Distributed cloud monitoring system and data monitoring method

Abstract

The application relates to a distributed cloud monitoring system and a data monitoring method. The system comprises a control plane platform, a plurality of first gateway devices and a data plane platform. The data plane platform comprises a plurality of data centers. The plurality of first gateway devices and the plurality of data centers are in one-to-one correspondence. Each data center comprises a plurality of user devices, a second gateway device corresponding to the plurality of user devices in one-to-one correspondence and a control plane device. The data confidentiality and integrity are ensured. The stability and security of the system are significantly enhanced. The network communication credibility and protection capability are ensured. Zero-trust security is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a distributed cloud monitoring system and a data monitoring method. BACKGROUND

[0002] In the current era of digital transformation, enterprises are constantly seeking more efficient and flexible ways to develop, deploy and manage applications. Cloud-native technology has emerged in this context, with its containerization, microservices architecture, continuous delivery and dynamic orchestration, making it easier and faster to land services, and has become the core of modern software development and IT operations. In this framework, distributed cloud scenarios, with their significant advantages in managing clusters across multiple nodes and geographic locations, combine the advantages of containerization technology and the flexibility of cloud computing, providing strong support for enterprises to respond to complex and dynamic market demands, especially in large enterprise projects. In a distributed cloud scenario, deploying a monitoring system is a key step to ensure system performance, reliability and security.

[0003] However, there are many challenges in deploying monitoring infrastructure in a distributed cloud scenario, especially in terms of security. The large number of nodes in a distributed cloud scenario results in complex network links. These complexities make it easy for network attackers to forge, tamper with data through links, and then attack the monitoring system, causing loss to the enterprise. Therefore, ensuring the security of the monitoring infrastructure and preventing network attacks is a key challenge that must be addressed when deploying a distributed cloud monitoring system. SUMMARY

[0004] Therefore, it is necessary to provide a distributed cloud monitoring system and a data monitoring method that can prevent network attacks to solve the above technical problems.

[0005] In a first aspect, the present application provides a distributed cloud monitoring system, comprising a control plane platform, a plurality of first gateway devices and a data plane platform, the data plane platform comprising a plurality of data centers, the plurality of first gateway devices and the plurality of data centers corresponding one-to-one, each data center comprising a plurality of user devices, a second gateway device corresponding to the plurality of user devices one-to-one, and a control plane device; wherein;

[0006] The user device is configured to collect monitoring data, perform security authentication with the corresponding second gateway device, encrypt the monitoring data after the security authentication is passed, and send the obtained first encrypted data to the corresponding second gateway device;

[0007] The second gateway device is configured to perform security authentication with a target control plane device contained in the data center to which the second gateway device belongs, and send the first encrypted data to the target control plane device after the security authentication is passed;

[0008] The target control plane device is configured to decrypt the first encrypted data to obtain first decrypted data, filter the first decrypted data to obtain to-be-transmitted data, perform security authentication with a first target gateway device corresponding to the data center, and after the security authentication is passed, encrypt the to-be-transmitted data and send the obtained second encrypted data to the first target gateway device.

[0009] The first target gateway device is configured to perform security authentication with the control plane platform, and after the security authentication is passed, send the second encrypted data to the control plane platform.

[0010] The control plane platform is configured to decrypt the second encrypted data to obtain second decrypted data, and integrate data based on the second decrypted data.

[0011] In one of the embodiments, each user device comprises an application and a first security agent.

[0012] The application is configured to collect monitoring data and report the monitoring data to the first security agent.

[0013] The first security agent is configured to perform security authentication with a corresponding second gateway device, and after the security authentication is passed, encrypt the monitoring data based on an encryption key obtained in the security authentication process and send the obtained first encrypted data to the corresponding second gateway device.

[0014] In one of the embodiments, the control plane device comprised in each data center comprises a second security agent and a first monitoring and alarm tool package.

[0015] The second security agent is configured to decrypt the first encrypted data to obtain first decrypted data and send the first decrypted data to the first monitoring and alarm tool package.

[0016] The first monitoring and alarm tool package is configured to filter the first decrypted data according to a pre-set index filtering rule to obtain to-be-transmitted data.

[0017] In one of the embodiments, the first monitoring and alarm tool package is further configured to determine whether to add a target label to the first decrypted data according to a pre-set aggregation logic.

[0018] In a case where the determination result is yes, the target label is added to the first decrypted data, and all decrypted data added with the target label is aggregated.

[0019] In one of the embodiments, the control plane platform comprises a third security agent and a second monitoring and alarm tool package.

[0020] The third security agent is configured to decrypt the second encrypted data to obtain second decrypted data and send the second decrypted data to the second monitoring and alarm tool package.

[0021] The second monitoring and alert toolkit is used for data integration based on the second decrypted data.

[0022] In one embodiment, the second monitoring alert toolkit is also used to store the second decrypted data in a database.

[0023] Secondly, this application also provides a data monitoring method applied to a user equipment, the user equipment including an application and a first security agent; the method includes:

[0024] The application collects monitoring data and reports it to the first security agent;

[0025] The first security agent performs security authentication with the corresponding second gateway device. After successful authentication, it encrypts the monitoring data using the encryption key obtained during the authentication process and sends the first encrypted data to the corresponding second gateway device. This instructs the second gateway device to perform security authentication with the target control plane device within its data center. After successful authentication, it sends the first encrypted data to the target control plane device. This instructs the target control plane device to decrypt the first encrypted data, obtaining the first decrypted data. The first decrypted data is then filtered to obtain the data to be transmitted. The agent then performs security authentication with the first target gateway device corresponding to its data center. After successful authentication, it encrypts the data to be transmitted and sends the second encrypted data to the first target gateway device. This instructs the first target gateway device to perform security authentication with the control plane platform. After successful authentication, the second encrypted data is sent to the control plane platform. This instructs the control plane platform to decrypt the second encrypted data, obtaining the second decrypted data. Data integration is then performed based on the second decrypted data.

[0026] Thirdly, this application also provides a data monitoring method applied to a control plane device, the control plane device including a second security agent and a first monitoring and alarm toolkit; the method includes:

[0027] The second security agent decrypts the first encrypted data from the second gateway device to obtain the first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit;

[0028] The first monitoring and alarm toolkit filters out the first decrypted data according to the pre-set index filtering rules to obtain the data to be transmitted;

[0029] The second security agent performs security authentication with a first target gateway device corresponding to the data center to which the second security agent belongs, encrypts the data to be transmitted after the security authentication is passed, and sends the obtained second encrypted data to the first target gateway device; instructs the first target gateway device to perform security authentication with the control plane platform, and sends the second encrypted data to the control plane platform after the security authentication is passed; instructs the control plane platform to decrypt the second encrypted data to obtain second decrypted data, and integrates data based on the second decrypted data.

[0030] In a fourth aspect, the present application also provides a computer device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the data monitoring method provided in the second or third aspect when executing the computer program.

[0031] In a fifth aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the data monitoring method provided in the second or third aspect.

[0032] The distributed cloud monitoring system and the data monitoring method include a control plane platform, a plurality of first gateway devices, and a data plane platform. The data plane platform includes a plurality of data centers. The plurality of first gateway devices and the plurality of data centers are in one-to-one correspondence. Each data center includes a plurality of user devices, a second gateway device corresponding to the plurality of user devices in one-to-one correspondence, and a control plane device. The user device is configured to collect monitoring data, perform security authentication with the corresponding second gateway device, encrypt the monitoring data after the security authentication is passed, send the obtained first encrypted data to the corresponding second gateway device, perform security authentication with the target control plane device included in the data center, send the first encrypted data to the target control plane device after the security authentication is passed, decrypt the first encrypted data to obtain first decrypted data, perform filtering processing on the first decrypted data to obtain to-be-transmitted data, perform security authentication with the first target gateway device corresponding to the data center, encrypt the to-be-transmitted data after the security authentication is passed, send the obtained second encrypted data to the first target gateway device, perform security authentication with the control plane platform after the security authentication is passed, and send the second encrypted data to the control plane platform. The control plane platform is configured to decrypt the second encrypted data to obtain second decrypted data, and integrate data based on the second decrypted data. In the entire process, from the perspective of the sender or the receiver, the attacker can only see the encrypted data and cannot obtain the plaintext data unless the attacker can obtain the encryption key. In addition, on the control plane, the attacker must pass strict identity authentication to access the corresponding data. This mechanism not only guarantees the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensures the credibility and protection capability of the network communication, and realizes zero-trust security. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained without creative labor.

[0034] Figure 1 The architecture diagram of the distributed cloud monitoring system in an embodiment;

[0035] Figure 2 The architecture diagram of the distributed cloud monitoring system in another embodiment;

[0036] Figure 3 The architecture diagram of the distributed cloud monitoring system in another embodiment;

[0037] Figure 4 This is an architecture diagram of a distributed cloud monitoring system in yet another embodiment;

[0038] Figure 5 This is an architecture diagram of a distributed cloud monitoring system in yet another embodiment;

[0039] Figure 6 This is a flowchart illustrating a data monitoring method in one embodiment;

[0040] Figure 7 This is a flowchart illustrating a data monitoring method in another embodiment. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0042] In one exemplary embodiment, such as Figure 1 As shown, a distributed cloud monitoring system is provided, including a control plane platform, multiple first gateway devices, and a data plane platform. The data plane platform includes multiple data centers, with each first gateway device corresponding to one of the data centers. Each data center includes multiple user devices, a second gateway device corresponding to each user device, and control plane devices. The user devices collect monitoring data and then perform security authentication with the corresponding second gateway device. After successful authentication, the monitoring data is encrypted, and the resulting encrypted data is sent to the corresponding second gateway device. The second gateway device performs security authentication with the target control plane devices within its data center. Then, the first encrypted data is sent to the target control plane device; the target control plane device decrypts the first encrypted data to obtain the first decrypted data, filters the first decrypted data, and obtains the data to be transmitted; it performs security authentication with the first target gateway device corresponding to the data center, and after the security authentication is passed, it encrypts the data to be transmitted and sends the obtained second encrypted data to the first target gateway device; the first target gateway device performs security authentication with the control plane platform, and after the security authentication is passed, it sends the second encrypted data to the control plane platform; the control plane platform decrypts the second encrypted data to obtain the second decrypted data, and performs data integration based on the second decrypted data.

[0043] Optionally, the embodiments of the present application focus on possible attackers inside and outside the distributed cloud, including but not limited to infected nodes lurking in the data center and external network enemies who can access the control plane open public service ports. These attackers conduct surveillance by listening to messages in the public network channel to intercept or tamper with the monitoring data. This causes the control plane to misjudge, operate on application or node scaling, and cause serious damage to production activities.

[0044] It should be noted that: Figure 1 In the embodiment of the present application, only the data plane platform includes two data centers, and each data center contains two user devices. The number of data centers can be more, the number of user devices contained in the data center can be more, and the number of user devices contained in each data center can be different. Figure 1 This does not constitute a limitation on the embodiments of the present application. The data plane platform and the control plane device are used to display or decide the reported data.

[0045] Optionally, the monitoring data can be the online status of the application, the CPU occupancy of the application, the memory occupancy of the application, etc. The application here can be a pod in the open source container orchestration system Kubernetes.

[0046] In the embodiments of the present application, the premise that the system and network traffic inside the data center are trusted does not hold. In order to solve this problem, any terminal traffic beyond the host range is encrypted and authenticated. This approach effectively prevents security threats such as data eavesdropping, fake attacks, and replay attacks. By providing a zero-trust security solution, the overall security coefficient of the distributed cloud is greatly improved, thereby ensuring the security and reliability of the distributed cloud environment. Among them, for any user device in the data center, the monitoring data can be reported in the following way: after the user device collects the monitoring data, it performs security authentication with the corresponding second gateway device. For example, it can use the Transport Layer Security (TLS) protocol to perform security authentication with the corresponding second gateway device. After the security authentication is passed, the encryption key obtained in the security authentication process is used to encrypt the monitoring data to obtain first encrypted data, and the first encrypted data is sent to the corresponding second gateway device. This encryption approach can shrink the network attack surface to the endpoint node device, i.e. the security level of the application and the physical device. Figure 1

[0047] ​Optionally, TLS 1.3 can be used for security authentication with the corresponding second gateway device. Compared with TLS 1.2, the handshake process of TLS 1.3 reduces the number of round trips (usually only one round trip) and removes support for unsafe algorithms, simplifying the protocol and improving security and performance. The encryption key generated in the case of security authentication using TLS is a symmetric key.

[0048] In this case, since no third party can be trusted, the certificate used by TLS is not issued by a recognized CA, but is self-signed within the distributed cloud.

[0049] In this case, the second gateway device receives the first encrypted data, performs security authentication with the target control plane device included in the data center to which it belongs, and, for example, can use the encryption protocol (Transport Layer Security, TLS) to perform security authentication with the target control plane device included in the data center to which it belongs. After the security authentication is passed, the first encrypted data is sent to the target control plane device.

[0050] In this case, the target control plane device receives the first encrypted data, uses the encryption key obtained in the security authentication process to decrypt the first encrypted data, obtains the first decrypted data, and performs filtering processing on the first decrypted data according to the pre-set index filtering rule to obtain the to-be-transmitted data.

[0051] For example, the administrator of the data center can pre-configure the index filtering rule, which includes some monitoring indexes that are not useful. After the target control plane device decrypts the first decrypted data, it checks whether the first decrypted data includes data under these monitoring indexes. If so, the data is deleted, which can ensure that the control plane platform only receives relevant index data, thereby avoiding the transmission of irrelevant data and significantly reducing the link load.

[0052] Optionally, at the control plane device node, the administrator can choose to continue reporting data to a higher-level control plane or consume it here.

[0053] In this case, the target control plane device performs security authentication with the first target gateway device corresponding to the data center to which it belongs after obtaining the to-be-transmitted data, and, for example, can use the encryption protocol (Transport Layer Security, TLS) to perform security authentication with the first target gateway device corresponding to the data center to which it belongs. After the security authentication is passed, the to-be-transmitted data is encrypted using the encryption key obtained in the security authentication process to obtain second encrypted data, and the second encrypted data is sent to the first target gateway device.

[0054] The first target gateway device receives the second encrypted data, performs security authentication with the control plane platform, and can perform security authentication with the control plane platform by using an encryption protocol (Transport Layer Security, TLS) as an example. After the security authentication is passed, the second encrypted data is sent to the control plane platform. The control plane platform decrypts the second encrypted data by using the encryption key obtained in the security authentication process to obtain second decrypted data, and integrates data based on the second decrypted data. Thus, from point to surface, the monitoring data in each data center of the entire distributed cloud has been collected. In the entire process, all is encrypted traffic across each hardware device (endpoint), and unless the attacker can crack the TLS handshake process, all data is secure and trusted. In the overall control plane, the data reported by each data center can be further aggregated, and then the data is consumed through grafana or based on other strategies.

[0055] In the above embodiment, a distributed cloud monitoring system is provided, including a control plane platform, a plurality of first gateway devices and a data plane platform. The data plane platform includes a plurality of data centers, the plurality of first gateway devices and the plurality of data centers are one-to-one corresponding, each data center includes a plurality of user devices, a second gateway device corresponding to the plurality of user devices and a control plane device; wherein; the user device is used to collect monitoring data, and performs security authentication with the corresponding second gateway device. After the security authentication is passed, the monitoring data is encrypted, and the obtained first encrypted data is sent to the corresponding second gateway device; the second gateway device is used to perform security authentication with the target control plane device contained in the data center, and after the security authentication is passed, the first encrypted data is sent to the target control plane device; the target control plane device is used to decrypt the first encrypted data to obtain first decrypted data, and performs filtering processing on the first decrypted data to obtain to-be-transmitted data; the first target gateway device corresponding to the data center performs security authentication, and after the security authentication is passed, the to-be-transmitted data is encrypted, and the obtained second encrypted data is sent to the first target gateway device; the first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is passed, the second encrypted data is sent to the control plane platform; the control plane platform is used to decrypt the second encrypted data to obtain second decrypted data, and integrates data based on the second decrypted data. In the entire process, from the perspective of the sender or the receiver, the attacker can only see the encrypted data and cannot obtain the plaintext data unless the attacker can obtain the encryption key. In addition, on the control plane, the attacker must pass through strict identity authentication to access the corresponding data. This mechanism not only guarantees the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensures the trustworthiness and protection capability of network communication, and realizes zero-trust security.

[0056] In some embodiments, referring to Figure 2 As shown in the figure, each user equipment comprises an application and a first security agent; the application is configured to collect monitoring data and report the monitoring data to the first security agent; the first security agent is configured to perform security authentication with a corresponding second gateway device, and after the security authentication is passed, encrypt the monitoring data based on an encryption key obtained in the security authentication process, and send the obtained first encrypted data to the corresponding second gateway device.

[0057] Optionally, the application can be a pod in an open-source container orchestration system Kubernetes.

[0058] The application can detect its online status, CPU (Central Processing Unit) occupation, memory occupation, etc., as monitoring data, and report the monitoring data to the first security agent (security agent).

[0059] The first security agent (security agent) receives the monitoring data, performs security authentication with a corresponding second gateway device using an encryption protocol (Transport Layer Security, TLS), and after the security authentication is passed, encrypts the monitoring data based on an encryption key obtained in the security authentication process, and sends the obtained first encrypted data to the corresponding second gateway device.

[0060] In the above embodiments, the first security agent (security agent) is configured in the user equipment, which can be used for security authentication with the next-hop hardware device, and can improve the stability and security of the system.

[0061] In some embodiments, referring to Figure 3 As shown in the figure, the control plane device contained in each data center comprises a second security agent and a first monitoring and alarm toolkit; the second security agent is configured to decrypt the first encrypted data to obtain first decrypted data, and send the first decrypted data to the first monitoring and alarm toolkit; the first monitoring and alarm toolkit is configured to filter the first decrypted data according to a pre-set index filtering rule to obtain to-be-transmitted data.

[0062] The second security agent can be used for security authentication with the previous-hop hardware device (the second gateway device), and after the security authentication is passed, the second security agent receives first encrypted data from the previous-hop hardware device, decrypts the first encrypted data based on an encryption key obtained in the security authentication process, obtains first decrypted data, and sends the first decrypted data to the first monitoring and alarm tool package. Since the data is encrypted in the process of being transmitted from the first security agent to the second security agent, an attacker cannot eavesdrop on any monitoring data.

[0063] Optionally, the first monitoring and alarm tool package can also pull data reported by each user device to the second security agent for consumption by timing. The first monitoring and alarm tool package can be Prometheus, which supports encryption and decryption of data by a self-signed certificate. Therefore, the control node does not need to worry about an attacker reading monitoring data by exposing an interface.

[0064] Optionally, the pre-set index filtering rule includes a useless monitoring index configured by an administrator. The first monitoring and alarm tool checks whether the first decrypted data includes data under the monitoring index, and if so, deletes the data, thereby avoiding transmission of irrelevant data and significantly reducing link load.

[0065] In the above embodiments, the second security agent is configured in the control plane device, and the first security agent can be used for security authentication with the previous-hop hardware device and the next-hop hardware device, which can improve the stability and security of the system.

[0066] In some embodiments, the monitoring and alarm tool package is further configured to determine whether to add a target label to the first decrypted data according to a pre-set aggregation logic, and add the target label to the first decrypted data if the determination result is yes, and aggregate all decrypted data with the target label.

[0067] For example, the pre-set aggregation logic can be to aggregate all data with a certain characteristic. In this case, after obtaining the first decrypted data, the first monitoring and alarm tool package can determine whether the first decrypted data has the characteristic, and in the affirmative case, determine that the target label needs to be added to the first decrypted data. The target label is added to the first decrypted data, and all decrypted data with the target label is aggregated and displayed for viewing by an operation and maintenance personnel.

[0068] For example, the pre-set aggregation logic can be to aggregate data from the same AZ, in which case, after obtaining the first decrypted data, the first monitoring and alerting toolkit can determine from which AZ the first decrypted data comes from, take the identifier corresponding to the AZ as the target label, add the target label to the first decrypted data, and aggregate all decrypted data added with the target label, so as to realize the aggregation of data from the same AZ.

[0069] In the above embodiment, the first monitoring and alerting toolkit is further configured to determine whether to add a target label to the first decrypted data according to the pre-set aggregation logic, and add the target label to the first decrypted data if the determination result is yes, and aggregate all decrypted data added with the target label. This enables the control plane to display and analyze the monitoring data in higher dimensions. This method not only simplifies the data management process, but also improves the operability and visualization level of the monitoring system. Furthermore, the operation and maintenance personnel can more comprehensively understand and monitor the overall operation state of the system, so as to timely discover potential problems and make optimization adjustments.

[0070] In some embodiments, referring to Figure 4 The control plane platform includes a third security agent and a second monitoring and alerting toolkit. The third security agent is configured to decrypt the second encrypted data to obtain second decrypted data and send the second decrypted data to the second monitoring and alerting toolkit. The second monitoring and alerting toolkit is configured to integrate data based on the second decrypted data.

[0071] Optionally, the first monitoring and alerting toolkit can be Prometheus.

[0072] Optionally, the third security agent can be configured to perform security authentication with the previous-hop hardware device (the first gateway device), receive the second encrypted data from the previous-hop hardware device after the security authentication is passed, decrypt the second encrypted data based on the encryption key obtained in the security authentication process to obtain second decrypted data, and send the second decrypted data to the second monitoring and alerting toolkit.

[0073] Optionally, the second monitoring and alerting toolkit integrates data based on the second decrypted data to obtain big-picture data, and displays the big-picture data for the operation and maintenance personnel to view.

[0074] In the above embodiment, the third security agent (security agent) is configured in the control plane platform, which can be configured to perform security authentication with the previous-hop hardware device and the next-hop hardware device, thereby improving the stability and security of the system.

[0075] In some embodiments, the second monitoring alarm toolkit is also used to store the second decrypted data in a database to form historical monitoring data for the corresponding user device, for future viewing and data statistics.

[0076] In some embodiments, see Figure 5 As shown, a distributed cloud monitoring system is provided, including a control plane platform, multiple first gateway devices, and a data plane platform. The data plane platform includes multiple data centers, with each first gateway device corresponding to one of the data centers. Each data center includes multiple user devices, a corresponding second gateway device, and control plane devices. Each user device includes an application and a first security agent. The control plane devices in each data center include a second security agent and a first monitoring and alarm toolkit. The control plane platform includes a third security agent and a second monitoring and alarm toolkit. The application collects monitoring data and reports it to the first security agent. The first security agent performs security authentication with the corresponding second gateway device. After successful authentication, it encrypts the monitoring data using the encryption key obtained during the authentication process and sends the encrypted data to the corresponding second gateway device. The second gateway device performs security authentication with the second security agent in the target control plane device within its data center. After successful authentication, it sends the first encrypted data to the second security agent. The second security agent decrypts the first encrypted data to obtain the first decrypted data and sends it to the first monitoring and alarm toolkit. The first monitoring and alarm toolkit filters the first decrypted data according to pre-set indicator filtering rules to obtain the data to be transmitted and returns it to the second security agent. The second security agent performs security authentication with the first target gateway device corresponding to its data center. After successful authentication, it encrypts the data to be transmitted and sends the resulting second encrypted data to the first target gateway device. The first target gateway device performs security authentication with the third security agent in the control plane platform. After successful authentication, it sends the second encrypted data to the third security agent. The third security agent decrypts the second encrypted data to obtain the second decrypted data and sends it to the second monitoring and alarm toolkit. The second monitoring and alarm toolkit performs data integration based on the second decrypted data.

[0077] In some embodiments, see Figure 6 As shown, a data monitoring method is provided, applied to a user equipment, the user equipment including an application and a first security agent; the method includes:

[0078] Step 601: The application collects monitoring data and reports the monitoring data to the first security agent.

[0079] The monitoring data can include application online status, application CPU usage, and application memory usage.

[0080] Step 602: The first security agent performs security authentication with the corresponding second gateway device. After the security authentication is successful, the monitoring data is encrypted based on the encryption key obtained during the security authentication process, and the resulting first encrypted data is sent to the corresponding second gateway device.

[0081] In this process, after receiving the first encrypted data, the second gateway device performs security authentication with the target control plane device within its data center. Upon successful authentication, it sends the first encrypted data to the target control plane device. The target control plane device, upon receiving the first encrypted data, decrypts it to obtain first decrypted data, filters it, and obtains the data to be transmitted. It then performs security authentication with the first target gateway device corresponding to its data center. Upon successful authentication, it encrypts the data to be transmitted and sends the resulting second encrypted data to the first target gateway device. After receiving the second encrypted data, the first target gateway device performs security authentication with the control plane platform. Upon successful authentication, it sends the second encrypted data to the control plane platform. The control plane platform, upon receiving the second encrypted data, decrypts it to obtain second decrypted data and performs data integration based on this second decrypted data. For detailed procedures, please refer to the aforementioned embodiments, which will not be repeated here.

[0082] The aforementioned data monitoring method ensures that, from both the sender's and receiver's perspectives, attackers can only see encrypted data and cannot access plaintext data unless they obtain the encryption key. Furthermore, at the control plane, attackers must undergo strict authentication to access the relevant data. This mechanism not only guarantees the confidentiality and integrity of the data but also significantly enhances the system's stability and security, ensuring the trustworthiness and protective capabilities of network communications.

[0083] In some embodiments, see Figure 7 As shown, a data monitoring method is provided, applied to a control plane device, which includes a second security agent and a first monitoring and alarm toolkit; the method includes:

[0084] Step 701: The second security agent decrypts the first encrypted data from the second gateway device to obtain the first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit.

[0085] Step 702: The first monitoring and alarm toolkit filters out the first decrypted data according to the pre-set index filtering rules to obtain the data to be transmitted.

[0086] Step 703, the second security agent performs security authentication with the first target gateway device corresponding to the data center to which the second security agent belongs, and after the security authentication is passed, the second security agent encrypts the to-be-transmitted data and sends the obtained second encrypted data to the first target gateway device.

[0087] The first target gateway device receives the second encrypted data, performs security authentication with the control plane platform, and after the security authentication is passed, sends the second encrypted data to the control plane platform; and the control plane platform receives the second encrypted data, decrypts the second encrypted data to obtain second decrypted data, and integrates data based on the second decrypted data. For details, refer to the foregoing embodiments, which will not be described here.

[0088] The above data monitoring method, from the perspective of the sender or the receiver, the attacker can only see the encrypted data and cannot obtain the plaintext data unless the attacker can obtain the encryption key. In addition, on the control plane, the attacker must pass strict identity authentication to access the corresponding data. This mechanism not only guarantees the confidentiality and integrity of the data, but also significantly enhances the stability and security of the system, ensuring the credibility and protection capability of network communication.

[0089] It should be understood that although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise stated herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0090] In an exemplary embodiment, a computer device is provided, comprising a memory and a processor, the memory stores a computer program, and the processor implements the data monitoring method shown in the above embodiments when executing the computer program. Figure 6 Or Figure 7 the data monitoring method shown.

[0091] In an embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the data monitoring method shown in the above embodiments. Figure 6 Or Figure 7 the data monitoring method shown.

[0092] In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the method of Figure 6 or Figure 7 the data monitoring method shown.

[0093] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiment methods. In the embodiments provided in the present application, any reference to memory, database or other medium can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0094] The technical features of the above embodiments can be combined in any way. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0095] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent of the present application. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A distributed cloud monitoring system, characterized in that, It includes a control plane platform, multiple first gateway devices, and a data plane platform. The data plane platform includes multiple data centers. The multiple first gateway devices and the multiple data centers correspond one-to-one. Each data center includes multiple user devices, a second gateway device corresponding one-to-one with the multiple user devices, and a control plane device. in; The user equipment is used to collect monitoring data, perform security authentication with the corresponding second gateway device, encrypt the monitoring data after the security authentication is passed, and send the obtained first encrypted data to the corresponding second gateway device. The second gateway device is used to perform security authentication with the target control plane device contained in its data center. After the security authentication is successful, the first encrypted data is sent to the target control plane device. The target control plane device is used to decrypt the first encrypted data to obtain the first decrypted data, and to filter out the first decrypted data to obtain the data to be transmitted. The system performs security authentication with the first target gateway device corresponding to the data center. After the security authentication is passed, the data to be transmitted is encrypted, and the resulting second encrypted data is sent to the first target gateway device. The first target gateway device is used to perform security authentication with the control plane platform, and after the security authentication is successful, it sends the second encrypted data to the control plane platform; The control plane platform is used to decrypt the second encrypted data to obtain the second decrypted data, and to integrate the data based on the second decrypted data.

2. The system according to claim 1, characterized in that, Each user device includes applications and a first security agent; The application is used to collect monitoring data and report the monitoring data to the first security agent; The first security agent is used to perform security authentication with the corresponding second gateway device. After the security authentication is successful, the monitoring data is encrypted based on the encryption key obtained in the security authentication process, and the obtained first encrypted data is sent to the corresponding second gateway device.

3. The system according to claim 1, characterized in that, Each data center contains control plane equipment including: a second security agent and a first monitoring and alerting toolkit; The second security agent is used to decrypt the first encrypted data to obtain the first decrypted data, and then send the first decrypted data to the first monitoring and alarm toolkit. The first monitoring and alarm toolkit is used to filter the first decrypted data according to the pre-set index filtering rules to obtain the data to be transmitted.

4. The system according to claim 3, characterized in that, The first monitoring and alarm toolkit is also used to determine whether to add a target tag to the first decrypted data according to a pre-set aggregation logic; If the determination result is yes, a target tag is added to the first decrypted data, and all decrypted data with the target tag added are aggregated.

5. The system according to claim 1, characterized in that, The control plane platform includes: a third security agent and a second monitoring and alarm toolkit; The third security agent is used to decrypt the second encrypted data to obtain the second decrypted data, and then send the second decrypted data to the second monitoring and alarm toolkit. The second monitoring and alert toolkit is used for data integration based on the second decrypted data.

6. The system according to claim 5, characterized in that, The second monitoring and alert toolkit is also used to store the second decrypted data in a database.

7. A data monitoring method, characterized in that, The method is applied to a user equipment, the user equipment including an application and a first security agent; the method includes: The application collects monitoring data and reports the monitoring data to the first security agent; The first security agent performs security authentication with the corresponding second gateway device. After the security authentication is successful, the monitoring data is encrypted based on the encryption key obtained in the security authentication process. The first encrypted data is sent to the corresponding second gateway device to instruct the second gateway device to perform security authentication with the target control plane device included in its data center. After the security authentication is successful, the first encrypted data is sent to the target control plane device. The target control plane device is instructed to decrypt the first encrypted data to obtain the first decrypted data, and then the first decrypted data is filtered to obtain the data to be transmitted. The system performs security authentication with the first target gateway device corresponding to the data center. After the security authentication is passed, the data to be transmitted is encrypted, and the resulting second encrypted data is sent to the first target gateway device. The system instructs the first target gateway device to perform security authentication with the control plane platform. After successful security authentication, the second encrypted data is sent to the control plane platform. The system then instructs the control plane platform to decrypt the second encrypted data to obtain the second decrypted data, and performs data integration based on the second decrypted data.

8. A data monitoring method, characterized in that, Applied to a control plane device, the control plane device including a second security agent and a first monitoring and alarm toolkit; in; The second security agent decrypts the first encrypted data from the second gateway device to obtain the first decrypted data, and sends the first decrypted data to the first monitoring alarm toolkit; The first monitoring and alarm toolkit filters out the first decrypted data according to the pre-set index filtering rules to obtain the data to be transmitted; The second security agent performs security authentication with the first target gateway device corresponding to its data center. After the security authentication is passed, the data to be transmitted is encrypted, and the obtained second encrypted data is sent to the first target gateway device. This instructs the first target gateway device to perform security authentication with the control plane platform. After successful security authentication, the second encrypted data is sent to the control plane platform. The control plane platform is instructed to decrypt the second encrypted data to obtain the second decrypted data, and then perform data integration based on the second decrypted data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method of claim 7 or 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method of claim 7 or 8.

Images