Opposite end node processing method and device, computer equipment and storage medium
By detecting the IP address of the peer node and performing identity authentication in the distributed database, the challenges of distributed database in terms of security and service quality are solved, and higher security and more stable service quality are achieved.
Patent Information
- Application Number
- CN202411940439.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-26
- Publication Date
- 2025-04-11
AI Technical Summary
Existing distributed databases have challenges in security and service quality, including data security, resource management, identity authentication, and anomaly detection.
By detecting whether the IP address of the newly connected peer node is on the blacklist, authentication is performed, and the request of the peer node is processed based on the authentication results, ensuring that only the authenticated node can interact with the target node.
It effectively improves the security and service quality of distributed databases, prevents unauthorized access and malicious behavior, reduces resource usage, and improves the stability and performance of the system.
Smart Images
Figure CN119814429A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of distributed databases, and in particular to a peer node processing method, device, computer equipment and computer-readable storage medium. Background Art
[0002] Currently, in modern information technology, distributed databases are becoming increasingly important due to their high availability, scalability, and fault tolerance. These distributed databases store data in multiple independent data storage nodes (DNs) and process and access data through computing nodes (CNs). In order to manage these nodes, distributed databases usually include one or more management nodes (MANAGERs), which are responsible for coordinating and monitoring the operations of the entire distributed database.
[0003] Currently, in distributed databases, CNs usually need to obtain DN information through MANAGERs to establish connections; however, unmanaged CNs (i.e., CNs that are not authenticated by MANAGERs) may illegally obtain DN information through eavesdropping and establish illegal connections with DNs, thereby performing unauthorized reading and tampering of data in DNs. At the same time, there are a large number of nodes in distributed databases, including computing management nodes (PMs) and storage management nodes (CMs), which communicate directly with MANAGERs. Although MANAGERs will verify the identities of these nodes, once malicious nodes establish connections with MANAGERs, they may continue to send requests, occupy MANAGER resources, and cause the service quality of distributed databases to decline. Therefore, existing distributed databases face the following challenges in terms of security and service quality:
[0004] 1. Data security: How to ensure that DN data is not unauthorizedly accessed and tampered by malicious CNs;
[0005] 2. Resource management: How to prevent malicious nodes from occupying MANAGER resources and affecting the service quality of the distributed database;
[0006] 3. Identity authentication: How to improve the identity authentication mechanism between CN and DN and the nodes communicating with MANAGER to prevent malicious behavior;
[0007] 4. Anomaly detection: How to effectively detect and respond to the behavior of malicious nodes to protect the stability and performance of distributed databases.
[0008] Based on this, how to provide a peer node processing method, device, computer equipment and computer-readable storage medium applied to a distributed database to effectively improve the security and service quality of the distributed database is a problem that urgently needs to be solved by technical personnel in this field. Summary of the invention
[0009] In view of the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a peer node processing method, apparatus, computer device and computer-readable storage medium, aiming to solve the problem of how to effectively improve the security and service quality of a distributed database.
[0010] In order to achieve the above object, the present invention adopts the following technical solutions:
[0011] In a first aspect, the present invention provides a peer node processing method, which is applied to a distributed database, wherein the method comprises:
[0012] When a new peer node is connected to any target node in the distributed database through a TCP link, detecting whether the IP address of the peer node is in the blacklist;
[0013] When the IP address of the peer node is not in the blacklist, identity authentication is performed on the peer node to generate an authentication result;
[0014] Based on the authentication result, the target request sent by the opposite node to the target node is processed.
[0015] In a second aspect, the present invention provides a peer node processing device, applied to a distributed database, wherein the device comprises:
[0016] A detection module, used for detecting whether the IP address of a new peer node is in a blacklist when the new peer node is connected to any target node in the distributed database through a TCP link;
[0017] An authentication module, configured to perform identity authentication on the peer node and generate an authentication result when the IP address of the peer node is not in the blacklist;
[0018] A processing module is used to process the target request sent by the opposite node to the target node based on the authentication result.
[0019] In a third aspect, the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-described method for processing a counterpart node when executing the computer program.
[0020] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the above-mentioned counterpart node processing method.
[0021] Compared with the prior art, the present invention provides a peer node processing method, device, computer equipment and computer-readable storage medium, which are applied to a distributed database, wherein when a new peer node is connected to any target node in the distributed database through a TCP link, it is detected whether the IP address of the peer node is in a blacklist; when the IP address of the peer node is not in the blacklist, the identity of the peer node is authenticated and an authentication result is generated; based on the authentication result, the target request sent by the peer node to the target node is processed; thereby, the present invention can effectively improve the security and service quality of the distributed database. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0023] Figure 1 A flowchart of a peer node processing method provided by an embodiment of the present invention.
[0024] Figure 2 A schematic diagram of a program module of a peer node processing device provided by an embodiment of the present invention.
[0025] Figure 3 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention.
[0026] Figure 4 Another structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0028] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.
[0029] It should also be understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
[0030] As used in the present specification and the appended claims, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.
[0031] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.
[0032] References to "one embodiment" or "some embodiments" etc. described in the specification of the present invention mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.
[0033] It should be understood that the order of execution of the steps in the following embodiments does not imply a precedence of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.
[0034] In order to illustrate the technical solution of the present invention, specific embodiments are provided below for illustration.
[0035] See also Figure 1 An embodiment of the present invention provides a peer node processing method, which is applied to a distributed database, wherein the method comprises the following steps:
[0036] S100, when a new peer node is connected to any target node in the distributed database through a TCP link, detecting whether the IP address of the peer node is in the blacklist;
[0037] S200, when the IP address of the peer node is not in the blacklist, performing identity authentication on the peer node and generating an authentication result;
[0038] S300, based on the authentication result, processing the target request sent by the opposite node to the target node;
[0039] The target nodes include computing nodes (CN), storage nodes (DN), computing management nodes (PM), storage management nodes (CM) and management nodes (MANAGER).
[0040] In specific implementation, this embodiment effectively improves the security and service quality of the distributed database by implementing multi-level security checks and identity authentication measures in the distributed database; first, in step S100, by detecting whether the IP address of the newly connected peer node is in the blacklist, it is possible to immediately block the access of known malicious or untrusted peer nodes, thereby reducing potential security threats; then, in step S200, the identity of the peer node not in the blacklist is authenticated to ensure that only the authenticated peer node can further interact with the target node, which enhances the access control of the distributed database and prevents unauthorized access; finally, in step S300, the request of the peer node is processed based on the authentication result, ensuring that the operations on the computing node (CN), storage node (DN), computing management node (PM), storage management node (CM) and management node (MANAGER) are authorized, thereby protecting the integrity and confidentiality of the data in the distributed database; the method of this embodiment not only avoids tampering and unauthorized access to data in the distributed database, but also improves the utilization efficiency and response speed of resources in the distributed database by reducing invalid and malicious request processing, thereby improving the service quality of the distributed database.
[0041] In the present invention, the functions of the computing node (CN), storage node (DN), computing management node (PM), storage management node (CM) and management node (MANAGER) in the distributed database are described as follows:
[0042] (1) Compute nodes (CNs) are responsible for parsing and optimizing SQL statements, sending and storing data to each DN, and reading data from the DN.
[0043] (2) Storage Node (DN), responsible for storing data;
[0044] (3) Computing management node (PM), responsible for managing CN and transparently transmitting MANAGER data to CN;
[0045] (4) Storage management node (CM), responsible for managing DN;
[0046] (5) Management node (MANAGER), which is responsible for the data of all nodes in the distributed database and provides other functions such as global transaction ID.
[0047] Furthermore, in one embodiment, the peer node processing method, wherein the step of detecting whether the IP address of the peer node is in a blacklist, further comprises:
[0048] When the IP address of the opposite node is in the blacklist, the TCP link is disconnected.
[0049] In specific implementation, this embodiment achieves rapid response and blocking of malicious or untrusted connections by immediately disconnecting the TCP link when it is detected that the IP address of the peer node is in the blacklist, thereby effectively preventing potential network attacks and unauthorized access and enhancing the overall security of the distributed database; this measure not only reduces the risk of the distributed database being affected by malicious behavior, but also reduces unnecessary consumption of distributed database resources by promptly terminating suspicious connections, thereby improving the efficiency and service quality of the distributed database in processing legitimate requests.
[0050] Furthermore, in one embodiment, the peer node processing method, wherein the processing of the target request sent by the peer node to the target node based on the authentication result includes:
[0051] When the authentication result is that the identity authentication of the opposite node is successful, a response is made to the target request sent by the opposite node to the target node.
[0052] Further, the peer node processing method, wherein when the authentication result is that the identity authentication of the peer node is successful, responding to the target request sent by the peer node to the target node includes:
[0053] When the authentication result is that the identity authentication of the peer node is successful, performing parameter verification on the target request sent by the peer node to the target node;
[0054] When the parameter verification result of the target request is normal, the target node is controlled to execute the target request.
[0055] Furthermore, the opposite node processing method, wherein when the parameter verification result of the target request is normal, controlling the target node to execute the target request includes:
[0056] When the parameter verification result of the target request is normal, determining whether the target node has the authority to execute the target request;
[0057] When the target node has the authority to execute the target request, the target node is controlled to execute the target request.
[0058] Furthermore, the peer node processing method, wherein the step of processing the target request sent by the peer node to the target node based on the authentication result, further comprises:
[0059] When the authentication result is that the identity authentication of the opposite node fails, the TCP link is disconnected, and the IP address of the opposite node is added to the blacklist.
[0060] In specific implementation, this embodiment ensures that only legal and secure target requests can be executed by performing detailed parameter verification and permission checks after the peer node identity authentication is successful. At the same time, the connection is disconnected and the IP address of the peer node is added to the blacklist when the authentication fails. Such a mechanism not only improves the security of the distributed database, prevents unauthorized access and potential data leakage, but also ensures the stability and service quality of the distributed database by precisely controlling the request execution of the peer node, thereby ensuring data security while maintaining the efficient operation of the distributed database.
[0061] The specific implementation process of the steps in this embodiment is roughly as follows:
[0062] 1. Identity authentication successful response:
[0063] Once the peer node's identity authentication is successful, the distributed database will enter the response phase; this means that the distributed database has confirmed the peer node's identity and considers it trustworthy and can interact further;
[0064] 2. Parameter verification of target request:
[0065] Before responding to the target request from the peer node, the distributed database will first verify the parameters in the target request; this step ensures the integrity and correctness of the target request and prevents possible injection attacks or other forms of malicious input;
[0066] For example, if the target request is to query a database, the distributed database will check whether the query statement conforms to the expected format, whether the parameters are within the allowed range, and whether it contains any potentially dangerous characters;
[0067] 3. Permission check:
[0068] After parameter verification, the distributed database will determine whether the target node (such as CN, DN, PM, CM or MANAGER) has the authority to execute the target request; this step is a key part of access control, ensuring that only authorized target nodes can perform specific operations;
[0069] The distributed database will check whether the target node has the required permissions to execute the target request based on the preset permission policy, such as role-based access control (RBAC);
[0070] 4. Execute the target request:
[0071] If the target node is authorized to execute the target request, the distributed database will control the target node to execute the target request; this may involve operations such as reading, writing, updating or deleting data;
[0072] For example, if the target request is to read data from a DN node, the distributed database will instruct the DN node to retrieve the corresponding data and send it back to the peer node;
[0073] Among them, if the target node is DN, it will respond normally to the request of the opposite node (CN); if the target node is PM or CM, it will obtain the opposite node (for PM, the opposite node is CN; for CM, the opposite node is DN) information from MANAGER. If the acquisition fails, no response data will be sent to the opposite node, but the TCP link will remain connected; if the target node is CN and MANAGER, it will respond normally to any request from the opposite node (for CN, the opposite node is the client, where the client refers to the device or process that actively communicates with CN and intends to access data through the distributed database, such as the mysql client program; for MANAGER, the opposite node is CM and PM).
[0074] 5. Identity authentication failure processing:
[0075] If the identity authentication of the peer node fails, the distributed database will take security measures and immediately disconnect the TCP link between the target node and the peer node to prevent unauthorized access;
[0076] At the same time, the distributed database adds the IP address of the peer node to the blacklist to prevent the IP address from attempting to connect again in the future, thereby enhancing the security of the distributed database.
[0077] Through the above process, the distributed database in this embodiment can ensure that only verified and authorized target nodes can perform operations, and can effectively defend against malicious or unauthorized access. This not only improves the security of data in the distributed database, but also maintains the stability and service quality of the distributed database.
[0078] It can be seen from the above method embodiments that the peer node processing method provided by the present invention is applied to a distributed database, which includes: when a new peer node is connected to any target node in the distributed database through a TCP link, detecting whether the IP address of the peer node is in the blacklist; when the IP address of the peer node is not in the blacklist, performing identity authentication on the peer node and generating an authentication result; based on the authentication result, processing the target request sent by the peer node to the target node; in this way, the method of the present invention can effectively improve the security and service quality of the distributed database.
[0079] Specifically, compared with the prior art, the beneficial effects of the method of the present invention are mainly reflected in the following aspects:
[0080] 1) Blacklist detection and identity authentication are performed on newly linked peer nodes in the distributed database, blocking the path for malicious peer nodes to attack target nodes in the distributed database;
[0081] 2) The malicious TCP link is disconnected in time, which alleviates the frequent requests sent by malicious peer nodes, thereby reducing the hidden dangers of node service quality in the distributed database.
[0082] It should be understood that, although the present application provides method operation steps as described in the embodiments or flowcharts, more or less operation steps may be included based on conventional or non-creative labor, and these operation steps are not necessarily performed in sequence according to the embodiment or flowchart. The order of steps listed in the embodiment or flowchart is only one way of executing the order of many steps, and does not represent the only execution order. It should be noted that there is not necessarily a certain order between the above steps. A person of ordinary skill in the art can understand from the description of the embodiment of the present invention that in different embodiments, the above steps may have different execution orders, that is, they may be executed in parallel, or they may be executed in exchange, etc. Moreover, at least a part of the steps in the embodiment or flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but may be executed in turn, alternately or synchronously with other steps or at least a part of the sub-steps or stages of other steps.
[0083] Based on the above method embodiment, please refer to Figure 2 Another embodiment of the present invention further provides a peer node processing device, which is applied to a distributed database, wherein the device comprises:
[0084] A detection module 11, configured to detect whether the IP address of a new peer node is in a blacklist when the new peer node is connected to any target node in the distributed database via a TCP link;
[0085] An authentication module 12, configured to perform identity authentication on the peer node and generate an authentication result when the IP address of the peer node is not in the blacklist;
[0086] A processing module 13, configured to process a target request sent by the peer node to the target node based on the authentication result;
[0087] The target nodes include computing nodes (CN), storage nodes (DN), computing management nodes (PM), storage management nodes (CM) and management nodes (MANAGER).
[0088] Furthermore, in one embodiment, the peer node processing device, wherein the detecting whether the IP address of the peer node is in a blacklist, further comprises:
[0089] When the IP address of the opposite node is in the blacklist, the TCP link is disconnected.
[0090] Furthermore, in one embodiment, the peer node processing device, wherein the processing of the target request sent by the peer node to the target node based on the authentication result includes:
[0091] When the authentication result is that the identity authentication of the opposite node is successful, a response is made to the target request sent by the opposite node to the target node.
[0092] Further, the peer node processing device, wherein when the authentication result is that the identity authentication of the peer node is successful, responding to the target request sent by the peer node to the target node includes:
[0093] When the authentication result is that the identity authentication of the peer node is successful, performing parameter verification on the target request sent by the peer node to the target node;
[0094] When the parameter verification result of the target request is normal, the target node is controlled to execute the target request.
[0095] Further, the peer node processing device, wherein when the parameter verification result of the target request is normal, controlling the target node to execute the target request includes:
[0096] When the parameter verification result of the target request is normal, determining whether the target node has the authority to execute the target request;
[0097] When the target node has the authority to execute the target request, the target node is controlled to execute the target request.
[0098] Further, the peer node processing device, wherein the processing of the target request sent by the peer node to the target node based on the authentication result, further includes:
[0099] When the authentication result is that the identity authentication of the opposite node fails, the TCP link is disconnected, and the IP address of the opposite node is added to the blacklist.
[0100] It should be noted that in the embodiment of the device of the present invention, the information interaction, execution process and other contents between the above-mentioned modules are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the aforementioned method embodiment part and will not be repeated here.
[0101] Based on the above method embodiment, another embodiment of the present invention further provides a computer device, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the functions or steps of the service end side of the opposite node processing method in any of the above method embodiments are implemented.
[0102] Based on the above method embodiment, another embodiment of the present invention further provides a computer device, which may be a client, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the functions or steps of the client side of the opposite node processing method in any of the above method embodiments are implemented.
[0103] Those skilled in the art will understand that Figure 3 and Figure 4 The structural schematic diagram shown in the figure is only a schematic diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0104] The processor may be a CPU, or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc.
[0105] Among them, the memory includes a readable storage medium, an internal memory, etc., wherein the internal memory can be the memory of a computer device, and the internal memory provides an environment for the operation of an operating system and computer-readable instructions in the readable storage medium. The readable storage medium can be a hard disk of a computer device, and in other embodiments, it can also be an external storage device of a computer device, for example, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on a computer device. Further, the memory can also include both an internal storage unit of a computer device and an external storage device. The memory is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of a computer program, etc. The memory can also be used to temporarily store data that has been output or is to be output.
[0106] Based on the above method embodiments, another embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the opposite end node processing method in any of the above method embodiments is implemented. The computer-readable storage medium may be non-volatile or volatile.
[0107] It should be noted that the above-mentioned functions or steps that can be implemented by the computer-readable storage medium or computer device, and the technical effects brought about by the functions / steps, can be found in the relevant descriptions in the aforementioned method embodiments. To avoid repetition, they will not be described one by one here.
[0108] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM). The disclosed memory components or memories of the operating environments described herein are intended to comprise one or more of these and / or any other suitable types of memory.
[0109] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, in the embodiment of the device of the present invention, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the above-mentioned method embodiment, which will not be repeated here. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
[0110] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0111] In the embodiments provided by the present invention, it should be understood that the disclosed devices / computer equipment and methods can be implemented in other ways. For example, the device / computer equipment embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0112] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0113] It should be noted that if software tools or components other than those of the Company appear in the embodiments of the present application, they are only used for illustration and do not represent actual use. The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the above embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents; and these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.
Claims
1. A peer node processing method, applied to a distributed database, characterized in that: The method comprises: When a new peer node is connected to any target node in the distributed database through a TCP link, detecting whether the IP address of the peer node is in the blacklist; When the IP address of the peer node is not in the blacklist, identity authentication is performed on the peer node to generate an authentication result; Based on the authentication result, the target request sent by the opposite node to the target node is processed.
2. The peer node processing method according to claim 1, characterized in that: The detecting whether the IP address of the peer node is in the blacklist further includes: When the IP address of the opposite node is in the blacklist, the TCP link is disconnected.
3. The peer node processing method according to claim 1, characterized in that: The processing, based on the authentication result, of the target request sent by the opposite node to the target node includes: When the authentication result is that the identity authentication of the opposite node is successful, a response is made to the target request sent by the opposite node to the target node.
4. The peer node processing method according to claim 3, characterized in that: When the authentication result is that the identity authentication of the peer node is successful, responding to the target request sent by the peer node to the target node includes: When the authentication result is that the identity authentication of the peer node is successful, performing parameter verification on the target request sent by the peer node to the target node; When the parameter verification result of the target request is normal, the target node is controlled to execute the target request.
5. The peer node processing method according to claim 4, characterized in that: When the parameter verification result of the target request is normal, controlling the target node to execute the target request includes: When the parameter verification result of the target request is normal, determining whether the target node has the authority to execute the target request; When the target node has the authority to execute the target request, the target node is controlled to execute the target request.
6. The peer node processing method according to claim 3, characterized in that: The processing, based on the authentication result, of the target request sent by the peer node to the target node further includes: When the authentication result is that the identity authentication of the opposite node fails, the TCP link is disconnected, and the IP address of the opposite node is added to the blacklist.
7. The peer node processing method according to any one of claims 1 to 6, characterized in that: The target nodes include computing nodes, storage nodes, computing management nodes, storage management nodes and management nodes.
8. A peer node processing device, applied to a distributed database, characterized in that: The device comprises: A detection module, used for detecting whether the IP address of a new peer node is in a blacklist when the new peer node is connected to any target node in the distributed database through a TCP link; An authentication module, configured to perform identity authentication on the peer node and generate an authentication result when the IP address of the peer node is not in the blacklist; A processing module is used to process the target request sent by the opposite node to the target node based on the authentication result.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the counterpart node processing method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the counterpart node processing method according to any one of claims 1 to 7 is implemented.