; to instruct the first target gateway device to perform security authentication with the control plane platform, and after the security authentication passes, send the second encrypted data to the control plane platform; The control plane platform is instructed to decrypt the second encrypted data to obtain second decrypted data, and perform data integration based on the second decrypted data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to claim 7 or 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claim 7 or 8 are implemented.

Images