Server cluster management method, electronic device, storage medium and program product

Abstract

The present application discloses a server cluster management method, electronic device, storage medium, and program product, which relate to the field of computer technology. The method includes obtaining network information and behavioral information of clients accessing the server cluster when it is necessary to manage the server cluster, wherein the network information refers to the frequency of attacks on the server cluster, and the behavioral information of the client refers to the client's network location, request frequency, etc.; determining the rotation period of a key based on the network information, and the key is used to encrypt the communication content; determining the risk level of the client based on the behavioral information; and determining the client's security policy based on the rotation period and risk level. In this way, by introducing network information and client behavior information, the client's security policy is dynamically adjusted, thereby better defending against various network attacks and improving the security of the system.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a server cluster management method, electronic equipment, storage medium, and program product. Background Art

[0002] When users access data in a server cluster through a client, they may be subject to network attacks.

[0003] In related technologies, it is possible to improve defense capabilities against network attacks by pre-setting security policies. For example, pre-setting security policies can include firewall rules, whitelists, password complexity specifications, etc. However, in these methods, pre-setting security policies may have blind spots when facing complex and changing new network attacks, resulting in poor security. Summary of the Invention

[0004] The present application provides a server cluster management method, electronic device, storage medium and program product to at least solve the problem of poor security in related technologies.

[0005] This application provides a server cluster management method, including:

[0006] Obtain network information and behavioral information of clients accessing the server cluster. The network information is used to indicate the frequency of attacks on the server cluster.

[0007] Determine the key rotation period based on network information and the client's risk level based on behavioral information;

[0008] Determine the client's security policy based on the rotation cycle and risk level.

[0009] The present application also provides a server cluster management device, comprising: an acquisition module, a first determination module and a second determination module, wherein:

[0010] The acquisition module is used to obtain network information and behavioral information of clients accessing the server cluster. The network information is used to indicate the frequency of attacks on the server cluster.

[0011] The first determination module is used to determine the key rotation period based on the network information and determine the risk level of the client based on the behavior information;

[0012] The second determination module is used to determine the security policy of the client according to the rotation cycle and the risk level.

[0013] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned server cluster management methods when executing the computer program.

[0014] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned server cluster management methods are implemented.

[0015] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned server cluster management methods when executed by a processor.

[0016] Through this application, when it is necessary to manage a server cluster, network information and behavioral information of clients accessing the server cluster can be obtained. Network information can refer to the frequency of attacks on the server cluster, and client behavioral information can refer to the client's network location, request frequency, etc. Based on the network information, the key rotation cycle can be determined, and the key can be used to encrypt the communication content; based on the behavioral information, the client's risk level can be determined; based on the rotation cycle and risk level, the client's security policy can be determined. In this way, by introducing network information and client behavioral information, the client's security policy can be dynamically adjusted to better defend against various network attacks, thereby improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 A schematic diagram of the system architecture provided in an embodiment of the present application;

[0019] Figure 2 A flow chart of a method for managing a server cluster provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the encrypted communication process provided by an embodiment of the present application;

[0021] Figure 4 A schematic diagram of the multi-indicator acquisition and monitoring process provided in an embodiment of the present application;

[0022] Figure 5 An interactive diagram of the resource configuration adjustment process provided in an embodiment of the present application;

[0023] Figure 6 A schematic diagram of the process of electing a master node in a server cluster provided in an embodiment of the present application;

[0024] Figure 7 An interactive diagram of the process of electing a master node in a server cluster provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of a server cluster cache data update process provided in an embodiment of the present application;

[0026] Figure 9 A schematic diagram of the overall management of a server cluster provided in an embodiment of the present application;

[0027] Figure 10 A schematic diagram of the structure of a server cluster management device provided in an embodiment of the present application;

[0028] Figure 11 A schematic diagram of the structure of another server cluster management device provided in an embodiment of the present application;

[0029] Figure 12 This is a schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0030] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0031] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0032] First, let’s explain the terms involved in this application:

[0033] Long Short-Term Memory (LSTM) networks are a specialized recurrent neural network architecture that effectively processes and predicts long intervals and delays in time series data. They address the vanishing and exploding gradient problems that traditional neural networks encounter when processing long sequences of data. LSTM networks are neural networks that effectively capture long-term dependencies. Their unique structure controls the forgetting, retention, and updating of information, resulting in improved performance when processing sequential data.

[0034] Consensus algorithm: An algorithm for managing replicated logs, designed to address consistency issues across multiple nodes in a distributed system. Designed to be easy to understand and highly practical, consensus algorithms are primarily used to ensure data consistency across multiple nodes in a distributed system. Consensus algorithms ensure data consistency across multiple nodes through methods such as leader election, log replication, and heartbeat mechanisms, and are able to tolerate node failures.

[0035] In related technologies, electronic devices can improve their defenses against network attacks through pre-set security policies. For example, these policies can include firewall rules, whitelists, and password complexity standards. However, these pre-set security policies may have blind spots when facing complex and changing new network attacks, resulting in poor security for server clusters.

[0036] In response to the above problems, in an embodiment of the present application, when it is necessary to manage a server cluster, network information and behavioral information of clients accessing the server cluster can be obtained, where network information can refer to the frequency of attacks on the server cluster, and behavioral information of the client can refer to the client's network location, request frequency, etc.; based on the network information, the rotation period of the key can be determined, and the key can be used to encrypt the communication content; based on the behavioral information, the risk level of the client can be determined; based on the rotation period and risk level, the client's security policy can be determined. In this way, by introducing network information and client behavior information, the client's security policy can be dynamically adjusted to better defend against various network attacks, thereby improving the security of the system.

[0037] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0038] In conjunction with the specific application environment architecture or specific hardware architecture on which the execution of the server cluster management method depends, the specific application environment architecture or specific hardware architecture is described here. Figure 1 , Figure 1 This is a schematic diagram of the system architecture provided by the embodiment of this application. Figure 1 , including a client 101 and a server cluster 102. The client 101 may be a local device of a user, and the user may access data in the server cluster 102 through the client 101. The server cluster 102 may include multiple server nodes such as server 1, server 2, server 3, and server N.

[0039] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0040] Figure 2 A flow chart of a method for managing a server cluster provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, an embodiment of the present application provides a method for managing a server cluster, and the method is described in detail as follows:

[0041] S201: Acquire network information and behavior information of clients accessing a server cluster.

[0042] The execution subject of the embodiments of the present application may be an electronic device, which may be a device with computing capabilities, such as a terminal device or a server. Alternatively, the execution subject may be a server cluster management device provided in the electronic device. The server cluster management device may be implemented by software or a combination of software and hardware.

[0043] The client may refer to a terminal device or application used by a user to interact with a server cluster.

[0044] Network information can be used to indicate the frequency of attacks on a server cluster. It can also be used to indicate current network traffic. For example, network information can include access traffic, number of requests, and response time. Specifically, when access traffic is high, the probability of a server cluster being attacked is higher. When the number of requests is high, there may be abnormal attacks or malicious requests, which increases the probability of a server cluster being attacked.

[0045] Behavior information can be used to indicate the client's operating data. For example, behavior information may include the geographical location of the client's Internet Protocol address, the frequency of requests to access the server cluster, the application interface call sequence, and any other information associated with the client's behavior of accessing the server cluster. The embodiments of the present application do not limit this.

[0046] S202: Determine a key rotation period based on network information, and determine a risk level of the client based on behavior information.

[0047] The key may refer to the key used for encrypting communications between the server cluster and the client.

[0048] The key rotation period may refer to the time interval for updating or replacing the key. For example, the key rotation period may be once a day or once an hour.

[0049] The risk level of a client can be used to describe the possibility that the client is at risk of being attacked, that is, the higher the risk level of the client, the higher the possibility that the client is at risk of being attacked and / or the possibility of potential risks being present; the lower the risk level of the client, the lower the possibility that the client is at risk of being attacked and / or the possibility of potential risks being present.

[0050] The key rotation period can be determined as follows: based on network information, the sensitivity of the server cluster can be determined, where the sensitivity is used to indicate the ability of the server cluster to remain stable after being attacked. The higher the sensitivity, the worse the ability of the server cluster to remain stable after being attacked, and the lower the sensitivity, the better the ability of the server cluster to remain stable after being attacked. When the sensitivity is greater than or equal to the preset sensitivity, the key is updated according to the first rotation period; when the sensitivity is less than the preset sensitivity, the key is updated according to the second rotation period, and the duration of the first rotation period is less than the duration of the second rotation period. For example, the first rotation period can be rotated once every minute, or the key can be generated in real time for update, and the second rotation period can be rotated once every thirty minutes.

[0051] For example, assuming that the first rotation period is 1 minute and the second rotation period is 1 hour, if the electronic device determines that the sensitivity of the server cluster is greater than the preset sensitivity, the electronic device rotates the key once every 1 minute; if the electronic device determines that the sensitivity of the server cluster is less than the preset sensitivity, the electronic device rotates the key once every 1 hour.

[0052] Exemplarily, the sensitivity of a server cluster can be determined by: obtaining network information, which may include the number of attacks on the server cluster, the response time, etc.; when the number of attacks on the server cluster increases, if the response time also increases, it can be determined that the sensitivity of the server cluster is high.

[0053] Optionally, the keys can be rotated in the following manner: a key pool is generated, which may include multiple pre-generated keys; according to the rotation period, the electronic device can randomly obtain a target key from the key pool, and apply the target key to the communication encryption between the cluster server and the client; for multiple keys in the key pool, the validity period of the multiple keys can be checked, and when the validity period of any key exceeds the preset validity period, the key is deleted.

[0054] For example, assuming that the key pool includes key 1, key 2 and key 3, and the rotation period is 1 minute, when the client requests communication, the electronic device can randomly select key 1 as the target key from the key pool, and after a rotation period of 1 minute, randomly select key 2 as the target key.

[0055] Next, combine Figure 3, through specific examples, the process of encrypted communication is explained.

[0056] Figure 3 For a schematic diagram of the encrypted communication process provided in the embodiment of this application, please see Figure 3 When encrypted communication is required, a session can be established first, for example, between a client and a server cluster. Key negotiation can then be performed, synchronizing the negotiated key to both parties in the session. Subsequent communication processes can be encrypted and transmitted according to the negotiated key. The encrypted communication process also includes key management. Specifically, key management can include rotating keys within a key pool according to a rotation period. The rotation period can also be dynamically adjusted based on the sensitivity of the server cluster. Keys that exceed a preset validity period will be destroyed. In response to the key destruction process, a new key can be generated according to a preset key generation algorithm and stored in the key pool.

[0057] The risk level of the client can be determined in the following manner: obtaining behavior information, which may include the client's Internet Protocol address location, the frequency of requests to access the server cluster, the application interface call sequence, etc.; performing feature vector extraction processing on the behavior information to obtain a behavior feature vector. For example, assuming that the behavior information includes the Internet Protocol address location, the frequency of requests to access the server cluster, and the application interface call sequence, then the Internet Protocol address location can be converted into a geographic location code, the frequency of requests to access the server cluster can be converted into a frequency value, the application interface call sequence can be represented by a word vector, and then the geographic location code, frequency value, and word vector are subjected to feature vector processing to obtain a behavior feature vector; inputting the obtained behavior feature vector into a preset risk assessment model, and receiving the risk level output by the risk assessment model. The higher the risk level, the higher the possibility that the client is at risk of attack and / or has potential risks. The risk assessment model can be a long short-term memory network model.

[0058] S203: Determine the security policy of the client based on the rotation cycle and risk level.

[0059] The client's security policy may include encryption policy and authentication policy.

[0060] The encryption policy may refer to an encryption method for data transmitted between a client and a cluster server. For example, the encryption policy may include a symmetric encryption algorithm, a public key encryption algorithm, and the like.

[0061] The authentication policy may refer to a policy used by an electronic device to authenticate the identity of a client.

[0062] The encryption strategy of the client can be determined in the following manner: obtain the data type accessed by the client, which may include message type, image type, document type, etc.; determine the first encryption strategy based on the rotation period, specifically, the shorter the rotation period, the higher the required security encryption level, and the longer the rotation period, the lower the required security encryption level; determine the second encryption strategy based on the data type, specifically, different encryption strategies can be used for different data types to improve processing efficiency. For example, assuming that the data type is a message type, a symmetric encryption strategy can be used for encryption; compare the first encryption strategy and the second encryption strategy to determine the encryption strategy of the client, wherein the encryption strategy can be determined based on the preset weights of the first encryption strategy and the second encryption strategy.

[0063] The client's authentication policy can be determined as follows: a risk level is obtained; if the risk level is less than a preset threshold, the authentication policy is determined to be to perform a first authentication on the client, and if the authentication result of the first authentication is "authentication passed," the client is determined to have passed the authentication. The first authentication can be used to verify the client's identity information; if the risk level is greater than or equal to the preset threshold, the authentication policy can be determined to be to perform a first authentication on the client, and if the authentication result of the first authentication is "authentication passed," the client is performed a second authentication on the client, and if the authentication result of the second authentication is "authentication passed," the client is determined to have passed the authentication. The preset threshold can be a value preset by the user.

[0064] Optionally, the second authentication may be a verification code authentication. For example, the electronic device may send a verification code to a preset terminal device corresponding to the client, and receive a second authentication result sent by the preset terminal device.

[0065] In an embodiment of the present application, when a server cluster needs to be managed, network information and behavioral information of clients accessing the server cluster can be obtained, wherein the network information can refer to the frequency of attacks on the server cluster, and the behavioral information of the client can refer to the network location of the client, the request frequency, etc.; based on the network information, the key rotation period can be determined, and based on the behavioral information, the risk level of the client can be determined, wherein the key rotation period can refer to the time interval between key updates or replacements, and the risk level of the client can be used to describe the possibility that the client is at risk of being attacked; based on the rotation period and the risk level, the client's security policy can be determined, wherein the client's security policy can include an encryption policy and an authentication policy, wherein the encryption policy can refer to the encryption method for data transmitted between the client and the cluster server, and the encryption policy can be determined based on the type of data accessed by the client and the rotation period, and the authentication policy can refer to the policy for electronic devices to authenticate the client's identity, and the client's authentication policy can be determined based on the risk level. In this way, compared with the static security policy method, this solution can dynamically determine and adjust the network security policy of the client accessing the server cluster by analyzing the network information and the client's behavioral information, thereby better defending against various network attacks and improving the security of the system.

[0066] Based on any of the above embodiments, Figure 3 , the process of multi-indicator collection and monitoring is explained in detail.

[0067] Figure 4 This is a schematic diagram of the multi-indicator acquisition and monitoring process provided in the embodiment of this application. Figure 4 , the method may include:

[0068] S401: Obtain resource usage rates for a historical period.

[0069] The resource utilization rate in a historical period may refer to the utilization rate of resources in the server cluster during the historical period, where the resources of the server cluster may include memory resources, central processing unit resources, etc. The resources of the server cluster in each historical period may be stored in a preset database, which may be a time series database.

[0070] S402: Predict resource utilization rates in future time periods based on resource utilization rates in historical time periods.

[0071] The resource utilization rate in the future period may refer to a possible resource utilization rate in the future period predicted based on the resource utilization rate in the historical period and the resource prediction model.

[0072] The historical period and future period can refer to user-defined values. For example, the historical period can refer to the past 7 days, and the future period can refer to the next 30 minutes. It is understood that the length of the historical period can be longer than the length of the future period to ensure higher accuracy of prediction for the future period.

[0073] The resource prediction model may refer to a prediction model pre-trained by a user. For example, the resource prediction model may refer to a long short-term memory network model.

[0074] S403: Obtain the current resource usage rate, and determine whether the current resource usage rate is greater than the resource usage rate in the future period.

[0075] If so, execute S404.

[0076] If not, execute S405.

[0077] S404: Scale down the current resource configuration.

[0078] If the current resource usage rate is greater than the resource usage rate in the future period, it may indicate that the resource usage demand in the future period may decrease. In order to avoid the waste of server cluster resources, the current resource configuration can be scaled down.

[0079] Scaling may refer to scaling down the resources of a server cluster based on predicted resource usage in future time periods.

[0080] S405: Expand the current resource configuration.

[0081] If the current resource usage rate is less than or equal to the resource usage rate in the future period, it may indicate that the resource usage demand in the future period may increase. In order to avoid the performance bottleneck problem of server cluster resources, the current resource configuration can be expanded.

[0082] Capacity expansion may refer to expanding the resources of a server cluster based on predicted resource usage in future time periods.

[0083] Optionally, if the current resource utilization rate is equal to the resource utilization rate in the future period, the current resource configuration may not be adjusted. Alternatively, the current resource configuration may be expanded to prevent problems such as inaccurate predictions or resource demand explosion.

[0084] Optionally, after the current resource configuration is expanded or reduced, it also includes: obtaining the actual resource utilization rate after the expansion or reduction process, performing error prediction processing on the actual resource utilization rate and the predicted resource utilization rate in the future time period to obtain a prediction error; if the prediction error is greater than or equal to a preset error value, the resource prediction model is corrected and the resource configuration is dynamically corrected.

[0085] Next, combine Figure 5 ,Through a specific interactive schematic diagram, the resource allocation adjustment process is ,explained.

[0086] Figure 5 For an interactive diagram of the resource configuration adjustment process provided in the embodiment of this application, please see Figure 5 ,include:

[0087] S11. The preset database sends the resource usage rate of the historical period to the resource prediction model.

[0088] S12. The resource prediction model sends the predicted resource usage rate for the future period to the electronic device.

[0089] S13. The electronic device requests a preset database to obtain actual resource usage.

[0090] S14. The preset database sends the actual resource usage rate to the resource prediction model.

[0091] S15. The resource prediction model sends the dynamically corrected resource configuration to the electronic device.

[0092] S406: Obtain the running status of the components of the server cluster.

[0093] The running status of a component may include the component's service response time, error rate, etc.

[0094] S407: Predict component failure information based on the operating status.

[0095] Failure information is used to indicate whether a component will fail in the future.

[0096] Failure information can indicate the probability of a component failing in a future period.

[0097] The fault information of a component can be predicted in the following ways: obtaining the operating status of the component and performing preset value analysis on multiple operating statuses. The preset value analysis can be used to determine whether the operating status exceeds the preset value; if it exceeds the preset value, it indicates that the component may have an operating problem and an early warning information is generated; if it does not exceed the preset value, the operating status of the component is analyzed using an anomaly detection algorithm to obtain fault information.

[0098] Among them, the operating status may refer to the utilization rate of the central processing unit, the memory utilization rate, the network bandwidth, etc.; the preset anomaly detection algorithm may refer to statistics-based anomaly detection, machine learning-based anomaly detection, time series-based anomaly detection, etc.

[0099] S408: When the fault information indicates that a component will fail in a future period, generate warning information.

[0100] It should be noted that the above embodiment does not limit the execution order between steps S401-S406 and steps S407-S408, that is, steps S401-S406 can be executed first, and then steps S407-S408; steps S407-S408 can be executed first, and then steps S401-S406; or steps S401-S406 and steps S407-S408 can be executed simultaneously.

[0101] exist Figure 4 In the embodiment shown, when it is necessary to perform multi-indicator collection and monitoring of the server cluster, the resource utilization rate of the historical time period can be obtained, and the resource utilization rate of the future time period can be predicted through a resource prediction model based on the resource utilization rate of the historical time period; if the current resource utilization rate is greater than the resource utilization rate of the future time period, it can indicate that the resource utilization demand in the future time period may decrease. In order to avoid the waste of server cluster resources, the current resource configuration can be scaled down; if the current resource utilization rate is less than or equal to the resource utilization rate of the future time period, it can indicate that the resource utilization demand in the future time period may increase. In order to avoid the performance bottleneck problem of the server cluster resources, the current resource configuration can be expanded; the operating status of the components of the server cluster is obtained, and the fault information is used to indicate whether the component will fail in the future time period. When the fault information indicates that the component will fail in the future time period, an early warning message is generated. In this way, through multi-indicator collection and monitoring, the operating status of the components of the server cluster can be monitored in real time, so that potential faults can be discovered in time and early warning signals can be issued, thereby improving the security of the system; at the same time, by predicting the resource utilization rate in future time periods, the resources of the server cluster can be dynamically allocated according to the utilization rate, thereby avoiding the waste of server cluster resources and the performance bottleneck of the server cluster, reducing operating costs while improving resource utilization.

[0102] Based on any of the above embodiments, Figure 6 , which explains in detail the process of electing the master node in the server cluster.

[0103] Figure 6 This is a schematic diagram of the process of selecting a master node in a server cluster provided in this application embodiment. Figure 6 , the method may include:

[0104] S601: Obtain the running status of the master node.

[0105] The electronic device can monitor the operating status of the master node in the server cluster according to a preset period.

[0106] Optionally, the operating status of the master node can be obtained through a heartbeat detection monitoring method. The electronic device can send a heartbeat packet to the master node according to a preset period and determine whether the master node can respond normally. If it can respond normally, it can be determined that the operating status of the master node is normal. If it cannot respond normally, it can be determined that the operating status of the master node is abnormal, that is, the master node has failed.

[0107] S602: When the running status indicates that the master node is failed, obtain node information of at least one slave node.

[0108] Node information may include the node's health status, current load, responsiveness, and resource utilization. Resource utilization may include memory, network bandwidth, and CPU resource utilization.

[0109] S603: Determine the node reliability corresponding to each slave node according to the node information of at least one slave node.

[0110] You can determine whether a node is reliable by analyzing the node information.

[0111] For example, for any slave node, based on the response capability of the node information, if the response delay is lower, it means that the node has a faster response speed and higher reliability; based on the current load of the node information, if the current load is low, it means that the node may have sufficient resources to process tasks as a master node and has higher reliability; based on the health status of the node information, if the node has a low failure rate and high stability in the historical period, it can be said that the node has higher reliability.

[0112] S604: Determine the target slave node.

[0113] A target slave node is determined among the at least one slave node, wherein the target slave node has the highest node reliability.

[0114] The target slave node may be determined by obtaining the reliability corresponding to at least one slave node, sorting the reliabilities in descending order, and determining the slave node corresponding to the reliability ranked first as the target slave node.

[0115] S605: Send a target request to the target slave node.

[0116] The target request can be used to request the target slave node to initiate re-election of the master node.

[0117] The target request may include information about master node failure, requirements for a new master node, election rules, etc.

[0118] S606: Receive the master node re-election result sent by the target slave node, and determine the target slave node as the new master node.

[0119] The re-election result can be used to indicate the information of the new master node.

[0120] The re-election results may include the serial number, identity information, Internet Protocol address, etc. of the new master node.

[0121] Optionally, after receiving the target request, the target slave node may elect a master node from at least one slave node through a consensus algorithm.

[0122] S607: Synchronize the log file to the target slave node.

[0123] The log file can be a write-ahead log, which can ensure the consistency of the log even after the node fails.

[0124] The log file may include update data, a timestamp of the update data, and the like.

[0125] Next, combine Figure 7 , through a specific interactive diagram, the process of electing the master node in the server cluster is explained.

[0126] Figure 7 For an interactive diagram of the process of electing a master node in a server cluster provided in this application embodiment, see Figure 7 Assume that the server cluster includes nodes A, B, and C, where node A is the master node and nodes B and C are slave nodes. The process of electing the master node may include:

[0127] S21. The electronic device obtains the operating status of node A (master node).

[0128] S22. Node A feeds back the operating status to the electronic device.

[0129] S23: Node A fails, that is, node A cannot feedback the operating status to the electronic device.

[0130] S24. The electronic device sends a target request to node B (target slave node). The target request can be used to request the target slave node to initiate re-election of the master node.

[0131] S25. Node B sends an election request to node C.

[0132] S26. Node C sends an election response to node B.

[0133] S27. Node B sends a re-election result to the electronic device, where the re-election result indicates that Node B is the newly elected master node.

[0134] S28, the electronic device synchronizes logs to node B (new master node). Figure 6In the illustrated embodiment, the operating status of the master node can be obtained. When the operating status indicates that the master node has failed, the node information of at least one slave node can be obtained. The node information can include the node's health status, current load, response capability, and resource utilization. Based on the node information of at least one slave node, the node reliability corresponding to each slave node is determined. Among the at least one slave node, a target slave node is determined, wherein the target slave node has the highest node reliability. A target request is sent to the target slave node, and the target request can be used to request the target slave node to initiate a re-election of the master node. The re-election result of the master node sent by the target slave node is received, and the target node is determined as the new master node. The log synchronization status of the new master node is obtained, and an alarm is generated when the log synchronization status is abnormal. In this way, by monitoring the operating status of the master node, the problem of master node failure can be quickly discovered, and the target slave node with the highest reliability can be selected from the slave nodes in a timely manner. An election is initiated among the slave nodes through a consistency algorithm, and the target node is determined as the new master node based on the election result. The new master node quickly responds and takes over the cluster through log synchronization, thereby ensuring the stability of the server cluster.

[0135] Based on any of the above embodiments, Figure 8 , which explains in detail the process of updating cache data in the server cluster.

[0136] Figure 8 This is a schematic diagram of the server cluster cache data update process provided in this application embodiment. Figure 8 , the method may include:

[0137] S801: Get the first number of requests to search for data in the cache.

[0138] Cache can refer to the cache space of a server cluster.

[0139] S802: Obtain a second number of times the requested data is found in the cache.

[0140] The second number may refer to the number of times the data requested by the client exists in the cache, that is, the number of cache hits.

[0141] It should be noted that the above embodiment does not limit the execution order between step S801 and step S802, that is, step S801 can be executed first, and then step S802; step S802 can be executed first, and then step S801; or step S801 and step S802 can be executed simultaneously.

[0142] S803: Determine the cache hit rate, where the hit rate is the ratio of the second number to the first number.

[0143] The cache hit rate can be used to refer to the probability of a cache hit, and the cache hit rate can also be used to indicate the level of cache performance.

[0144] It can be understood that the higher the cache hit rate, the higher the cache performance, that is, most of the client's requests can obtain data directly from the cache, reducing the burden of re-downloading data; the lower the cache hit rate, the lower the cache performance, that is, most of the client's requests cannot obtain data directly from the cache, thereby increasing the burden of re-downloading data and making data acquisition efficiency lower.

[0145] S804: When the hit rate is less than or equal to the first threshold, obtain the first data and the second data.

[0146] The first data is data whose access frequency is greater than the second threshold, that is, the first data may be hot data with a high access frequency.

[0147] The second data is associated with the key configuration, that is, the second data may be data related to the key configuration, for example, the second data may be system configuration data, business data, etc.

[0148] The first threshold and the second threshold may be values ​​preset by the user. For example, the first threshold may be 70%, and the second threshold may be 100 times.

[0149] S805: Store the first data and the second data in a cache.

[0150] Before storing the first data and the second data in the cache, the method further includes: obtaining multiple cache data cached in the cache, and determining access frequencies corresponding to the multiple cache data respectively; determining target cache data among the multiple cache data, wherein the access frequency corresponding to the target cache data is less than or equal to a second threshold; and deleting the target cache data from the cache.

[0151] Before storing the first data and the second data in the cache, the method further includes: first storing the first data and the second data in a hotspot database, and then sharding the cache data in the hotspot database into multiple storage nodes through a consistency algorithm, wherein the consistency algorithm can be a consistent hash algorithm.

[0152] Sharded storage can be performed in the following manner: for any storage node, the storage node will generate a first hash value through a hash algorithm based on the identification of the storage node, and the electronic device will place the storage node on the corresponding hash ring according to the first hash value, wherein the hash ring includes multiple hash values, and the multiple hash values ​​are arranged in a clockwise manner to form a logical ring structure; for any cached data in the hotspot database, the cached data will generate a second hash value through a hash algorithm, and the corresponding target storage node will be determined on the hash ring according to the second hash value, and the cache will be stored in the target storage node.

[0153] For example, assuming that there are storage node A, storage node B, storage node C and cache data D, where storage node A generates a first hash value of 5 through a hash algorithm, storage node B generates a first hash value of 10 through a hash algorithm, storage node C generates a first hash value of 25 through a hash algorithm, and cache data D generates a second hash value of 10 through a hash algorithm, then it can be determined that the corresponding target storage node on the hash ring is storage node B, and the cache data D is stored in storage node B; optionally, assuming that there is also cache data E, and cache data E generates a second hash value of 22 through a hash algorithm, then the storage node closest to the second hash value on the hash ring is storage node C, then the target storage node can be determined to be storage node C, and the cache data E is stored in storage node C.

[0154] exist Figure 8 In the embodiment shown, when it is necessary to update the cache data of the server cluster, the first number of requests to find data in the cache and the second number of times the requested data is found in the cache can be obtained. The second number can refer to the number of times the data requested by the client exists in the cache, that is, the number of cache hits. The cache hit rate is determined based on the first number and the second number. The hit rate is the ratio of the second number to the first number. The higher the cache hit rate, the higher the cache performance, and the lower the cache hit rate, the lower the cache performance. When the hit rate is less than or equal to a first threshold, the first data and the second data are obtained. The first data can be hot data with a high access frequency, and the second data can be data related to key configurations. The first data and the second data are stored in the cache. In this way, when the current cache hit rate is less than or equal to the first threshold, that is, when the cache performance is poor, the cache is updated and the hot data and key configuration data are stored in the cache. At the same time, the access frequency of the cached data in the cache can be verified, and the data with a low access frequency can be deleted from the cache, thereby improving the performance and efficiency of the cache.

[0155] Based on any of the above embodiments, Figure 9 , which provides a detailed description of the overall management process of the server cluster.

[0156] Figure 9 This is a schematic diagram of the overall management of the server cluster provided in this application embodiment. Figure 9 , including: dynamic security policy module, multi-indicator collection and monitoring module, distributed cluster module and hierarchical cache module. Among them, the dynamic security policy module can perform behavioral analysis based on the client's behavioral information to determine the key rotation cycle and risk level, and then determine the authentication strategy and encryption strategy based on the rotation cycle and risk level. The server cluster can communicate according to the encryption strategy; the monitoring agent in the multi-indicator acquisition and monitoring module can obtain the behavioral information collected by the dynamic security policy module, as well as the component operation status, resource utilization rate of historical periods and other information. The monitoring agent can store the resource utilization rate of historical periods in a preset database and input it into the resource prediction model, and adjust the resource configuration based on the output future resource utilization rate. The monitoring agent can also predict faults based on behavioral information and operation status, and generate early warning information in a timely manner; the distributed cluster module includes a master node and multiple slave nodes. The master node can receive the security policy issued by the dynamic security policy module, and can also receive resource configuration adjustment information. The master node and multiple slave nodes are synchronized through consistency algorithms, write-ahead logs, encryption strategies, etc.; the layered cache module can receive configuration updates sent by the master node, and store hot data and key data in multiple storage nodes through sharded storage.

[0157] A server cluster management device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0158] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0159] Figure 10 This is a schematic diagram of the structure of the server cluster management device provided in the embodiment of the present application. Figure 10 As shown, the embodiment of the present application further provides a server cluster management device 10, comprising: an acquisition module 11, a first determination module 12 and a second determination module 13, wherein:

[0160] The acquisition module 11 is used to obtain network information and behavior information of clients accessing the server cluster, where the network information is used to indicate the frequency of attacks on the server cluster;

[0161] The first determination module 12 is used to determine the key rotation period based on the network information and determine the risk level of the client based on the behavior information;

[0162] The second determining module 13 is used to determine the security policy of the client according to the rotation cycle and the risk level.

[0163] A server cluster management device provided in an embodiment of the present application can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0164] In one possible design, the second determining module 13 is specifically configured to:

[0165] Get the data type accessed by the client;

[0166] Determine encryption strategy based on rotation cycle and data type;

[0167] Determine the client's authentication strategy based on the risk level. The security strategy includes encryption strategy and authentication strategy.

[0168] In one possible design, the second determining module 13 is specifically configured to:

[0169] If the risk level is less than the preset threshold, the authentication strategy is determined to be to perform a first authentication on the client, and when the authentication result of the first authentication is passed, the client is determined to be authenticated, and the first authentication is used to verify the identity information of the client;

[0170] If the risk level is greater than or equal to the preset threshold, the authentication strategy is determined to perform a first authentication on the client, and when the authentication result of the first authentication is passed, a second authentication is performed on the client, and when the authentication result of the second authentication is passed, it is determined that the client has passed the authentication.

[0171] In one possible design, the first determining module 12 is specifically configured to:

[0172] Determine the sensitivity of the server cluster based on network information. Sensitivity is used to indicate the ability of the server cluster to remain stable after being attacked.

[0173] If the sensitivity is greater than or equal to the preset sensitivity, the key is updated according to the first rotation period;

[0174] If the sensitivity is less than the preset sensitivity, the key is updated according to the second rotation period, and the duration of the first rotation period is less than the duration of the second rotation period.

[0175] Figure 11 This is a schematic diagram of the structure of another server cluster management device provided in an embodiment of the present application. Figure 10 Based on the examples shown, see Figure 11The server cluster management device 10 further includes: a prediction module 14, an election module 15 and a cache module 16, wherein:

[0176] The prediction module 14 is used to obtain resource usage rates in historical periods;

[0177] Based on the resource utilization rate in the historical period, predict the resource utilization rate in the future period;

[0178] Process the current resource configuration based on the resource utilization rate in the future period.

[0179] In one possible design, the prediction module 14 is specifically configured to:

[0180] Get the current resource usage;

[0181] If the current resource usage rate is less than or equal to the resource usage rate in the future period, the current resource configuration will be expanded;

[0182] If the current resource usage is greater than the resource usage in the future period, the current resource configuration will be scaled down.

[0183] In one possible design, the prediction module 14 is specifically configured to:

[0184] Get the running status of the components of the server cluster;

[0185] Predict component failure information based on operating status. Failure information is used to indicate whether a component will fail in the future.

[0186] When the fault information indicates that a component will fail in a future period, a warning message is generated.

[0187] The election module 15 is used to obtain the running status of the master node;

[0188] When the running status indicates that the master node has failed, determining a target slave node from at least one slave node and sending a target request to the target slave node, the target request being used to request the target slave node to initiate a re-election of the master node;

[0189] Receive the master node re-election result sent by the target slave node.

[0190] In a possible design, the election module 15 is specifically used to:

[0191] Obtain node information of at least one slave node;

[0192] Determining node reliability corresponding to each slave node based on node information of at least one slave node;

[0193] Determine the target slave node, which has the highest node reliability.

[0194] In a possible design, the election module 15 is specifically used to:

[0195] When the re-election result indicates that the target slave node is the re-elected master node, obtaining a log file, wherein the log file includes update data and a timestamp of the update data;

[0196] Synchronize the log file to the target slave node.

[0197] The cache module 16 is used to:

[0198] Get the first time a request looks for data in the cache;

[0199] Gets the second number of times the requested data was found in the cache;

[0200] Based on the first number and the second number, the cache is managed.

[0201] In one possible design, the cache module 16 is specifically configured to:

[0202] Determine the cache hit rate, which is the ratio of the second number to the first number;

[0203] When the hit rate is less than or equal to a first threshold, acquiring first data and second data, a frequency of access of the first data is greater than a second threshold, and the second data is associated with a key configuration;

[0204] The first data and the second data are stored in a cache.

[0205] Figure 12 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 12 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the electronic device 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus.

[0206] During the specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502 , so that the at least one processor 501 executes the above-mentioned embodiment of the method for managing a server cluster.

[0207] The specific implementation process of the processor 501 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0208] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the application may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0209] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0210] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0211] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above-mentioned server cluster management method embodiments when running.

[0212] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0213] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned server cluster management method embodiments are implemented.

[0214] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned server cluster management method embodiments are implemented.

[0215] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0216] The above is a detailed introduction to the server cluster management method, electronic device, storage medium and program product provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for managing a server cluster, characterized in that: include: Acquire network information and behavior information of clients accessing the server cluster, wherein the network information is used to indicate the frequency of attacks on the server cluster; Determining a key rotation period based on the network information, and determining a risk level of the client based on the behavior information, wherein the behavior information is used to indicate operation data of the client; wherein the risk level of the client is used to describe the possibility that the client is at risk of being attacked; wherein the risk level of the client is obtained by performing feature vector extraction processing on the behavior information to obtain a behavior feature vector, and inputting the behavior feature vector into a preset risk assessment model; Determining a security policy for the client based on the rotation period and the risk level; wherein the security policy includes an encryption policy and an authentication policy; Determining a key rotation period according to the network information includes: Determining the sensitivity of the server cluster based on the network information, where the sensitivity indicates the ability of the server cluster to remain stable after being attacked; wherein the network information includes the number of attacks on the server cluster and the response time; If the sensitivity is greater than or equal to the preset sensitivity, updating the key according to the first rotation period; If the sensitivity is less than the preset sensitivity, updating the key according to a second rotation period, where the duration of the first rotation period is less than the duration of the second rotation period; Determining a security policy for the client based on the rotation period and the risk level includes: Obtaining the type of data accessed by the client; Determining an encryption strategy according to the rotation period and the data type; Determining an authentication policy for the client according to the risk level, the security policy including the encryption policy and the authentication policy; The method further comprises: Get resource usage for historical periods; Predicting resource utilization rates in future time periods based on resource utilization rates in the historical time periods; Processing the current resource configuration according to the resource utilization rate in the future period; The server cluster includes a master node and at least one slave node, and the method further includes: Get the running status of the master node; When the operating status indicates that the master node has failed, obtaining node information of the at least one slave node; determining a node reliability corresponding to each slave node based on the node information of the at least one slave node; determining a target slave node, the target slave node having the highest node reliability, and sending a target request to the target slave node, the target request being used to request the target slave node to initiate re-election of the master node; Receiving a master node re-election result sent by the target slave node; The method further comprises: Get the first time a request looks for data in the cache; Obtain a second number of times the requested data is found in the cache; The cache is managed based on the first number of times and the second number of times.

2. The method according to claim 1, characterized in that Determining an authentication strategy for the client based on the risk level includes: If the risk level is less than a preset threshold, determining that the authentication strategy is to perform a first authentication on the client, and determining that the client has passed the authentication when the authentication result of the first authentication is passed, wherein the first authentication is used to verify the identity information of the client; If the risk level is greater than or equal to the preset threshold, the authentication strategy is determined to be to perform the first authentication on the client, and when the authentication result of the first authentication is passed, the second authentication is performed on the client, and when the authentication result of the second authentication is passed, it is determined that the client has passed the authentication.

3. The method according to claim 1, characterized in that The processing of the current resource configuration according to the resource usage rate in the future time period includes: Get the current resource usage; If the current resource usage rate is less than or equal to the resource usage rate in the future time period, then expanding the current resource configuration; If the current resource usage rate is greater than the resource usage rate in the future time period, the current resource configuration is scaled down.

4. The method according to any one of claims 1 to 2, characterized in that The method further comprises: Obtaining the operating status of components of the server cluster; Predicting fault information of the component based on the operating status, the fault information being used to indicate whether the component will fail in a future period; When the fault information indicates that the component will fail in a future period, early warning information is generated.

5. The method according to claim 1, characterized in that After receiving the master node re-election result sent by the target slave node, the method further includes: When the re-election result indicates that the target slave node is the re-elected master node, obtaining a log file, wherein the log file includes update data and a timestamp of the update data; Synchronize the log file to the target slave node.

6. The method according to claim 5, characterized in that Managing the cache based on the first number and the second number includes: Determining a hit rate of the cache, the hit rate being a ratio of the second number to the first number; When the hit rate is less than or equal to a first threshold, acquiring first data and second data, where a frequency of access of the first data is greater than a second threshold, and the second data is associated with a key configuration; The first data and the second data are stored in the cache.

7. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the server cluster management method according to any one of claims 1 to 6 when executing the computer program.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the server cluster management method according to any one of claims 1 to 6 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the server cluster management method according to any one of claims 1 to 6 are implemented.

Images