Distributed file system cluster access method and device, equipment and medium

Abstract

The invention provides a distributed file system cluster access method, device and equipment and a medium, which are applied to a database, and the database is used for accessing a plurality of distributed file system clusters authenticated by a plurality of sets of key distribution centers. The method comprises the following steps: opening a reading authority to a bill file and a configuration file of a key distribution center for a database user; creating a corresponding secure object for each distributed file system cluster in a database, and setting an access permission for each secure object; the database executes a statement for creating a secure object, and reads a bill file and a configuration file of a key distribution center; creating a data object of each distributed file system cluster in the database, and taking the secure object as an access parameter of the data object; and the data object accesses the distributed file system cluster based on the access parameters. The safe access of the database to different KDC authentication HDFS clusters is realized, and the data security is further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed file systems, and in particular, to a method, device, equipment and medium for accessing a distributed file system cluster. Background Art

[0002] Currently, in a big data processing environment, a database often needs to access data stored on HDFS (Hadoop Distributed File System). In traditional authentication methods, the same database can only access HDFS clusters that use the same KDC (Key Distribution Center) authentication at the same time.

[0003] However, when the same database needs to access multiple HDFS clusters that use different KDC authentications, traditional authentication methods often have conflicts and inconveniences. In addition, for secret objects that store sensitive authentication information, the lack of an effective permission control mechanism may also lead to the risk of data leakage. Therefore, how to effectively solve the conflict problem of the same database accessing multiple sets of KDC-authenticated storages and increase the permission control of secret objects has become a technical problem to be solved urgently in the current big data processing field. Summary of the Invention

[0004] In view of this, an object of the present invention is to provide a method, device, equipment and medium for accessing a distributed file system cluster, by creating and managing multiple secret objects and implementing permission control over them, so as to achieve the secure access of the database to HDFS clusters authenticated by different KDCs and further improve data security.

[0005] In a first aspect, an embodiment of the present invention provides a method for accessing a distributed file system cluster, which is applied to a database. The database is used to access multiple distributed file system clusters authenticated by multiple key distribution centers. The method includes: opening the read permission of the ticket file and configuration file of the key distribution center for database users; creating a corresponding secret object for each distributed file system cluster in the database and setting access permissions for each secret object; the database executes a statement to create a secret object, reads the ticket file and configuration file of the key distribution center; creates a data object for each distributed file system cluster in the database, and uses the secret object as an access parameter of the data object; and the data object accesses the distributed file system cluster based on the access parameter.

[0006] In an alternative embodiment of the present application, the parameters included in the above-mentioned secret object are used to characterize the name of the authentication ticket object, the storage key distribution center authentication data source address, the address where the storage key distribution center authentication ticket file is located, the configuration file information, the authentication validity time, and the unique name of the distributed file system user.

[0007] In an alternative embodiment of the present application, the step of setting access permissions for each secret object includes: setting access permissions for each secret object based on roles, user groups, or user identities.

[0008] In an alternative embodiment of the present application, the steps of the database executing the statement to create a secret object, reading the ticket file and configuration file of the key distribution center include: the database executing the statement to create a secret object, verifying according to the access permissions of each secret object; reading the ticket file and configuration file of the key distribution center, encrypting and compressing the ticket file and configuration file; storing the encrypted and compressed ticket file and configuration file in the metadata information of the database.

[0009] In an alternative embodiment of the present application, the above data object is used to be accessed and modified by a user who has the access permission of the secret object.

[0010] In an alternative embodiment of the present application, the steps of the above data object accessing the distributed file system cluster based on access parameters include: determining that the current user or process has the access permission of the secret object; determining the key distribution center authentication ticket file information in the metadata of the database based on the access parameters; pulling the key distribution center authentication ticket file information to a local specified directory and configuring it based on a preset authentication method; synchronizing the configuration information of the authentication method with the configuration information in the local system; performing security authentication on the distributed file system cluster based on the authentication method and accessing the distributed file system cluster.

[0011] In an alternative embodiment of the present application, the above authentication method includes: Kerberos authentication.

[0012] Second aspect, an access device for a distributed file system cluster provided by an embodiment of the present invention is applied to a database. The database is used to access multiple distributed file system clusters authenticated by multiple key distribution centers. The device includes: a ticket file and configuration file preparation module, configured to open the read permission of the ticket file and configuration file of the key distribution center for database users; a secret object creation and access permission setting module, configured to create a corresponding secret object for each distributed file system cluster in the database and set access permissions for each secret object; a creation statement execution and file processing module, configured to execute the statement for creating a secret object in the database and read the ticket file and configuration file of the key distribution center; a data object creation and access parameter configuration module, configured to create a data object of each distributed file system cluster in the database and use the secret object as the access parameter of the data object; a distributed file system cluster access module, configured to access the distributed file system cluster based on the access parameter by the data object.

[0013] Third aspect, an electronic device provided by an embodiment of the present invention includes a processor and a memory. The memory stores computer executable instructions that can be executed by the processor. The processor executes the computer executable instructions to implement the above-mentioned access method for a distributed file system cluster.

[0014] Fourth aspect, a computer-readable storage medium provided by an embodiment of the present invention stores computer executable instructions. When the computer executable instructions are called and executed by a processor, the computer executable instructions cause the processor to implement the above-mentioned access method for a distributed file system cluster.

[0015] The embodiments of the present invention bring the following beneficial effects: The embodiments of the present invention provide an access method, device, equipment, and medium for a distributed file system cluster, which open the read permission of the ticket file and configuration file of the key distribution center for database users; create a corresponding secret object for each distributed file system cluster in the database and set access permissions for each secret object; execute the statement for creating a secret object in the database and read the ticket file and configuration file of the key distribution center; create a data object of each distributed file system cluster in the database and use the secret object as the access parameter of the data object; access the distributed file system cluster based on the access parameter by the data object. In this way, by creating and managing multiple secret objects and implementing permission control over them, the database can securely access different HDFS clusters authenticated by KDC, and further improve data security.

[0016] Other features and advantages of the present disclosure will be set forth in the following description, or may be learned by inference or without doubt from the description, or may be learned by implementing the above technologies of the present disclosure.

[0017] To make the above objects, features, and advantages of the present disclosure more obvious and understandable, the following specifically enumerates preferred embodiments and, in conjunction with the accompanying drawings, provides a detailed description as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0019] Figure 1 It is a flowchart of a method for accessing a distributed file system cluster provided by an embodiment of the present invention; Figure 2 It is a schematic diagram of a method for accessing a distributed file system cluster provided by an embodiment of the present invention; Figure 3 It is a schematic structural diagram of an access device for a distributed file system cluster provided by an embodiment of the present invention; Figure 4 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

[0021] Currently, in a big data processing environment, a database often needs to access data stored on HDFS. However, when the same database needs to access multiple HDFS clusters using different KDC authentications, traditional authentication methods often have conflicts and inconveniences. In addition, for the secret object storing sensitive authentication information, the lack of an effective permission control mechanism may also lead to the risk of data leakage. Therefore, how to effectively solve the conflict problem of accessing multiple sets of KDC-authenticated storages by the same database and increase the permission control of the secret object has become a technical problem urgently to be solved in the current big data processing field.

[0022] Based on this, an access method, device, equipment, and medium for a distributed file system cluster provided by an embodiment of the present invention specifically relate to the technical field of the integration of a database and a distributed file system (such as HDFS), and provide a method and system for solving the authentication storage conflict of accessing multiple sets of KDC (Key Distribution Center) by the same database, and further improve data security by increasing the permission control of the secret object.

[0023] For the convenience of understanding this embodiment, first, a detailed introduction to an access method for a distributed file system cluster disclosed in an embodiment of the present invention is provided.

[0024] Embodiment 1: An embodiment of the present invention provides an access method for a distributed file system cluster, which is applied to a database. The database is used to access multiple distributed file system clusters authenticated by multiple key distribution centers. Refer to Figure 1 The flowchart of an access method for a distributed file system cluster shown. The access method for the distributed file system cluster includes the following steps: Step S102: Open the read permission for the ticket file and configuration file of the key distribution center to the database user.

[0025] In this embodiment, the preparation of the KDC ticket file and configuration file can be carried out first: for each HDFS cluster to be accessed, an independent secret object is created in the database. A secret is an object in the database used to store KDC ticket information.

[0026] Step S104: Create a corresponding secret object for each distributed file system cluster in the database, and set access permissions for each secret object.

[0027] In this embodiment, a secret object can be created in the database and permissions can be set: for each HDFS cluster to be accessed, an independent secret object is created in the database, and the access permission to this secret object is granted to the specified user, and other users have no access rights.

[0028] In some embodiments, the parameters included in the above secret object are used to represent the name of the authentication ticket object, the storage key distribution center authentication data source address, the address where the key distribution center authentication ticket file is stored, the configuration file information, the authentication expiration time, and the unique name of the distributed file system user.

[0029] Each secret object in this embodiment may include the following parameters: Secret_name: The name of the authentication ticket object, used to uniquely identify the secret object.

[0030] Kdc_url: stores the KDC authentication data source address.

[0031] Kdc_ticket_url: The address where the KDC authentication ticket file is located.

[0032] Kdc_config_url: configuration file information matching Kdc_ticket_url.

[0033] Kdc_life_timeout: Authentication validity period.

[0034] Hdfs_principal: The unique name of the HDFS user.

[0035] In this embodiment, access permissions can be set for each secret object to ensure that only authorized users or processes can access and operate these sensitive information.

[0036] In some embodiments, access rights can be set for each secret object based on roles, user groups, or user identities. The permission control in this embodiment can be performed based on roles, user groups, or specific user identities.

[0037] Step S106: The database executes a statement to create a secret object and reads the ticket file and configuration file of the key distribution center.

[0038] In this embodiment, the statement for creating a secret object can be executed, and the ticket file and configuration file of the key distribution center can be processed.

[0039] In some embodiments, the database executes a statement to create a secret object, and performs verification based on the access rights of each secret object; reads the ticket file and configuration file of the key distribution center, and encrypts and compresses the ticket file and configuration file; and stores the encrypted and compressed ticket file and configuration file in the metadata information of the database.

[0040] The database can execute the statement to create the secret object and verify it according to the set access rights. Read the corresponding KDC ticket file and configuration file, and encrypt and compress it according to the current data encryption method and compression algorithm. Store the encrypted and compressed data in the metadata information of the database as part of the secret object, and ensure that only users with corresponding access rights can access the data.

[0041] Step S108: Create data objects for each distributed file system cluster in the database, and use the secret object as the access parameter for the data objects.

[0042] In this embodiment, data objects for HDFS can be created and access parameters can be configured: According to the HDFS cluster to be accessed, corresponding data objects such as storage space tablespace are created in the database. When creating the tablespace, select the secret object of the corresponding HDFS cluster and use it as the access parameter for the tablespace.

[0043] In a database management system, a tablespace is a logical unit used to organize and manage the database storage structure. It maps the physical storage of the database (such as data files) to the logical storage (such as objects like tables and indexes), and is a core component of the database storage architecture.

[0044] In some embodiments, the data objects are used to be accessed and modified by users who have the access permission to the secret object. This embodiment can ensure that only users with corresponding permissions can access and modify the secret object for storing HDFS authentication ticket information.

[0045] Step S110: The data objects access the distributed file system cluster based on the access parameters.

[0046] The tablespace object in this embodiment can access the HDFS cluster based on the access parameters.

[0047] In some embodiments, it can be determined that the current user or process has the access permission to the secret object; determine the key distribution center authentication ticket file information in the database metadata based on the access parameters; pull the key distribution center authentication ticket file information to a local specified directory and configure it based on a preset authentication method; synchronize the configuration information of the authentication method with the configuration information in the local system; perform security authentication on the distributed file system cluster based on the authentication method and access the distributed file system cluster.

[0048] Among them, the above authentication method includes: Kerberos authentication. Kerberos is a computer network authorization protocol used to authenticate personal communications in a secure manner in an insecure network.

[0049] When the tablespace object needs to access HDFS, the corresponding KDC authentication ticket information is found in the database metadata through the information of the bound secret object. Verification is performed according to the set access permissions to ensure that the current user or process has the permission to access the secret object. The KDC ticket information is pulled to a specified local directory and configured according to the Kerberos authentication process. The relevant configuration information in krb5.conf (hdfs.keytab is the key file used for authentication when the HDFS service enables Kerberos authentication) is synchronized with the relevant configuration information in the local system. The source HDFS is authenticated securely by Kerberos using hdfs.keytab (hdfs.keytab is the keytab file in the Kerberos authentication system, which is used for the HDFS service or client to complete authentication in a Kerberized cluster), so as to achieve secure access to HDFS.

[0050] In the embodiments of the present invention, support for multiple sets of KDC authentication and permission management can be realized: by setting tablespace objects for multiple different HDFS storage spaces, KDC authentication can be performed using their respective corresponding secret objects. By setting independent permission controls for each secret object, it is ensured that only authorized users or processes can access and operate these secret objects, thereby achieving secure access to different HDFS clusters. The permission management can be based on roles, user groups, or specific user identities, and can adapt to different security requirements.

[0051] The embodiments of the present invention provide a method for accessing a distributed file system cluster, which grants read permissions to the ticket file and configuration file of the key distribution center to database users; creates corresponding secret objects for each distributed file system cluster in the database, and sets access permissions for each secret object; the database executes the statement to create a secret object, reads the ticket file and configuration file of the key distribution center; creates data objects for each distributed file system cluster in the database, and uses the secret object as the access parameter for the data object; the data object accesses the distributed file system cluster based on the access parameter. In this way, by creating and managing multiple secret objects and implementing permission control over them, secure access of the database to different KDC-authenticated HDFS clusters is achieved, and data security is further enhanced.

[0052] Embodiment 2: This embodiment provides another method for accessing a distributed file system cluster, which is implemented on the basis of the above embodiment and focuses on describing the specific implementation method for the database to securely access different KDC-authenticated HDFS clusters. See Figure 2Schematic diagram of an access method for a distributed file system cluster. The access method for the distributed file system cluster includes: 1. Prepare the KDC ticket file and configuration file: In this embodiment, read permissions for the KDC ticket file and configuration file can be opened for database users to ensure that the database can obtain these necessary authentication information, including the KDC URL (Uniform Resource Locator), ticket file URL, configuration file information, etc.

[0053] 2. Create a secret object in the database and set permissions: For each HDFS cluster that needs to be accessed, an independent secret object is created in the database.

[0054] Each secret object in this embodiment contains the following parameters: Secret_name: Such as "HDFS1_Secret".

[0055] Kdc_url: Such as "http: / / kdc1.example.com".

[0056] Kdc_ticket_url: Such as " / path / to / ticket1.keytab".

[0057] Kdc_config_url: Such as " / path / to / krb5_config1.conf".

[0058] Kdc_life_timeout: Such as set to 3600 seconds (1 hour).

[0059] Hdfs_principal: Such as "hdfs1_user@EXAMPLE.COM".

[0060] In this embodiment, access permissions can be set for each secret object to ensure that only authorized users or processes can access. For example, a user group named "HDFS_Admins" can be created, and the members of this group can be set to have permissions to access the secret object.

[0061] 3. Execute the creation statement and process the ticket file: The database in this embodiment executes the SQL statement for creating a secret object. For example: CREATE SECRET hdfs1_secret WITH ( KDC_URL = 'http: / / kdc1.example.com', KDC_TICKET_URL = ' / path / to / hdfs1.keytab', KDC_CONFIG_URL = ' / path / to / krb5_config1.conf', KDC_LIFE_TIMEOUT = 3600, HDFS_PRINCIPAL = 'hdfs1_user@EXAMPLE.COM' ); CREATE SECRET hdfs2_secret WITH ( KDC_URL = 'http: / / kdc2.example.com', KDC_TICKET_URL = ' / path / to / hdfs2.keytab', KDC_CONFIG_URL = ' / path / to / krb5_config2.conf', KDC_LIFE_TIMEOUT = 3600, HDFS_PRINCIPAL = 'hdfs2_user@EXAMPLE.COM' ); The database in this embodiment is verified according to the set access permissions to ensure that the current user has the permission to create a secret object. Read the corresponding KDC ticket file and configuration file, perform encryption and compression processing, and store the processed data in the metadata information of the database.

[0062] 4. Create an HDFS external table: In this embodiment, two external tables can be created based on hdfs1_secret, which are respectively used to read the data of the above two HDFS text files.

[0063] First, create the first external table (to read file1.txt), for example: CREATE EXTERNAL TABLE hdfs1_external_table1 ( column1 varchar(20), column2 INT, column3 DOUBLE ) ROW FORMAT DELIMITED FIELDS TERMINATED BY ',' STORED AS TEXTFILE LOCATION 'hdfs: / / namenode_host:port / user / hadoop / data / file1.txt' TBLPROPERTIES ( 'secret.name' = 'hdfs1_secret' ); After that, create a second external table (reading file2.txt), for example: CREATE EXTERNAL TABLE hdfs1_external_table2 ( fieldA varchar(20), fieldB varchar(200), fieldC TIMESTAMP ) ROW FORMAT DELIMITED FIELDS TERMINATED BY ',' STORED AS TEXTFILE LOCATION 'hdfs: / / namenode_host:port / user / hadoop / data / file2.txt' TBLPROPERTIES ( 'secret.name' = 'hdfs2_secret' ); 5. Database object access to HDFS: In this embodiment, when the external table object needs to access HDFS, the database obtains the KDC authentication ticket through the bound secret object information. It verifies according to the set access permissions to ensure that the current user has the permission to access the secret object. Pull the KDC ticket information to the local specified directory and configure it according to the Kerberos authentication process. Use the pulled ticket file to perform Kerberos security authentication on the source HDFS, so as to achieve secure access to HDFS.

[0064] 6. Support and permission management for multiple sets of KDC authentication: In this embodiment, independent secret objects can be created for each different HDFS cluster, and corresponding permission control can be implemented. By setting independent access permissions for each secret object, it is ensured that only authorized users or processes can access and operate these secret objects. Permission management can be based on roles, user groups, or specific user identities to meet different security requirements.

[0065] The above method provided by the embodiment of the present invention has the following advantages: (1) Authentication conflict resolution: By creating independent secret objects for each HDFS cluster, secure access of the same database to different KDC-authenticated HDFS clusters is successfully achieved, solving the problem of authentication conflicts.

[0066] (2) Security improvement: Encryption and compression processing ensure the security of KDC ticket files and configuration files, preventing the leakage of sensitive information. At the same time, by setting permission control for secret objects, the security of data is further improved.

[0067] (3) Flexible configuration and management: Different HDFS storage spaces can use their respective corresponding secret objects for KDC authentication, and flexible configuration and management can be achieved through permission management.

[0068] Embodiment 3: Corresponding to the above method embodiment, the embodiment of the present invention provides an access device for a distributed file system cluster, which is applied to a database, and the database is used to access multiple distributed file system clusters authenticated by multiple key distribution centers. Refer to Figure 3 the structural schematic diagram of an access device for a distributed file system cluster shown in the figure. The access device for the distributed file system cluster includes: A ticket file and configuration file preparation module 31, which is used to open the read permission of the ticket file and configuration file of the key distribution center for database users; A secret object creation and access permission setting module 32, which is used to create corresponding secret objects for each distributed file system cluster in the database and set access permissions for each secret object; A creation statement execution and file processing module 33, which is used for the database to execute the statement for creating secret objects and read the ticket file and configuration file of the key distribution center; A data object creation and access parameter configuration module 34, which is used to create data objects of each distributed file system cluster in the database and use the secret object as the access parameter of the data object; A distributed file system cluster access module 35, which is used for data objects to access the distributed file system cluster based on the access parameters.

[0069] An access device for a distributed file system cluster according to an embodiment of the present invention opens read permissions for the ticket file and configuration file of the key distribution center to database users; creates a corresponding secret object for each distributed file system cluster in the database, and sets access permissions for each secret object; the database executes a statement to create a secret object, reads the ticket file and configuration file of the key distribution center; creates a data object for each distributed file system cluster in the database, and uses the secret object as an access parameter for the data object; the data object accesses the distributed file system cluster based on the access parameter. In this way, by creating and managing multiple secret objects and implementing permission control over them, the database can securely access different KDC-authenticated HDFS clusters, and further improve data security.

[0070] The above parameters are used to represent the name of the authentication ticket object, the storage address of the key distribution center authentication data source, the address where the key distribution center authentication ticket file is stored, configuration file information, authentication validity time, and the unique name of the distributed file system user.

[0071] The above secret object creation and access permission setting module is used to set access permissions for each secret object based on roles, user groups, or user identities.

[0072] The above creation statement execution and file processing module is used for the database to execute a statement to create a secret object, verify according to the access permissions of each secret object; read the ticket file and configuration file of the key distribution center, and perform encryption and compression processing on the ticket file and configuration file; store the encrypted and compressed ticket file and configuration file in the metadata information of the database.

[0073] The above data object is used to be accessed and modified by users who have access permissions to the secret object.

[0074] The above distributed file system cluster access module is used to determine that the current user or process has access permissions to the secret object; determine the key distribution center authentication ticket file information in the metadata of the database based on the access parameter; pull the key distribution center authentication ticket file information to a local specified directory, and configure it based on a preset authentication method; synchronize the configuration information of the authentication method with the configuration information in the local system; perform security authentication on the distributed file system cluster based on the authentication method, and access the distributed file system cluster.

[0075] The above authentication method includes: Kerberos authentication.

[0076] Those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working process of the access device of the distributed file system cluster described above can refer to the corresponding process in the embodiment of the access method of the distributed file system cluster mentioned above, and will not be elaborated here.

[0077] Embodiment 4: The embodiment of the present invention also provides an electronic device for running the access method of the above-mentioned distributed file system cluster; see Figure 4 the structural schematic diagram of an electronic device shown. The electronic device includes a memory 100 and a processor 101. Among them, the memory 100 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor 101 to implement the access method of the above-mentioned distributed file system cluster.

[0078] Furthermore, Figure 4 the electronic device shown also includes a bus 102 and a communication interface 103, and the processor 101, the communication interface 103 and the memory 100 are connected through the bus 102.

[0079] Among them, the memory 100 may include a high-speed random access memory (RAM, Random Access Memory), and may also include a non-volatile memory, such as at least one disk memory. Through at least one communication interface 103 (which can be wired or wireless), a communication connection is established between this system network element and at least one other network element, and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 102 can be an ISA bus, a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 4 only a bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0080] The processor 101 may be an integrated circuit chip with the ability to process signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 101 or the instructions in the form of software. The above-mentioned processor 101 may be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it may also be a digital signal processor (DSP for short), an application specific integrated circuit (ASIC for short), a field-programmable gate array (FPGA for short), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present invention can be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory 100, and the processor 101 reads the information in the memory 100 and combines its hardware to complete the steps of the method in the foregoing embodiments.

[0081] The embodiments of the present invention also provide a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions cause the processor to implement the above-mentioned access method for a distributed file system cluster. For the specific implementation, reference can be made to the method embodiments, and details are not described herein again.

[0082] The computer program product of the access method, device, equipment and medium for a distributed file system cluster provided by the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods in the foregoing method embodiments. For the specific implementation, reference can be made to the method embodiments, and details are not described herein again.

[0083] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described system and / or device can refer to the corresponding processes in the foregoing method embodiments, and details are not described herein again.

[0084] In addition, in the description of the embodiments of the present invention, unless otherwise clearly defined and limited, the terms "installation", "connection", and "coupling" should be understood in a broad sense. For example, it may be a fixed connection, a detachable connection, or an integral connection; it may be a mechanical connection or an electrical connection; it may be a direct connection or an indirect connection through an intermediate medium, and it may be the communication inside two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific situations.

[0085] If the above-mentioned function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs that can store program codes.

[0086] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. is based on the orientation or positional relationship shown in the drawings. It is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0087] Finally, it should be noted that the above-described embodiments are only specific embodiments of the present invention, used to illustrate the technical solutions of the present invention, and are not intended to limit it. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions described in the foregoing embodiments or can easily think of changes, or perform equivalent replacements for some of the technical features; and these modifications, changes, or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A method for accessing a distributed file system cluster, characterized in that: Applied to a database, the database is used to access multiple distributed file system clusters authenticated by multiple sets of key distribution centers, the method includes: Give database users read access to the ticket file and configuration file of the key distribution center; Creating a corresponding secret object for each distributed file system cluster in the database, and setting access rights for each secret object; The database executes a statement for creating the secret object and reads a ticket file and a configuration file of a key distribution center; Creating a data object of each distributed file system cluster in the database, and using the secret object as an access parameter of the data object; The data object accesses the distributed file system cluster based on the access parameter.

2. The method according to claim 1, characterized in that The parameters included in the secret object are used to characterize the name of the authentication ticket object, the storage key distribution center authentication data source address, the address of the storage key distribution center authentication ticket file, configuration file information, authentication validity time and the unique name of the distributed file system user.

3. The method according to claim 1, characterized in that The steps of setting access rights for each secret object include: Set access permissions for each secret object based on role, user group, or user identity.

4. The method according to claim 1, characterized in that: The database executes a statement to create the secret object and reads a ticket file and a configuration file of a key distribution center, including: The database executes a statement to create the secret object and performs verification according to the access rights of each secret object; Read the ticket file and configuration file of the key distribution center, and encrypt and compress the ticket file and the configuration file; The encrypted and compressed ticket file and the configuration file are stored in the metadata information of the database.

5. The method according to claim 1, characterized in that The data object is used to be accessed and modified by a user who has access rights to the secret object.

6. The method according to claim 5, characterized in that The step of the data object accessing the distributed file system cluster based on the access parameter comprises: Determine whether the current user or process has access rights to the secret object; determining key distribution center authentication ticket file information in metadata of the database based on the access parameter; Pull the key distribution center authentication ticket file information to a local specified directory and configure it based on a preset authentication method; Synchronizing the configuration information of the authentication method with the configuration information in the local system; The distributed file system cluster is security authenticated based on the authentication method, and the distributed file system cluster is accessed.

7. The method according to claim 6, characterized in that The authentication method includes: Kerberos authentication.

8. An access device for a distributed file system cluster, characterized in that: Applied to a database, the database is used to access multiple distributed file system clusters authenticated by multiple sets of key distribution centers, the device comprises: The ticket file and configuration file preparation module is used to open the read permission of the ticket file and configuration file of the key distribution center to the database user; A secret object creation and access permission setting module, used to create a corresponding secret object for each distributed file system cluster in the database and set access permissions for each secret object; Create a statement execution and file processing module, which is used for the database to execute the statement for creating the secret object and read the ticket file and configuration file of the key distribution center; A data object creation and access parameter configuration module, used to create a data object of each distributed file system cluster in the database, and use the secret object as an access parameter of the data object; A distributed file system cluster access module is used for the data object to access the distributed file system cluster based on the access parameter.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the access method of the distributed file system cluster as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the method for accessing a distributed file system cluster as described in any one of claims 1 to 7.

Images