Data access method, physical machine, computer cluster and program product

Abstract

The present application provides a data access method, a physical machine, a computer cluster and a program product. The physical machine is deployed with: a cache manager, a virtual machine instance, and the virtual machine instance includes: a cache file system, a control device and a corresponding shared device. The control device responds to the first access request of the cache file system and sends a second access request carrying the name identifier of the target resource to the cache manager; the cache manager obtains the index identifier corresponding to the target resource based on the second access request and sends the index identifier to the control device; the control device maps the index identifier to the corresponding shared device and returns the virtual address space of the target resource in the shared device to the cache file system, so that the cache file system can access the target resource based on the virtual address space. The present application can improve the security of the virtual machine instance's data access to the physical machine.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data access method, a physical machine, a computer cluster, and a program product. Background Art

[0002] In a virtualized environment, the host is the physical machine that runs the virtualization software and is responsible for managing and allocating physical hardware resources to multiple virtual machine instances (guests). Virtual machine instances generally cannot directly access the physical machine's file system.

[0003] Currently, if a virtual machine instance needs to access the physical machine's file system, it must indirectly access the physical machine's file system using file system sharing technology. Common file system sharing technologies include Virtio-fs (a technology for efficient file system sharing in a virtualized environment).

[0004] However, when a virtual machine instance uses Virtio-fs technology to access the file system of a physical machine, it needs to map a complete file system directory structure specific to the physical machine to the shared memory space of the virtual machine instance, which leads to the problem of low security of this data access method. Summary of the Invention

[0005] The present application provides a data access method, a physical machine, a computer cluster, and a program product, which can improve the security of data access by virtual machine instances to physical machines.

[0006] In a first aspect, the present application provides a data access method, wherein a physical machine is deployed with: a cache manager and at least one virtual machine instance, wherein the virtual machine instance includes: a cache file system, a control device, and a shared device corresponding to the control device; the method includes:

[0007] The control device sends a second access request to the cache manager in response to the first access request for the target resource; the first access request is sent by the cache file system to the control device; the second access request carries: the name identifier of the target resource;

[0008] The control device receives a first access response returned by the cache manager based on the second access request; the first access response carries: an index identifier corresponding to the target resource;

[0009] The control device maps the index identifier to the corresponding shared device and returns a second access response to the cache file system; the second access response includes: the virtual address space of the target resource in the shared device, so that the cache file system accesses the target resource through the virtual address space.

[0010] Optionally, different control devices correspond to different data sources, and the second access request further carries: an identifier of the target data source corresponding to the control device.

[0011] Optionally, the first access request carries: a name identifier of the target resource, and the control device sends a second access request to the cache manager in response to the first access request for the target resource, including:

[0012] The control device performs a security check on the first access request;

[0013] When the first access request passes the security check, the control device adds the identifier of the target data source to the first access request to obtain the second access request;

[0014] The control device sends a second access request to the cache manager.

[0015] Optionally, the first access request is a read request, and after the control device sends a second access request to the cache manager in response to the first access request for the target resource, the method further includes:

[0016] In response to not obtaining the index identifier from the cache manager within a preset time period, the control device sends a third access response to the cache file system, where the third access response is used to indicate that the physical machine does not cache the target resource.

[0017] Optionally, before the control device sends the second access request to the cache manager in response to the first access request for the target resource, the method further includes:

[0018] The control device establishes a connection with the cache file system through a corresponding virtual port.

[0019] In a second aspect, the present application provides a data access method, wherein a physical machine is deployed with: a cache manager and at least one virtual machine instance, wherein the virtual machine instance includes: a cache file system, a control device, and a shared device corresponding to the control device; the method includes:

[0020] The shared device receives a data access request sent by the cache file system, wherein the data access request includes: a virtual address space of a target resource in the shared device; the virtual address space is obtained based on the method according to any one of the first aspects;

[0021] The shared device feeds back the target resource to the cache file system in response to the data access request.

[0022] In a third aspect, the present application provides a data access method, wherein a physical machine is deployed with: a cache manager and at least one virtual machine instance, wherein the virtual machine instance includes: a cache file system, a control device, and a shared device corresponding to the control device; the method includes:

[0023] The cache file system sends a first access request for a target resource to the control device, so that the control device sends a second access request to the cache manager in response to the first access request, and after receiving a first access response returned by the cache manager based on the second access request, maps the index identifier corresponding to the target resource to the corresponding shared device, and returns a second access response to the cache file system; the second access request carries: the name identifier of the target resource; the first access response carries: the index identifier; the second access response includes: the virtual address space of the target resource in the shared device;

[0024] The cache file system receives the second access response and accesses the target resource through a direct access DAX channel with the shared device based on the virtual address space.

[0025] Optionally, before the cache file system sends the first access request for the target resource to the control device, the method further includes:

[0026] The cache file system monitors the virtual port corresponding to the control device to determine whether the control device establishes a connection through the virtual port;

[0027] The cache file system sends a first access request for a target resource to the control device, including:

[0028] When the cache file system establishes a connection with the control device, the cache file system sends the first access request to the control device.

[0029] Optionally, the first access request is a read request, and after the cache file system sends the first access request for the target resource to the control device, the method further includes:

[0030] The cache file system obtains the target resource from the object storage service system or the network file system in response to a third access response from the control device; the third access response is used to indicate that the physical machine does not cache the target resource; the third access response is sent by the control device to the cache file system in response to not obtaining the index identifier from the cache manager within a preset time period.

[0031] Optionally, after the cache file system obtains the target resource from the object storage service system or the network file system in response to the third access response from the control device, the method further includes:

[0032] The cache file system sends a third access request to the control device; the third access request is used to request to write the target resource into the cache manager.

[0033] In a fourth aspect, the present application provides a data access method, wherein a physical machine is deployed with: a cache manager and at least one virtual machine instance, wherein the virtual machine instance includes: a cache file system, a control device, and a shared device corresponding to the control device; the method includes:

[0034] The cache manager receives a second access request sent by a control device, wherein the second access request is sent by the control device to the cache manager in response to a first access request for a target resource; the first access request is sent by the cache file system to the control device; and the second access request carries: a name identifier of the target resource;

[0035] The cache manager obtains an index identifier corresponding to the target resource based on the name identifier of the target resource;

[0036] The cache manager sends a first access response carrying the index identifier to the control device, so that the control device maps the index identifier to the corresponding shared device, and returns a second access response to the cache file system; the second access response includes: the virtual address space of the target resource in the shared device, so that the cache file system accesses the target resource through the virtual address space.

[0037] Optionally, the first access request is a read request, and the method further includes:

[0038] When the cache manager fails to find the index identifier corresponding to the target resource based on the name identifier of the target resource, the cache manager sends a third access response to the cache file system through the control device. The third access response is used to indicate that the physical machine does not cache the target resource.

[0039] In a fifth aspect, the present application provides a data access method, wherein a physical machine is deployed with: a cache manager and at least one virtual machine instance, wherein the virtual machine instance includes: a cache file system, a control device, and a shared device corresponding to the control device; the method includes:

[0040] The cache file system sends a first access request for a target resource to the control device;

[0041] The control device sends a second access request to the cache manager in response to the first access request; the second access request carries: a name identifier of the target resource;

[0042] The cache manager obtains an index identifier corresponding to the target resource based on the name identifier of the target resource;

[0043] The cache manager sends a first access response to the control device, where the first access response carries: the index identifier;

[0044] The control device maps the index identifier to the corresponding shared device and returns a second access response to the cache file system; the second access response includes: the virtual address space of the target resource in the shared device;

[0045] In response to the second access response, the cache file system accesses the target resource through a direct access DAX channel with the shared device based on the virtual address space.

[0046] In a sixth aspect, the present application provides a physical machine, on which are deployed: a cache manager and at least one virtual machine instance, the virtual machine instance including: a cache file system, a control device, and a shared device corresponding to the control device, where different control devices correspond to different data sources;

[0047] Wherein, the control device is used to execute the method as described in any one of the first aspects;

[0048] The shared device is used to execute the method according to the second aspect;

[0049] The cache file system is used to execute the method according to any one of the third aspects;

[0050] The cache manager is used to execute the method as described in any one of the fourth aspects.

[0051] In a seventh aspect, the present application provides a computer cluster, which includes at least one physical machine as described in the sixth aspect.

[0052] In an eighth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method as described in any one of the first, second, third, and fourth aspects.

[0053] In a ninth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method as described in any one of the first, second, third, and fourth aspects.

[0054] The data access method, physical machine, computer cluster, and program product provided by this application add a control device to a virtual machine instance. The control device can obtain a first access request sent by the cache file system of the virtual machine instance and, based on the first access request, obtain an index identifier of a target resource from a cache manager, thereby laying the foundation for mapping the index identifier to a shared device to obtain the virtual address space of the target resource. By sending a second access response including the virtual address space of the target resource to the cache file system, the cache file system can access the target resource based on the virtual address space of the target resource. This means that access to the target resource is achieved without mapping the complete file system directory structure to the shared memory space, thereby improving the security of data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0056] Figure 1 A schematic diagram of the structure of a physical machine provided in an embodiment of the present application;

[0057] Figure 2 A flowchart of a data access method provided in an embodiment of the present application;

[0058] Figure 3 A schematic diagram of the structure of another physical machine provided for this application;

[0059] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in this application.

[0060] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0061] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0062] The following is an explanation of the terms involved in this application:

[0063] Virtualization layer: This layer sits between physical machines and virtual machine instances, implementing virtualization functionality. It provides an abstraction layer between physical machines and virtual machine instances, enabling virtual machine instances to run without knowing the underlying hardware, enabling the sharing, isolation, and dynamic allocation of hardware resources.

[0064] Direct Access (DAX): A mechanism that enables user-level applications in a virtual machine instance to directly access data in the physical machine's file system. It allows user-level applications in a virtual machine instance to directly access files mapped to persistent memory without first copying file system data to the page cache.

[0065] Filesystem in Userspace (FUSE): is a framework that allows user-level applications to create and manage file systems. It provides a mechanism that allows non-privileged user-level applications to create fully functional file systems without recompiling the kernel.

[0066] In a virtualized environment, a physical machine is a physical machine running virtualization software, responsible for managing and allocating physical hardware resources to multiple virtual machine instances. Virtual machine instances run as independent operating system instances on the physical machine, interacting with the physical hardware through the virtualization layer. Each virtual machine instance has its own operating system kernel, user space, and resource allocation, and is isolated from the physical machine and other virtual machine instances, ensuring that each virtual machine instance can independently run applications and services.

[0067] Since virtual machine instances are isolated from physical machines, they cannot directly access the file system of the physical machine. Therefore, it is necessary to set up a shared memory area between the physical machine and the virtual machine instance and use data transmission technology to realize data transmission between the physical machine and the virtual machine instance.

[0068] A shared memory area is a physical memory space located on a physical machine. It is mapped to the address space of a virtual machine instance through virtualization technology, allowing the virtual machine instance to directly access the memory.

[0069] Zero copy data transmission is a data transmission technology that significantly improves data transmission efficiency by reducing unnecessary data copy operations and directly transmitting data between virtual machine instances and physical machines.

[0070] Currently, file system sharing technology enables zero-copy data transfer between physical machines and virtual machine instances. Virtio-fs is a commonly used file system sharing technology. Virtio-fs implements file system sharing in a virtualized environment. Its core components include the FUSE daemon on the physical machine, the kernel FUSE module, and the Virtio-fs device on the virtual machine instance. These components work in coordination to enable file system data transfer between the virtual machine instance and the physical machine.

[0071] The Virtio-fs device driver in the Virtio-fs device is responsible for transmitting file system requests and responses between virtual machine instances and physical machines. The Virtio-fs device establishes an efficient communication channel between the virtual machine instances and the physical machine using the Virtio protocol. It also utilizes shared memory areas and DAX functions to implement zero-copy data transfer, allowing virtual machine instances to access data resources on the physical machine as efficiently as accessing the local file system.

[0072] During implementation, the Virtio-fs device fully maps the file system structure and content on the physical machine to the virtual machine instance. Therefore, the file directory structure, file size, and content seen by the virtual machine instance remain consistent with those on the physical machine. This feature enables the virtual machine instance to bypass its own page cache and directly access data on the physical machine through the DAX function, further improving data transmission efficiency.

[0073] However, the above method of mapping a complete file system directory structure to the shared memory space of the virtual machine instance so that the virtual machine instance can directly access files on the physical machine has certain security risks and may lead to low security issues in data access.

[0074] Taking into account the above-mentioned problems existing in the existing data access method, an embodiment of the present application proposes a data access method that does not require mapping the complete file system directory structure to the shared memory space, so as to improve the security of data access.

[0075] The following detailed description of the technical solution of the present application is provided in conjunction with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0076] Figure 1This is a schematic diagram of the structure of a physical machine provided in an embodiment of the present application. Figure 1 As shown, the physical machine 10 may be deployed with: a cache manager 11 and at least one virtual machine instance 12. The virtual machine instance 12 may include: a cache file system 13, a control device 14, and a shared device 15 corresponding to the control device 14.

[0077] Illustratively, the cache manager 11 can be used to manage and maintain cache content in the persistent memory of the physical machine 10, and to transfer and update cache data. Optionally, the cache manager 11 can be, for example, a background management process. In some embodiments, the cache manager 11 can be, for example, a cache file system 13 cache daemon (cachefs cache daemon). The persistent memory can be, for example, a memory cache or a disk cache. It should be understood that the embodiments of the present application do not limit the specific form of the cache manager 11.

[0078] Taking the example of multiple virtual machine instances 12 deployed on the physical machine 10, the multiple virtual machine instances 12 may each include a cache file system 13, a control device 14, and a shared device 15 corresponding to the control device 14, and the above components can be used to execute the data access method provided in any embodiment of the present application. Alternatively, among the multiple virtual machine instances 12, some virtual machine instances 12 may be able to execute the data access method provided in any embodiment of the present application. It should be understood that the present application does not limit the number of virtual machine instances 12 deployed on the physical machine 10.

[0079] In some embodiments, the cache file system 13 may refer to cachefs fuse in any existing virtual machine instance 12. For example, the cache file system 13 may be used to accelerate read-only data access efficiency of the virtual machine through local caching and other methods.

[0080] For example, the control device 14 and the shared device 15 corresponding to the control device 14 can be preset in the virtual machine instance 12 (for example, as a process of the virtual machine instance 12, preset in the virtual machine instance 12). In some embodiments, the control device 14 can also be called a cachefs device.

[0081] Optionally, the cache file system 13 included in the virtual machine instance 12 may correspond to the control device 14. Optionally, for any virtual machine instance 12 deployed on the physical machine 10, taking the virtual machine instance 12 including one control device 14 as an example, the virtual machine instance 12 may include a cache file system 13 corresponding to the control device 14. Alternatively, in some embodiments, taking the virtual machine instance 12 including multiple control devices 14 as an example, the virtual machine instance 12 may include multiple cache file systems 13, and the multiple cache file systems 13 may correspond one-to-one to the multiple control devices 14.

[0082] Exemplarily, the shared device 15 may refer to any shared device 15 in an existing virtual machine instance 12. For example, the shared device 15 may be the aforementioned Virtio-fs device.

[0083] Based on the above-mentioned physical machine 10, the present application provides a data access method. Figure 2 A flow chart of a data access method provided in an embodiment of the present application. Figure 2 As shown, the method may include the following steps:

[0084] S101 : The cache file system 13 sends a first access request for a target resource to the control device 14 .

[0085] Exemplarily, the target resource may be data in any form, such as a file, table data, etc. The present application does not limit the data type of the target resource.

[0086] Optionally, the first access request may be a read request or a write request. For example, if the first access request is a read request, the first access request may be used to request reading the target resource. For example, if the first access request is a write request, the first access request may be used to request writing the target resource to the physical machine 10.

[0087] Illustratively, the first access request may include a name identifier of the target resource. For example, if the target resource is a file, the name identifier of the target resource may be, for example, the name of the file. Alternatively, if the target resource is table data, the name of the target resource may be, for example, information such as a table header. Alternatively, the name of the target resource may be, for example, a data block number.

[0088] For example, the first access request may also be used to describe a resource requirement. The resource required by the resource requirement is the target resource. Alternatively, in some embodiments, the first access request may refer to the content of an access request sent by any existing cache file system 13 to the physical machine 10 for data access, which is not further described in this application.

[0089] It should be understood that the present application does not limit the timing at which the cache file system 13 sends the first access request for the target resource to the control device 14. For example, the cache file system 13 may send the first access request for the target resource to the control device 14 in response to a user's target operation on the virtual machine instance 12. The target operation may be an operation that needs to be performed based on the target resource. Alternatively, the cache file system 13 may send the first access request for the target resource to the control device 14 in response to a target resource acquisition instruction triggered during the execution of a process of the virtual machine instance 12.

[0090] For example, taking the above-mentioned cache file system 13 and control device 14 as different processes of the virtual machine instance 12, the cache file system 13 process can, for example, generate the above-mentioned first access request and synchronize the first access request to the process of the control device 14 to send the first access request to the control device 14.

[0091] Correspondingly, the control device 14 may receive the first access request.

[0092] S102 : The control device 14 sends a second access request to the cache manager 11 in response to the first access request for the target resource.

[0093] The second access request may carry: the name identifier of the target resource.

[0094] As one possible implementation, after receiving the first access request, the control device 14 may, for example, use the first access request as the second access request. As another possible implementation, assuming the first access request includes descriptive information (e.g., text) describing the resource requirement, the control device 14 may first determine the target resource required by the resource requirement based on the descriptive information. Then, the control device 14 may generate the second access request based on the name identifier of the target resource.

[0095] Optionally, the control device 14 may implement a method of sending the second access request to the cache manager 11 by referring to any existing interaction method between the virtual machine instance 12 and the cache manager 11 of the physical machine 10, which will not be described in detail here.

[0096] Correspondingly, the cache manager 11 may receive the second access request sent by the control device 14 .

[0097] S103: The cache manager 11 obtains an index identifier corresponding to the target resource based on the name identifier of the target resource.

[0098] For example, the index identifier corresponding to the target resource may be, for example, the file descriptor (FD) corresponding to the target resource. The FD may be a non-negative integer index. Taking the FD as an example, the cache manager 11 may optionally obtain the FD corresponding to the target resource based on the name identifier of the target resource. For example, the cache manager 11 may obtain the FD of the target resource based on the name identifier of the target resource based on any existing data access method. This method will not be further described in this application. S104: The cache manager 11 sends a first access response to the control device 14.

[0099] The first access response may carry: the above-mentioned index identifier.

[0100] Optionally, after determining the above-mentioned index identifier, the cache manager 11 may generate a first access response including the index identifier based on the index identifier.

[0101] Accordingly, the control device 14 may receive the first access response.

[0102] S105 : The control device 14 maps the index identifier to the corresponding shared device 15 , and determines the virtual address space of the target resource in the shared device 15 .

[0103] For example, the virtual address space can be represented by an offset and a data size. The offset can, for example, refer to the offset of the target resource's storage location relative to a specific location. For example, the specific location can be a starting location, etc. Alternatively, the representation of the virtual address space (or the content of the virtual address space) can refer to any existing address used for data access based on the shared device 15, and this application does not limit this.

[0104] Optionally, taking the shared device 15 as a Virtio-fs device as an example, the control device 14 can, for example, map the index identifier to the corresponding shared device 15 through the Virtio protocol to obtain the virtual address space of the target resource in the shared device 15.

[0105] S106 : The control device 14 returns a second access response to the cache file system 13 .

[0106] Correspondingly, the cache file system 13 may receive the second access response.

[0107] The second access response may include: the virtual address space of the target resource in the shared device 15, so that the cache file system 13 can access the target resource through the virtual address space. Exemplarily, the cache file system 13 may send an access request including the virtual address space to the shared device 15 to access the target resource through the shared device 15.

[0108] In this embodiment, by adding a control device 14 to the virtual machine instance 12, the control device 14 can receive a first access request sent by the cache file system 13 of the virtual machine instance 12 and, based on the first access request, obtain an index identifier of the target resource from the cache manager 11. This lays the foundation for mapping the index identifier to the shared device 15 to obtain the virtual address space of the target resource. By sending a second access response including the virtual address space of the target resource to the cache file system 13, the cache file system 13 can access the target resource based on the virtual address space of the target resource. This allows access to the target resource without mapping the entire file system directory structure to the shared memory space, thereby improving data access security.

[0109] In some embodiments, different control devices 14 may correspond to different data sources. Alternatively, taking the example of multiple virtual machine instances 12 deployed on the physical machine 10, the different control devices 14 may refer to control devices 14 included in different virtual machine instances 12. Taking the example of a virtual machine instance 12 including multiple control devices 14, the different control devices 14 may also refer to different control devices 14 included in the same virtual machine instance 12.

[0110] Optionally, the data source may be a data source stored in the physical machine 10. It should be understood that the present application does not limit the form of the data source. For example, the data source may be any existing data source in the physical machine 10, such as a file, folder, data, or table.

[0111] The second access request may also carry an identifier of a target data source corresponding to the control device 14 .

[0112] As mentioned above, different control devices 14 may correspond to different data sources. The target data source is the data source corresponding to the control device 14. Optionally, the identifier of the target data source may be used to indicate the range of data sources accessible through the control device 14. For example, the identifier of the target data source may be a globally unique identifier. In some instances, the identifier of the target data source may also be referred to as a tag for the target data source.

[0113] For example, taking the case where the target data source is mounted on an Object Storage Service (OSS), the identifier of the target data source can be, for example, the name of the OSS bucket (i.e., the namespace in OSS, equivalent to the container for storing objects) (the name of the OSS bucket is globally unique) as the identifier of the target data source.

[0114] Optionally, the identifier of the target data source corresponding to the control device 14 may be pre-configured in the control device 14 , for example.

[0115] Optionally, the cache manager 11 may obtain the index identifier corresponding to the target resource based on the identifier of the target data source and the name identifier of the target resource. For example, the cache manager 11 may first determine the range of data sources that the control device 14 can access based on the identifier of the above-mentioned target data source. For example, the cache manager 11 may pre-store a mapping relationship between the identifier of the data source and the range of accessible data sources. The cache manager 11 may determine the range of data sources that the control device 14 can access based on the identifier of the above-mentioned target data source and the mapping relationship. Exemplarily, the mapping relationship between the identifier of the data source and the range of accessible data sources may be as shown in Table 1 below:

[0116] Table 1

[0117]

[0118] Exemplarily, taking the identifier of the target data source as data source identifier 3 as an example, based on the mapping relationship shown in Table 1 above, the control device 14 can determine that the range of data sources accessible to the control device 14 is data source range 3.

[0119] After determining the scope of the data source accessible to the control device 14, the cache manager 11 may, for example, search for an index identifier corresponding to the target resource within the scope of the data source based on the name identifier of the target resource. If the cache manager 11 finds the index identifier corresponding to the target resource within the scope of the data source, step S104 may be executed to send a first access response including the index identifier to the control device 14.

[0120] In some embodiments, assuming that a target resource has a data source range indication tag pre-added to physical machine 10 (e.g., an identifier of the data source corresponding to control device 14 that is permitted to access the target resource), cache manager 11 may first search for the target resource based on the target resource's name. Then, if the data source range indication tag of the target resource matches the identifier of the target data source corresponding to control device 14, cache manager 11 may obtain the index identifier corresponding to the target resource.

[0121] In this embodiment, the control device 14 sends an identifier of the target data source corresponding to the control device 14 to the cache manager 11, and different control devices 14 can correspond to different data sources, so that the cache management can isolate the range of data sources that can be accessed by different control devices 14 based on the identifiers of the data sources sent by different control devices 14, thereby improving data security in the scenario of multiple control devices 14.

[0122] The following describes in detail how the control device 14 sends the second access request to the cache manager 11 in response to the first access request for the target resource:

[0123] As a possible implementation manner, the control device 14 may, for example, first perform a security check on the first access request.

[0124] Exemplarily, the above-mentioned safety check may include, for example: verification check, and / or current limiting check, etc.

[0125] Taking the example of a security check including a verification check, the control device 14 may, for example, perform a verification check on the first access request based on the data transmission protocol between the control device 14 and the cache file system 13, such as verifying the format correctness and content integrity of the first access request. For example, the control device 14 may determine that the security check on the first access request has passed after the format correctness and content integrity checks on the first access request have passed. If the first access request does not meet the verification checks on the format correctness or content integrity, the control device 14 may determine that the security check on the first access request has failed.

[0126] Taking the example of a security check including a rate limiting check, illustratively, after receiving the first access request, the control device 14 may, for example, add the first access request to a queue of pending requests. The control device 14 may then determine whether the rate limiting check has passed based on the number of pending access requests in the queue. For example, the control device 14 may determine that the security check for the first access request has failed if the number of pending access requests in the queue is greater than a preset number. For example, the control device 14 may determine that the security check for the first access request has passed if the number of pending access requests in the queue is less than or equal to a preset number.

[0127] Taking the first access request carrying the name identifier of the target resource as an example, the control device 14 can add the identifier of the target data source to the first access request when the first access request passes the security check to obtain a second access request. The control device 14 can then send the second access request to the cache manager 11.

[0128] For example, if the first access request includes a blank identification field, the control device 14 may, for example, add the identifier of the target data source to the blank identification field of the first access request to obtain a second access request. Alternatively, the control device 14 may, for example, tag the first access request with the identifier of the target data source. The control device 14 may use the first access request, tagged with the identifier of the target data source, as the second access request.

[0129] In this embodiment, the control device 14 can perform a security check on the first access request. If the security check on the first access request passes, it indicates that processing the first access request can ensure the security of the operation of the virtual machine instance 12 and the physical machine 10. Therefore, if the security check on the first access request passes, the identifier of the target data source is added to the first access request to obtain a second access request and send it to the cache manager 11. This improves the security of data transmission between the control device 14 and the cache manager 11, thereby further improving the security of the data access process.

[0130] The following is an exemplary description of how the cache file system 13 accesses the target resource after receiving the second access response:

[0131] As a possible implementation manner, the cache file system 13 may, for example, respond to the second access response and access the target resource through the DAX channel between the cache file system 13 and the shared device 15 based on the virtual address space carried in the second access response.

[0132] Exemplarily, taking the above-mentioned virtual address space including the offset and the size of the target resource as an example, the cache file system 13 can, for example, access the sparse file of the physical machine 10 through the DAX channel between the shared device 15 based on the offset and the size of the target resource to achieve access to the target resource. Exemplarily, the offset can be, for example, an offset relative to position 0 of the sparse file. For example, if the offset is 2 gigabytes (G) and the size of the target resource is 1G, the cache file system 13 can access the data resource of the sparse file starting from the 2G data position and then accessing 1G of data resources as the target resource through the DAX channel between the shared device 15.

[0133] In some embodiments, the cache file system 13 may, for example, send a data access request to the shared device 15 , requesting access to the target resource through a DAX channel between the cache file system 13 and the shared device 15 .

[0134] Accordingly, the shared device 15 may receive the data access request sent by the cache file system 13. The data access request may include: a virtual address space of the target resource in the shared device 15. The virtual address space is obtained based on the data access method described in any of the above embodiments.

[0135] Then, the shared device 15 may feedback the target resource to the cache file system 13 in response to the data access request.

[0136] Optionally, the shared device 15 may establish a DAX channel between the shared device 15 and the cache file system 13 in response to the data access request, so that the cache file system 13 can access the target resource through the DAX channel between the shared device 15 and the cache file system 13.

[0137] In this embodiment, the control device 14 sends a second access response including the virtual address space of the target resource to the cache file system 13, so that the cache file system 13 can access the target resource based on the virtual address space through the DAX channel between the shared device 15, thereby realizing high-efficiency data transmission with zero copy between the cache file system 13 and the physical machine 10 through the DAX shared memory, thereby improving the efficiency of data transmission.

[0138] As a possible implementation method, before the cache file system 13 sends a first access request for the target resource to the control device 14 (also before the control device 14 sends a second access request to the cache manager 11 in response to the first access request for the target resource), for example, it can also first establish a connection with the control device 14.

[0139] For example, the cache file system 13 may monitor the virtual port corresponding to the control device 14 to determine whether the control device 14 establishes a connection through the virtual port.

[0140] Exemplarily, the cache file system 13 may monitor a virtual port of a virtual socket (VirtualSocket, vsock) through a process, and wait for the control device 14 to connect.

[0141] The control device 14 may, for example, establish a connection with the cache file system 13 through a corresponding virtual port, so that the cache file system 13 sends the aforementioned first access request to the control device 14 when the connection is established with the control device 14 .

[0142] Through the above method, the cache file system 13 can send a first access request to the control device 14 in a timely manner after the control device 14 is connected to the cache file system 13 by monitoring the virtual port corresponding to the control device 14, laying the foundation for subsequent acquisition of the virtual address space of the target resource based on the control device 14.

[0143] As a possible implementation method, taking the first access request as a read request as an example, if the cache manager 11 fails to find the index identifier corresponding to the target resource based on the name identifier of the target resource, it can send a third access response to the cache file system 13 through the control device 14.

[0144] The third access response may be used to indicate that the physical machine does not cache the target resource.

[0145] If the cache manager 11 fails to find the index identifier corresponding to the target resource based on the name identifier of the target resource, it indicates that the physical machine 10 does not store the target resource, or the target resource is not within the range of data sources accessible to the control device 14. Therefore, the cache manager 11 may send the third access response to the control device 14.

[0146] Correspondingly, the control device 14 may receive the third access response.

[0147] The control device 14 may send a second access request to the cache manager 11 in response to the first access request for the target resource, and then send the above-mentioned third access response to the cache file system 13 if the index identifier is not obtained from the cache manager 11 within a preset time period.

[0148] For example, the preset time length may be pre-stored in the control device 14. For example, the preset time length may be, for example, 10 seconds. This application does not limit the preset time length.

[0149] Exemplarily, the control device 14 may determine that the index identifier is not obtained from the cache manager 11 when receiving the third access response from the cache manager 11 .

[0150] Correspondingly, the cache file system 13 may receive the third access response.

[0151] Through the above method, the control device 14 can send a third access response to the cache file system 13 when the above index identifier is not obtained from the cache manager 11, so that the cache file system 13 can promptly determine that the target resource cannot be accessed from the cache manager 11, laying the foundation for the subsequent cache file system 13 to continue to read the target resource through other means, and increasing the probability of the cache file system 13 successfully reading the target resource.

[0152] If the cache file system 13 receives the third access response, it may optionally continue to read the target resource in other ways, for example.

[0153] For example, the cache file system 13 may obtain the target resource from an object storage service (OSS) system in response to the third access response from the control device 14. Alternatively, the cache file system 13 may also obtain the target resource from a network file system, etc., in response to the third access response from the control device 14. It should be understood that this application does not limit the manner in which the cache file system 13 continues to obtain the target resource upon receiving the third access response.

[0154] As a possible implementation, after acquiring the target resource, the cache file system 13 may further send a third access request to the control device 14 , for example. The third access request may be used to request writing the target resource into the cache manager 11 .

[0155] Exemplarily, the third access request may include the target resource mentioned above.

[0156] Accordingly, the control device 14 may receive the third access request. Optionally, the control device 14 may add an identifier of the target data source corresponding to the control device 14 to the target resource in response to the third access request.

[0157] Exemplarily, the control device 14 may, for example, send a fourth access request to the cache manager 11 after adding the identifier of the target data source corresponding to the control device 14 to the target resource. The fourth access request may, for example, include the target resource to which the identifier of the target data source corresponding to the control device 14 is added.

[0158] Accordingly, the cache manager 11 can receive the fourth access request and store the target resource. Using the identifier of the target data source corresponding to the control device 14, the cache manager 11 can isolate the target resource from other "target data sources not corresponding to the control device 14" based on the identifier of the target data source corresponding to the control device 14.

[0159] In this embodiment, upon receiving the third access response, cache file system 13 indicates that it failed to read the target resource from cache manager 11. In this case, cache file system 13 can continue to obtain the target resource through the object storage service system or network file system, thereby increasing the probability of successfully reading the target resource. By sending the third access request to control device 14, cache file system 13 enables control device 14 to write the target resource to cache manager 11 based on the third access request, laying the foundation for cache file system 13 to subsequently read the target resource from cache manager 11.

[0160] Figure 3 This is a structural diagram of another physical machine 10 provided in this application. Figure 3 As shown, the virtual machine instance 12 deployed on the physical machine 10 may include a running container (Rund Pod) and a running virtual machine monitor (Rund VMM). The Rund Pod includes a cache file system 13 (e.g., cachefs fuse), a metadata engine (meta engine), and an OSS mount (i.e., OSS mount). The Rund VMM includes a control device 14 (e.g., a cachefs device) and a shared device 15 (a virtio-fs device).

[0161] Physical machine 10 includes a cache manager 11 (e.g., a cachefs cache daemon), a memory cache / disk cache (e.g., a mem / disk cache), and sparse files. Sparse files can be directly mapped to virtual machine instance 12 as DAX windows via a virtio-fs channel. A control device 14 can be used to memory-map cache data to corresponding DAX slots.

[0162] like Figure 3As shown, the solid lines between the cache file system 13, the metadata engine, and the OSS mount represent function calls between them. The dashed lines connecting the cache file system 13, the control device 14, the cache manager 11, and the sparse file represent remote procedure calls (RPCs), also known as RPC calls, and the control links between them. The dashed-dotted lines between the cache file system 13, the shared device 15, and the sparse file represent DAX data links between them.

[0163] By adding a new control device 14 in the rund vmm, the two aforementioned security multi-tenancy problems are solved at the same time, and this control device 14 and the cachefs process in the virtual machine instance 12 can be one-to-one corresponding.

[0164] The cache file system 13 process in virtual machine instance 12 listens on a vsock port, waiting for a connection from control device 14. This prevents the process in virtual machine instance 12 from actively initiating requests. Once the connection is established, cache file system 13 can directly send the request to control device 14. Control device 14 then performs security checks such as verification and rate limiting on the request before forwarding it to cache manager 11 on physical machine 10.

[0165] In terms of data security isolation, when creating a control device 14, a data source name or tag (i.e., the identifier of the aforementioned target data source) can be set for each control device 14. After being processed by the control device 14, the first access request sent by the cache file system 13 can be added with the tag identifying the data source to obtain a second access request, which is then forwarded to the cache manager 11. The cache manager 11 can use the identifier of the target data source to isolate different data sources (e.g., different cache directories) to achieve secure multi-tenancy of data. For example, if the data source requiring cache acceleration is an OSS mount, the OSS bucket can be used as the data source tag. Because OSS bucket names are globally unique, runs that can access the same bucket belong to the same user or are authorized to access other users, improving data access security.

[0166] Furthermore, to reduce the performance impact of multiple data copies caused by request forwarding, each control device 14 can be configured with a corresponding new shared device 15. This shared device 15 can transparently transmit files to the virtual machine instance 12, rather than entire directories. This avoids the security risks associated with transparently transmitting a complete file system directory structure. By using shared device 15 as a DAX window, control device 14 can map the required cached data into the DAX window and transparently transmit it to the process of the cache file system 13, achieving direct zero-copy access to cached content on the host.

[0167] In this embodiment, by using shared device 15 as a DAX window, control device 14 can be used to map the required cached data into the DAX window without accessing the file contents therein, thereby enabling on-demand mapping of target resources to the DAX window for use by virtual machine instance 12. Utilizing the DAX data path of shared device 15 avoids the security risks of transparently transmitting the entire file system directory through shared device 15, and enables highly efficient zero-copy data transmission between virtual machine instance 12 and physical machine 10 via DAX shared memory. By transparently transmitting only the target resources that cache file system 13 needs to access, rather than the entire directory, the security risks associated with transparently transmitting directories are reduced, improving data access security.

[0168] The present application also provides a computer cluster. The computer cluster may include at least one physical machine 10 as described in any of the aforementioned embodiments. The implementation principle and technical effects of the computer cluster provided by the present application are similar to those of the aforementioned physical machine 10, and will not be further described.

[0169] Figure 4 This is a hardware structure diagram of an electronic device provided in this application. The electronic device may be the physical machine 10 as described in any of the above embodiments. Figure 4 The electronic device 40 shown includes a memory 41, a processor 42, and a communication interface 43. The memory 41, processor 42, and communication interface 43 are communicatively connected to each other. For example, the memory 41, processor 42, and communication interface 43 may be communicatively connected using a network connection. Alternatively, the electronic device 40 may further include a bus 44. The memory 41, processor 42, and communication interface 43 are communicatively connected to each other via the bus 44. Figure 4 The electronic device 40 is a memory 41 , a processor 42 , and a communication interface 43 , which are connected to each other via a bus 44 .

[0170] Memory 41 can be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). Memory 41 can store programs. When the program stored in memory 41 is executed by processor 42, processor 42 and communication interface 43 are used to perform the data access method described in any of the aforementioned embodiments. Memory 41 can also store data required by the data access method.

[0171] The processor 42 may be a general-purpose CPU, a microprocessor, an application-specific integrated circuit (ASIC), a graphics processing unit (GPU), or one or more integrated circuits.

[0172] Processor 42 may also be an integrated circuit chip with signal processing capabilities. During implementation, the data access method of the present application may be implemented using hardware integrated logic circuits or software instructions within processor 42. The processor 42 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the various methods, steps, and logic block diagrams disclosed in the following embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the following embodiments of this application may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules within the decoding processor. The software modules may be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 41, and processor 42 reads information from memory 41 and, in conjunction with its hardware, implements the data access method of the present application.

[0173] The communication interface 43 uses a transceiver module such as, but not limited to, a transceiver to implement communication between the electronic device 40 and other devices or a communication network. For example, a data set can be obtained through the communication interface 43.

[0174] When the electronic device 40 includes a bus 44 , the bus 44 may include a path for transmitting information between various components of the electronic device 40 (eg, the memory 41 , the processor 42 , and the communication interface 43 ).

[0175] The present application also provides a computer-readable storage medium, which may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes. Specifically, the computer-readable storage medium stores program instructions, and the program instructions are used for the methods in the above embodiments.

[0176] The present application also provides a program product, the program product including execution instructions, the execution instructions stored in a readable storage medium. At least one processor of an electronic device can read the execution instructions from the readable storage medium, and the at least one processor executes the execution instructions so that the electronic device implements the data access method provided in the various embodiments described above.

[0177] The term "plurality" in this article refers to two or more. The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship; in the formula, the character " / " indicates that the previous and next associated objects are in a "division" relationship. In addition, it should be understood that in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0178] It will be understood that the various numerical numbers involved in the embodiments of the present application are merely distinctions for the convenience of description and are not intended to limit the scope of the embodiments of the present application.

[0179] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data access method, characterized in that: A cache manager and at least one virtual machine instance are deployed on a physical machine. The virtual machine instance includes a cache file system, a control device, and a shared device corresponding to the control device. The method includes: The control device sends a second access request to the cache manager in response to the first access request for the target resource; the first access request is sent by the cache file system to the control device; the second access request carries: the name identifier of the target resource; The control device receives a first access response returned by the cache manager based on the second access request; the first access response carries: an index identifier corresponding to the target resource; The control device maps the index identifier to the corresponding shared device and returns a second access response to the cache file system; the second access response includes: the virtual address space of the target resource in the shared device, so that the cache file system accesses the target resource through the virtual address space.

2. The method according to claim 1, characterized in that Different control devices correspond to different data sources, and the second access request further carries: an identifier of the target data source corresponding to the control device.

3. The method according to claim 2, characterized in that The first access request carries: a name identifier of the target resource; the control device sends a second access request to the cache manager in response to the first access request for the target resource, including: The control device performs a security check on the first access request; When the first access request passes the security check, the control device adds the identifier of the target data source to the first access request to obtain the second access request; The control device sends a second access request to the cache manager.

4. The method according to any one of claims 1 to 3, characterized in that The first access request is a read request. After the control device sends a second access request to the cache manager in response to the first access request for the target resource, the method further includes: In response to not obtaining the index identifier from the cache manager within a preset time period, the control device sends a third access response to the cache file system, where the third access response is used to indicate that the physical machine does not cache the target resource.

5. The method according to any one of claims 1 to 3, characterized in that Before the control device sends the second access request to the cache manager in response to the first access request for the target resource, the method further includes: The control device establishes a connection with the cache file system through a corresponding virtual port.

6. A data access method, characterized in that: A cache manager and at least one virtual machine instance are deployed on a physical machine. The virtual machine instance includes a cache file system, a control device, and a shared device corresponding to the control device. The method includes: The shared device receives a data access request sent by the cache file system, wherein the data access request includes: a virtual address space of a target resource in the shared device; the virtual address space is obtained based on the method according to any one of claims 1 to 5; The shared device feeds back the target resource to the cache file system in response to the data access request.

7. A data access method, characterized in that: A cache manager and at least one virtual machine instance are deployed on a physical machine. The virtual machine instance includes a cache file system, a control device, and a shared device corresponding to the control device. The method includes: The cache file system sends a first access request for a target resource to the control device, so that the control device sends a second access request to the cache manager in response to the first access request, and after receiving a first access response returned by the cache manager based on the second access request, maps the index identifier corresponding to the target resource to the corresponding shared device, and returns a second access response to the cache file system; the second access request carries: the name identifier of the target resource; the first access response carries: the index identifier; the second access response includes: the virtual address space of the target resource in the shared device; The cache file system receives the second access response and accesses the target resource through a direct access DAX channel with the shared device based on the virtual address space.

8. The method according to claim 7, characterized in that Before the cache file system sends the first access request for the target resource to the control device, the method further includes: The cache file system monitors the virtual port corresponding to the control device to determine whether the control device establishes a connection through the virtual port; The cache file system sends a first access request for a target resource to the control device, including: When the cache file system establishes a connection with the control device, the cache file system sends the first access request to the control device.

9. The method according to claim 7 or 8, characterized in that The first access request is a read request. After the cache file system sends the first access request for the target resource to the control device, the method further includes: The cache file system obtains the target resource from the object storage service system or the network file system in response to a third access response from the control device; the third access response is used to indicate that the physical machine does not cache the target resource; the third access response is sent by the control device to the cache file system in response to not obtaining the index identifier from the cache manager within a preset time period.

10. The method according to claim 9, characterized in that After the cache file system obtains the target resource from the object storage service system or the network file system in response to the third access response from the control device, the method further includes: The cache file system sends a third access request to the control device; the third access request is used to request to write the target resource into the cache manager.

11. A data access method, characterized in that: A cache manager and at least one virtual machine instance are deployed on a physical machine. The virtual machine instance includes a cache file system, a control device, and a shared device corresponding to the control device. The method includes: The cache manager receives a second access request sent by a control device, wherein the second access request is sent by the control device to the cache manager in response to a first access request for a target resource; the first access request is sent by the cache file system to the control device; and the second access request carries: a name identifier of the target resource; The cache manager obtains an index identifier corresponding to the target resource based on the name identifier of the target resource; The cache manager sends a first access response carrying the index identifier to the control device, so that the control device maps the index identifier to the corresponding shared device, and returns a second access response to the cache file system; the second access response includes: the virtual address space of the target resource in the shared device, so that the cache file system accesses the target resource through the virtual address space.

12. The method according to claim 11, characterized in that The first access request is a read request, and the method further includes: When the cache manager fails to find the index identifier corresponding to the target resource based on the name identifier of the target resource, the cache manager sends a third access response to the cache file system through the control device. The third access response is used to indicate that the physical machine does not cache the target resource.

13. A data access method, characterized in that: A cache manager and at least one virtual machine instance are deployed on a physical machine. The virtual machine instance includes a cache file system, a control device, and a shared device corresponding to the control device. The method includes: The cache file system sends a first access request for a target resource to the control device; The control device sends a second access request to the cache manager in response to the first access request; the second access request carries: a name identifier of the target resource; The cache manager obtains an index identifier corresponding to the target resource based on the name identifier of the target resource; The cache manager sends a first access response to the control device, where the first access response carries: the index identifier; The control device maps the index identifier to the corresponding shared device and returns a second access response to the cache file system; the second access response includes: the virtual address space of the target resource in the shared device; In response to the second access response, the cache file system accesses the target resource through a direct access DAX channel with the shared device based on the virtual address space.

14. A physical machine, characterized in that: The physical machine is deployed with: a cache manager and at least one virtual machine instance, wherein the virtual machine instance includes: a cache file system, a control device, and a shared device corresponding to the control device; Wherein, the control device is used to execute the method according to any one of claims 1 to 5; The shared device is used to perform the method according to claim 6; The cache file system is used to execute the method according to any one of claims 7 to 10; The cache manager is used to execute the method according to claim 11 or 12.

15. A computer cluster, characterized in that: The computer cluster includes at least one physical machine according to claim 14.

16. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1-5, 6, 7-10, 11-12, and 13 when executed by a processor.

17. A computer program product, characterized in that The computer program product comprises a computer program, which implements the method according to any one of claims 1-5, 6, 7-10, 11-12, and 13 when executed by a processor.

Images