Method and product for automatic discovery and access of cluster nodes

Abstract

The application discloses a kind of cluster node automatic discovery and access method and product, for the existing centralized cluster discovery target equipment is limited to the same broadcast domain, and cannot judge the problem of target equipment authenticity.New node is discovered by mDNS mechanism, if new node is discovered by management node, the management node directly obtains the TXT content in the DNS information published by new node, extracts the special additional content in TXT and carries out verification, if it passes, further extract the specific content item of the special additional content, construct rechecking data, request the related service of new node by service IP and port information, to complete the rechecking of new node;If it passes, according to the node access function provided by new node and new node normal interaction, complete the access of new node;By the method provided in the application, the target equipment of centralized cluster discovery is no longer limited to the same broadcast domain, and the accuracy of node identification is ensured by double-checking mechanism.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a cluster node access method. Background Art

[0002] Currently, in centralized cluster deployments, new nodes must first register with a central management node or have specific reporting parameters, such as the central node's IP address, pre-populated in the new node. This requires some manual effort each time a new node joins. mDNS (Multicast DNS) allows devices to find services on other devices on a network via broadcast or multicast, without relying on traditional centralized DNS servers. mDNS is used not only for simple device discovery but also for dynamic discovery of devices providing specific services. Using the mDNS protocol and a mechanism for discovering specific service providers allows for target device discovery, but this requires the devices to be in the same broadcast domain and cannot verify the authenticity of the target device. Summary of the Invention

[0003] The present application provides a method and product for automatic discovery and access of cluster nodes, aiming to solve the problem in the prior art that the target devices discovered by centralized clusters are limited to the same broadcast domain and the authenticity of the target devices cannot be determined.

[0004] In one aspect, a method for automatically discovering and accessing cluster nodes is provided. The cluster nodes are divided into management nodes and ordinary nodes. Service information published by a new node via the mDNS protocol can be received by at least one node in the cluster. The IP address published by the new node can be accessed by the management node in the cluster. The new node and the cluster nodes use the same pre-configured mDNS protocol, including:

[0005] Cluster nodes discover new nodes through the mDNS mechanism;

[0006] If the new node is found to be a management node, the management node directly obtains the TXT content in the DNS information published by the new node, extracts the special additional content in the TXT and verifies it. The special additional content is in ciphertext form and has a unique ciphertext format. The verification includes confirming the existence of the special additional content, performing preliminary decryption on the special additional content, and verifying the format of the data after preliminary decryption. If the special additional content does not exist, the node is abandoned and calibrated.

[0007] If the verification fails, the node is abandoned and calibrated. If the verification passes, the specific content items of the special additional content are further extracted, re-verification data is constructed, and the relevant services of the new node are requested through the service IP and port information published by the new node to complete the re-verification of the new node.

[0008] If the re-inspection fails, the node is abandoned and calibrated. If the re-inspection passes, the management node interacts normally with the new node according to the node access function provided by the business module of the new node to complete the access of the new node.

[0009] If the new node is found to be a normal node, the acquired information will be reported to the management node, which will then perform verification, re-verification, and access operations.

[0010] In the above solution, optionally, the method further includes: if the new node is found to be a common node, the common node extracts the TXT content in the information published by the new node and performs an initial verification on the new node according to the verification method;

[0011] If the initial check fails, it means that the new node is non-compliant and does not meet the access conditions. The ordinary node will store and mark the currently received information. After that, the ordinary node will re-collect the DNS information published by the new node through active query or passive reception.

[0012] If the initial inspection is passed, the ordinary node will report all the service information that has passed the initial inspection to the management node; the management node extracts the service information reported by the ordinary node and performs verification, re-inspection and access operations.

[0013] In the above scheme, further optionally, the DNS information is published by the business module, and the specific service information in the DNS information includes PTR, SRV, TXT and A information, wherein the special additional content in TXT is provided by the business module in ciphertext form, and the key and certificate used by the business module in the new node are obtained by applying after submitting their own unique characteristics, and are stored in this node for use, and cannot be used by any node other than this node.

[0014] The above solution may optionally further include: the new node needs to be connected to the network in advance and have its IP configured, and the service module and mDNS service package of the node need to be installed and started normally.

[0015] In the above scheme, optionally, in order to ensure that the source of the published service information matches the actual node, the special data used by the node that publishes the service information in TXT comes from its business module. The special data is the value of the special additional content. When re-verifying, the management node uses the special data to re-verify with the business module of the actual node.

[0016] In the above solution, optionally, the communication between the cluster nodes uses a secure communication mechanism, and the data during the transmission process are all encrypted.

[0017] In the above solution, optionally, the identification of the new node is determined by a specific service obtained or queried by mDNS.

[0018] In the above solution, optionally, the new node and the cluster node use the same set of mDNS protocol publishing service power supply software to keep the new node consistent with the cluster node. The specific service names published by the new node and the cluster node through the mDNS protocol publishing service function software are uniformly specified to identify the cluster node.

[0019] In the above scheme, optionally, the information used for initial inspection, verification and re-inspection is generated by the business module, and the process of initial inspection, verification and re-inspection is also implemented by the business module, and ciphertext and encrypted transmission are used in the initial inspection, verification and re-inspection process.

[0020] In a second aspect, a computer program product comprises a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0021] Compared with the prior art, this application has at least the following beneficial effects:

[0022] Based on further analysis and research of existing technical issues, this application recognizes that existing centralized clusters are limited to the same broadcast domain when discovering target devices and cannot verify the authenticity of target devices. This application uses the mDNS mechanism, TXT special additional content, and business module verification to ensure that new nodes can be safely and reliably connected to the cluster. The method provided by this application has the following advantages during cluster deployment or expansion:

[0023] (1) Automatic discovery reduces manual configuration operations during access and saves labor costs.

[0024] (2) The automatic discovery mechanism eliminates the risk of manual access being missed when the number of accesses is large, and access is more efficient.

[0025] (3) The automated access method eliminates various problems caused by non-compliant manual operation processes through standardized access procedures, reducing the risk of access failure.

[0026] (4) The accuracy of node identification is ensured through a double verification mechanism of verification and re-verification.

[0027] (5) Strict key and certificate management mechanisms and encrypted communication mechanisms ensure the security of the entire process. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1A schematic diagram of a scenario in which a new cluster is deployed with one management node and one common node in the first embodiment of the present application.

[0029] Figure 2 A schematic diagram of a second embodiment of the present application shows a scenario in which a new node is added to an original cluster, and the new node and the original cluster management node are in the same broadcast domain.

[0030] Figure 3 A schematic diagram of a scenario in which a new node is added to an original cluster and the new node and the original cluster management node are not in the same broadcast domain is provided in the third embodiment of the present application.

[0031] Figure 4 A schematic diagram of the process of automatic discovery and access of new nodes in a scenario provided by one embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0033] In the description of the present application, unless otherwise specified, expressions such as “include”, “comprising”, “having”, etc. also mean “not limited to” (certain units, components, materials, steps, etc.).

[0034] Currently, in centralized cluster deployments, new nodes must first register with a central management node or have specific reporting parameters, such as the central node's IP address, pre-populated in the new node. This requires some manual effort each time a new node joins. mDNS (Multicast DNS) allows devices to find services on other devices on a network via broadcast or multicast, without relying on traditional centralized DNS servers. mDNS is used not only for simple device discovery but also for dynamic discovery of devices providing specific services.

[0035] Using the mDNS protocol and a mechanism to discover specific services can discover target devices, but this requires the devices to be in the same broadcast domain and cannot determine the authenticity of the target device.

[0036] The purpose of this application is to establish a method that can automatically identify the target device, distinguish its authenticity, and finally complete automatic access, so that the discovery and access of cluster nodes are fully automated.

[0037] In one embodiment, reference Figure 4This provides an automatic discovery and access method for cluster nodes, which are divided into management nodes and ordinary nodes. Service information published by a new node using the mDNS protocol can be received by at least one node in the cluster. The IP address published by the new node can be accessed by the management node in the cluster. The new node and cluster nodes use the same pre-configured mDNS protocol, including:

[0038] Cluster nodes discover new nodes through the mDNS mechanism;

[0039] If the new node is a management node, the management node directly obtains the TXT content in the DNS information published by the new node, extracts the special additional content in the TXT and verifies it. The special additional content is in ciphertext form and has a unique format. The verification includes confirming the existence of the special additional content, performing preliminary decryption on the special additional content, and verifying the data format after preliminary decryption. If the special additional content does not exist, the node is abandoned and calibrated.

[0040] If the verification fails, the node will be abandoned and calibrated. If the verification passes, the specific content items of the special additional content will be further extracted, and re-verification data will be constructed. The relevant services of the new node will be requested through the service IP and port information published by the new node to complete the re-verification of the new node.

[0041] If the re-inspection fails, the node is abandoned and calibrated. If the re-inspection passes, the management node interacts with the new node normally according to the node access function provided by the new node's business module to complete the access of the new node.

[0042] If the new node is found to be a normal node, the acquired information will be reported to the management node, which will then perform verification, re-verification, and access operations.

[0043] In this embodiment, the present application provides a method for automatic discovery and access of cluster nodes, which is suitable for new deployment and node expansion scenarios of centralized clusters. The main steps of this method include: the node accesses the network and configures the IP, and the business package and mDNS service package of the deployment node are installed and started normally; the cluster node discovers the newly connected node through the mDNS mechanism. If the new node is found to be a management node, the special additional content in the TXT of the DNS information published by the new node is directly obtained for verification. After the basic verification is passed, the content decrypted from the special additional content is used to re-verify with the newly connected node. After the verification is passed, the node access process is automatically followed for access. If any of the above steps fails to verify, the device will be abandoned and calibrated. If the new node is identified as a non-management node, the obtained information will be reported to the management node, and the management node will perform the verification and access operations.

[0044] In one embodiment, if the new node is found to be a common node, the common node extracts the TXT content in the information published by the new node and performs an initial verification on the new node according to the verification method;

[0045] If the initial check fails, it means that the new node is non-compliant and does not meet the access conditions. The ordinary node will store and mark the currently received information. After that, the ordinary node will re-collect the DNS information published by the new node through active query or passive reception.

[0046] If the initial inspection is passed, the ordinary node will report all the service information that has passed the initial inspection to the management node; the management node extracts the service information reported by the ordinary node and performs verification, re-inspection and access operations.

[0047] In one embodiment, to prevent impersonation through specific service names, special additional content is added to the TXT file. This content is in ciphertext format and has a unique format, which is verified during the basic verification phase. DNS information is published by the service module, and the specific service information in the DNS information includes PTR, SRV, TXT, and A information. The special additional content in the TXT file is provided by the service module in ciphertext. The key and certificate used by the service module in the new node are obtained by submitting their own unique characteristics and are stored in the node for use. Any node other than the node cannot use it.

[0048] In one embodiment, to ensure that the source matches the actual node, the special data used by the node publishing the service in TXT comes from its local business service. During re-verification, the management node uses this data to re-verify the business service of the actual node, further preventing impersonation.

[0049] In this embodiment, in order to ensure that the source of the published service information matches the actual node, the special data used by the node that publishes the service information in TXT comes from its business module. The special data is the value of the special additional content. When re-verifying, the management node uses the special data to re-verify with the business module of the actual node.

[0050] In one embodiment, the dedicated additional content provider is a business module, and the content is provided in encrypted form.

[0051] In one embodiment, communication between cluster nodes uses a secure communication mechanism, and all data in the transmission process are encrypted.

[0052] In one embodiment, the keys and certificates used by the business modules in the node are obtained by applying for and submitting their own unique characteristics, and are stored in the node for use. Other nodes cannot use them, thus ensuring security.

[0053] To implement the solution of the above embodiment, it should also be required that: the service information published by the access node through the mDNS protocol can be received by at least one node in the original cluster. The service IP address published by the access node can be accessed by the cluster management node.

[0054] This software provides a unified mDNS protocol publishing service, consistent across all nodes. The specific service names published by nodes using this software are uniformly assigned and used to identify cluster nodes. The TXT file containing the specific service information published by nodes is provided by the business module and used for pre-connection verification. New nodes and cluster nodes use the same mDNS protocol publishing service software, ensuring consistency across all nodes. The specific service names published by new and cluster nodes using this mDNS protocol publishing service software are uniformly assigned and used to identify cluster nodes.

[0055] New nodes are identified through specific services retrieved or queried by mDNS. Verification and access of new nodes utilizes a mechanism for generating and verifying access verification information. The verification information source and verification are implemented by the business module, and transmission is encrypted and secure, ensuring security and reliability.

[0056] Example 1

[0057] refer to Figure 1 , take the deployment of a management node M and a common node S in a new cluster as an example:

[0058] (1) M is deployed and connected to the network normally, the mDNS service is enabled, and it periodically detects whether there are nodes in the broadcast domain that publish specific services.

[0059] (2) S is deployed and connected to the network normally, the mDNS service is enabled and specific services are published.

[0060] (3) M node collects the specific service information (including PTR, SRV, TXT, A, etc.) published by S through active query or passive reception.

[0061] (4) Node M extracts the TXT content in the information released by S and performs an initial check, including the presence of special additional content, and basic information verification such as preliminary decryption and decrypted data format; if the check passes, step (5) is executed; otherwise, it means that node S is not compliant and does not meet the access conditions. Node M stores the currently received information, marks it, and returns to step (1).

[0062] (5) Node M further extracts the specific content items of the special additional content, constructs the re-verification data, and then requests S's related services (this process uses encrypted transmission) for re-verification through the service IP, port, and other information published by S; if the re-verification is successful, step (6) is executed; otherwise, it means that the service information published by node S is fake or incorrect, and returns to step (1).

[0063] (6) The M node interacts with the S node normally according to the node access function provided by the service to complete the node access.

[0064] Example 2

[0065] refer to Figure 2 , for example, add a new node to the original cluster, and the new node and the original cluster management node are in the same broadcast domain:

[0066] The original cluster node management node M and ordinary node S are set, and a new node S1 is added, where S1 and M are in the same broadcast domain. The access steps of the new node S1 are exactly the same as the access steps of the ordinary node S in Example 1.

[0067] Example 3

[0068] refer to Figure 3 For example, a new node is added to the original cluster, and the new node is not in the same broadcast domain as the original cluster management node:

[0069] Set up the original cluster node management node M and ordinary node S, and add a new node S1, where S1 and S are in the same broadcast domain. The steps for S1 access are as follows:

[0070] (1) S1 is deployed and connected to the network normally, the mDNS service is enabled, and specific services are published.

[0071] (2) The S node collects the specific service information (including PTR, SRV, TXT, A, etc.) published by S1 through active query or passive reception.

[0072] (3) The S node extracts the TXT content in the information released by S1 and performs an initial check, including the presence of special additional content, and basic information verification such as preliminary decryption and decrypted data format; if the check passes, step (4) is executed; otherwise, it means that the S1 node is not compliant and does not meet the access conditions. The S node stores the currently received information, marks it, and returns to step (2).

[0073] (4) The S node reports all service information that has passed the initial inspection to the M node.

[0074] (5) Node M extracts the service information reported by S, extracts the special additional content in the TXT information, verifies it according to the initial verification method (if the verification fails here, M will make a record and end the current process), and further extracts the specific content items of the special additional content. After constructing the re-verification data, it requests the relevant services of S1 through the service IP, port and other information provided in the service information reported by S (this process uses encrypted transmission method) for re-verification; if the re-verification is successful, execute step (6), otherwise it means that the service information released by node S is impersonated or incorrect, and end the current process.

[0075] (6) Node M interacts with S1 normally according to the node access function provided by the service to complete the node access.

[0076] In one embodiment, a computer program product is also provided, including a computer program / instruction, which implements the steps of the above-mentioned embodiment method when executed by a processor.

[0077] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A method for automatically discovering and accessing cluster nodes, wherein the cluster nodes are divided into management nodes and ordinary nodes; characterized in that: The service information published by the new node through the mDNS protocol can be received by at least one node in the cluster; the IP address published by the new node can be accessed by the management node in the cluster; The new node uses the same pre-configured mDNS protocol as the cluster nodes, including: Cluster nodes discover new nodes through the mDNS mechanism; If the new node is found to be a management node, the management node directly obtains the TXT content in the DNS information published by the new node, extracts the special additional content in the TXT and verifies it. The special additional content is in ciphertext form and has a unique ciphertext format. The verification includes confirming the existence of the special additional content, performing preliminary decryption on the special additional content, and verifying the format of the data after preliminary decryption. If the special additional content does not exist, the node is abandoned and calibrated. If the verification fails, the node is abandoned and calibrated. If the verification passes, the specific content items of the special additional content are further extracted, re-verification data is constructed, and the relevant services of the new node are requested through the service IP and port information published by the new node to complete the re-verification of the new node. If the re-inspection fails, the node is abandoned and calibrated. If the re-inspection passes, the management node interacts normally with the new node according to the node access function provided by the business module of the new node to complete the access of the new node. If the new node is found to be a normal node, the acquired information will be reported to the management node, which will then perform verification, re-verification, and access operations.

2. The method for automatically discovering and accessing cluster nodes according to claim 1, wherein: Also includes: If the new node is found to be a common node, the common node extracts the TXT content in the information published by the new node and performs an initial verification on the new node according to the verification method described above; If the initial check fails, it means that the new node is non-compliant and does not meet the access conditions. The ordinary node will store and mark the currently received information. After that, the ordinary node will re-collect the DNS information published by the new node through active query or passive reception. If the initial inspection is passed, the common node will report all the service information that has passed the initial inspection to the management node; The management node extracts the service information reported by the ordinary nodes and performs verification, re-verification and access operations.

3. The method for automatically discovering and accessing cluster nodes according to claim 1 or 2, wherein: The DNS information is published by the business module. The specific service information in the DNS information includes PTR, SRV, TXT and A information. Among them, the special additional content in TXT is provided by the business module in ciphertext. The key and certificate used by the business module in the new node are obtained by applying after submitting their own unique characteristics, and are stored in this node for use. Any node other than this node cannot use it.

4. The method for automatically discovering and accessing cluster nodes according to claim 1, wherein: Also includes: The new node needs to be connected to the network and configured with an IP address in advance, and the business module and mDNS service package of the node must be installed and started normally.

5. The method for automatically discovering and accessing cluster nodes according to claim 1, wherein: To ensure that the source of published service information matches the actual node, the special data used by the node that publishes the service information in TXT comes from its business module. The special data is the value of the special additional content. When re-verifying, the management node uses the special data to re-verify with the business module of the actual node.

6. The method for automatically discovering and accessing cluster nodes according to claim 1, wherein: The communication between the cluster nodes uses a secure communication mechanism, and the data during transmission are all encrypted.

7. The method for automatically discovering and accessing cluster nodes according to claim 1 or 2, characterized in that: The identification of the new node is determined by the specific service obtained or queried by mDNS.

8. The method for automatically discovering and accessing cluster nodes according to claim 1, wherein: New nodes and cluster nodes use the same mDNS protocol publishing service supply software to ensure consistency between new nodes and cluster nodes. New nodes and cluster nodes use the same mDNS protocol publishing service function software to publish specific service names uniformly to identify cluster nodes.

9. The method for automatically discovering and accessing cluster nodes according to claim 2, wherein: The information used for initial inspection, verification and re-inspection is generated by the business module, and the process of initial inspection, verification and re-inspection is also implemented by the business module. Ciphertext and encrypted transmission are used during the initial inspection, verification and re-inspection process.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

Images