A network security access method and device for a large model task, an apparatus, and a medium

Abstract

The method comprises the following steps: receiving a target access request, wherein the target access request comprises current access user information; in response to determining that the sending device of the target access request is an authorized device or that the current access user is an authorized user based on the current access user information, sending the target access request to a target container group, wherein the target container group is used to execute a large model task; collecting access logs of the target access request through a trusted log platform, and sending the access logs to a user corresponding to the target container group. The method of the present disclosure allows only authorized devices or authorized users to access the container group, prevents unauthorized access by relevant personnel, effectively improves the security of model task processing, and records and transmits the access logs to the user through the trusted log platform, thereby realizing traceable safe operation.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer technology, and particularly relates to a network security access method and device for a large model task, equipment and a medium. BACKGROUND

[0002] In a cloud computing scenario, a cloud server of model as a service (MaaS) can provide a large model as a service to a user, and the user hopes that a container group (pod) of a model-related task of the user runs in an isolated network environment to ensure security. Related personnel may log in to the container group of the user to obtain some data for inference or fine-tuning without authorization, resulting in low security of model task processing of the user. In related technologies, part of the access is shielded through network isolation at a task level, but the effect is not good and needs to be improved. SUMMARY

[0003] To solve the above technical problems, the present disclosure provides a network security access method, device, equipment and medium for a large model task.

[0004] The present disclosure provides a network security access method for a large model task, which comprises the following steps:

[0005] receiving a target access request, wherein the target access request comprises current access user information;

[0006] In response to determining that the sending device of the target access request is an authorized device or determining that the current access user is an authorized user based on the current access user information, the target access request is sent to a target container group, wherein the target container group is used to execute a large model task;

[0007] Access logs of the target access request are collected through a trusted log platform, and the access logs are sent to a user corresponding to the target container group.

[0008] The present disclosure also provides a network security access device for a large model task, which comprises:

[0009] a receiving module configured to receive a target access request, wherein the target access request comprises current access user information;

[0010] a sending module configured to, in response to determining that the sending device of the target access request is an authorized device or determining that the current access user is an authorized user based on the current access user information, send the target access request to a target container group, wherein the target container group is used to execute a large model task;

[0011] A log module is configured to collect an access log of the target access request through a trusted log platform, and send the access log to a user corresponding to the target container group.

[0012] The electronic device includes a processor, a memory for storing executable instructions of the processor, and the processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the network security access method for the large model task provided by the embodiments of the present disclosure.

[0013] The electronic device includes a processor, a memory for storing executable instructions of the processor, and the processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the network security access method for the large model task provided by the embodiments of the present disclosure.

[0014] The technical solution provided by the embodiments of the present disclosure has the following advantages compared with the prior art: the network access solution provided by the embodiments of the present disclosure receives a target access request, wherein the target access request includes current access user information; in response to determining that the sending device of the target access request is an authorized device or determining that the current access user is an authorized user based on the current access user information, the target access request is sent to a target container group, wherein the target container group is used to execute a large model task; an access log of the target access request is collected through a trusted log platform, and the access log is sent to a user corresponding to the target container group. By using the above technical solution, for the received access request, if it is determined that the sending device of the access request is an authorized device or the access user is an authorized user, the access to the container group is allowed, and the access log is collected through the trusted log platform and sent to the user of the container group, which realizes that only the authorized device or the authorized user can access the container group for executing the large model task, prevents unauthorized access by relevant personnel, effectively improves the security of the large model task processing, and realizes safe operation with traceability by recording and transmitting the access log to the user through the trusted log platform. BRIEF DESCRIPTION OF DRAWINGS

[0015] The above and other features, advantages, and aspects of the embodiments of the present disclosure will become more apparent by describing in detail the following specific embodiments with reference to the attached drawings. Throughout the drawings, the same or similar reference numerals refer to the same or similar elements. It should be understood that the drawings are schematic, and the original and elements are not necessarily drawn to scale.

[0016] Figure 1 A flowchart of a network security access method for a large model task provided by some embodiments of the present disclosure;

[0017] Figure 2 Another flowchart of a network security access method for a large model task provided by some embodiments of the present disclosure;

[0018] Figure 3 A schematic diagram of a network access procedure provided for some embodiments of the present disclosure;

[0019] Figure 4 A schematic diagram of a logging procedure provided for some embodiments of the present disclosure;

[0020] Figure 5 A schematic diagram of an architecture of a control plane provided for some embodiments of the present disclosure;

[0021] Figure 6 A schematic diagram of a structure of a network security access device for a large model task provided for some embodiments of the present disclosure;

[0022] Figure 7 A schematic diagram of a structure of an electronic device provided for some embodiments of the present disclosure. DETAILED DESCRIPTION

[0023] Embodiments of the present disclosure will be described in more detail with reference to the drawings. While certain embodiments of the present disclosure will be shown and described below, it is to be understood that the present disclosure can be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and fully convey the scope of the present disclosure to those skilled in the art.

[0024] It should be understood that various steps in the method embodiments of the present disclosure can be performed in different sequences and / or in parallel. In addition, the method embodiments can include additional steps and / or omit performing the steps shown. The scope of the present disclosure is not limited in this regard.

[0025] The term "comprising" and variations thereof as used herein are used inclusively, i.e., "comprising but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment." The term "another embodiment" means "at least one additional embodiment." The term "some embodiments" means "at least some embodiments." Related definitions will be given in the description of the application below.

[0026] It should be noted that the terms "first", "second", and the like in the present disclosure are used only to distinguish different devices, modules or units, and do not imply the order of execution or the mutual dependency of the functions performed by these devices, modules or units.

[0027] It should be noted that the terms "one", "multiple" in the present disclosure are illustrative and not restrictive, and those skilled in the art should understand that "one" or "multiple" should be understood as "one or more" unless otherwise explicitly indicated in the context.

[0028] The names of the messages or information exchanged between the plurality of devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0029] In a cloud computing scenario, model as a service as a cloud service end can provide cloud services to serve model entities of different model vendors. Specifically, the model as a service can undertake a large model of a model vendor, and then provide inference, fine-tuning and other services based on the large model. A user wants his own model related task to run in an isolated network environment.

[0030] If the relevant personnel can log in the container group at will, it may cause the user's data such as prompt words to be taken away or misused, or may damage the intended program behavior in the user's container group, and in serious cases may cause the service to be unavailable, resulting in low security of the user's model task processing. In the related art, part of the access is shielded by the network isolation at the task level, but the effect is not good and needs to be improved.

[0031] To solve the above problems, the present disclosure provides a network security access method for a large model task, which will be introduced below in combination with specific embodiments.

[0032] Figure 1 A flowchart of the network security access method for a large model task provided by some embodiments of the present disclosure is shown. The method can be executed by a network security access device for a large model task, which can be implemented by software and / or hardware, and can be integrated in an electronic device. As shown in Figure 1 The method comprises the following steps:

[0033] Step 101, receiving a target access request, wherein the target access request includes current access user information.

[0034] The network security access method for a large model task in the embodiments of the present disclosure can be executed by a cloud service platform of model as a service. The cloud service platform can provide cloud services for different models, and provide inference, fine-tuning and other services based on the models. The cloud service platform can manage the network access of the task corresponding container group of the model user.

[0035] The target access request can be a request for initiating network access to the target container group, and the target access request can come from other container groups or other devices, without limitation. The target access request can include current access user information, which can be specific information representing the current access user, for example, can include a user identifier, a user name, and the like of the current access user. The target container group can be a container group receiving network access, and the number of target container groups can be one or more, which is set according to actual conditions. The target container group is located in a container cluster management system, which can include multiple physical machines or virtual machines, referred to as nodes or hosts. One or more container groups can be set on one node or host. The target container group is used to execute a large model task. The large model task can include inference tasks and / or fine-tuning tasks of a large model, and the model of the embodiments of the present disclosure can be a large language model. The large language model can be a natural language-based processing model that can learn the rules and structures of natural language, understand the meaning of natural language, and generate coherent text with correct grammar and semantics according to the understood meaning, and even images or videos, etc. A container group can be the smallest scheduling unit in container technology. The container group can include one or more containers. Containers in the same container group share resources, and can execute model inference, model fine-tuning (Supervised Fine-Tuning, SFT), and the like in the container group. The container group can be used to execute model inference or model fine-tuning tasks of a user.

[0036] Specifically, when the current access user needs to access the target container group, the target access request carrying the current access user information can be sent to the network security access device of the large model task. The network security access device of the large model task can receive the target access request.

[0037] Step 102, in response to determining that the sending device of the target access request is an authorized device or that the current access user is an authorized user based on the current access user information, the target access request is sent to the target container group, wherein the target container group is used to execute a large model task.

[0038] The sending device can be a hardware device from which the current access user sends the target access request. The authorized device can be a device that has been authorized to allow access to the target container group. In the embodiments of the present disclosure, the authorized device can include a cluster bastion host of the container cluster management system where the target container group is located and a host and a host bastion host of the target container group. The authorized user can be a user who has been authorized to allow access to the target container group. The authorized user can be a relevant person who is used to maintain the target container group when needed.

[0039] Specifically, after receiving the target access request, the network security access device of the large model task can determine whether the target access request meets the access condition, that is, determine whether the sending device of the target access request is an authorized device, and determine whether the current access user corresponding to the current access user information is an authorized user. If one of the two determination steps is yes, that is, the sending device is an authorized device or the current access user is an authorized user, it is determined that access is allowed, and the target access request can be sent to the target container group for access.

[0040] In some embodiments, Figure 2 Another flowchart of a network security access method of a large model task provided by some embodiments of the present disclosure is shown in Figure 2 In a possible implementation, determining whether the target access request meets the access condition, that is, determining whether the sending device of the target access request is an authorized device or determining whether the current access user is an authorized user based on the current access user information, includes the following steps:

[0041] Step 201: Determine whether the sending device is the host of the target container group, the host bastion host, or the cluster bastion host corresponding to the management container group based on the access source information in the target access request. If yes, perform step 202; otherwise, perform step 203.

[0042] The access source information can be information representing the access source of the target access request, and the access source information can include information of a specific sending device of the access source. The bastion host can be an intermediate access device located between the container group to be accessed and the outside, used to control and record all access behaviors to and from the network, and ensure security. All accesses to the container group to be accessed must pass through the bastion host. The host of the target container group can be a node where the target container group is located in the container cluster management system. The host can allow access, for example, the host can be an Elastic Compute Service Virtual Machine (ECS VM). The host bastion host can be a bastion host between the host and the outside. The host bastion host of the target container group can be a bastion host between the host of the target container group and the outside, and can access the target container group through a Secure Shell (SSH) connection provided by the target container group. The cluster bastion host can be a bastion host between the management container group and the outside. The cluster bastion host can be used to access the management container group and other container groups through the management container group. The target container group only allows other container groups belonging to the same task to access, thereby realizing task-level network isolation. The management container group can be a container group in the container cluster management system for controlling network access of the container group. The management container group can belong to the same task as the target container group, and the task label of the management container group is a service label. The task label of each container group included in the container cluster management system can be considered to belong to the same task, so as to allow the management container group to access each container group.

[0043] Specifically, the network security access device of the large model task can extract access source information in the target access request, and determine a sending device according to the access source information. The access source information of different sending devices can be different. It is determined whether the sending device is the host of the target container group or the host bastion host, or whether the sending device is the cluster bastion host corresponding to the management container group. If yes, step 202 is performed. Otherwise, step 203 is performed.

[0044] The order of steps 201 and 203 is only an example in Figure 2 Steps 203 can be performed first, and then step 201 can be performed, or steps 201 and 203 can be performed in parallel.

[0045] In step 202, it is determined that the sending device of the target access request is an authorized device.

[0046] In step 202, it is determined that the sending device of the target access request is an authorized device.

[0047] Optionally, the authorized device forwards the target access request after determining that the current access user is an authorized user.

[0048] The authorized user set is stored in the authorized device, and after receiving the target access request, the current access user information can be matched in the authorized user set. If the current access user information is included in the authorized user set, it is determined that the matching is successful, and the target access request can be forwarded to the target container group; if the current access user information is not included in the authorized user set, it is determined that the matching fails, and the target access request will not be forwarded. Therefore, the access request from the authorized device can be considered as having passed the judgment to allow access to the container group, and it can be determined that the access condition is met.

[0049] Step 203, when the target access request comes from the system command line tool, determine whether the current access user information matches successfully in the authorized user set, if yes, execute step 204; otherwise, execute step 206.

[0050] The system command line tool can be a command line tool of a container cluster management system, allowing users to interact and manage the container groups in the container cluster management system. The authorized user set can be a set of one or more authorized users who have obtained the permission to access the container group, and each authorized user is set with an expiration time. When the time reaches the expiration time, the permission management system can delete the authorized user in the authorized user set, and the authorized user set can be updated by the permission management system, improving the flexibility of authorized user management.

[0051] Specifically, when the network security access device of the large model task determines that the target access request comes from the system command line tool according to the access source information, the current access user information can be matched in the authorized user set. If the current access user information is included in the authorized user set, it is determined that the matching is successful, and step 204 is executed; if the current access user information is not included in the authorized user set, it is determined that the matching fails, and it is determined that the current access user is not an authorized user, and step 206 is executed.

[0052] Step 204, determine that the current access user is an authorized user.

[0053] Step 205, determine that the target access request meets the access condition.

[0054] Step 206, determine that the target access request does not meet the access condition.

[0055] In the above scheme, whether to allow access to the container group is determined by determining whether the access source is an authorized device or the access user is an authorized user, and the user can only access the container group through authorization or through an authorized device. On the basis of technical control of network isolation at the task level, only the intended access path is directed, and other accesses are rejected, effectively improving the security of model task processing.

[0056] In step 103, the trusted log platform collects the access log of the target access request, and sends the access log to the user corresponding to the target container group.

[0057] The trusted log platform can be a log platform implemented based on trusted hardware. The trusted log platform is deployed in a trusted execution environment (Trusted Execution Environment, TEE) based on trusted hardware. The trusted execution environment (Trusted Execution Environment, TEE) is a secure area of device hardware or software, isolated from the main operating system, providing a trusted environment to execute sensitive or critical code and data. The security of TEE mainly comes from its isolation from the main operating system and hardware protection measures. TEE provides a secure execution environment in which the stored and executed code and data are protected. TEE itself is composed of special hardware in the processor, and some security protection mechanisms are used to prevent external tampering or theft of code and data in TEE. In addition, TEE does not allow ordinary applications to access the code and data therein, thereby improving the security of the system. The access log can be the log of all devices involved in the network access process of the target access request, including operation logs at various levels, such as the Infrastructure as a Service (IaaS) layer, the Platform as a Service (PaaS) layer (container cluster management system), and the MaaS layer.

[0058] In some embodiments, the trusted log platform collects the access log of the target access request, including: collecting, by the trusted log platform, the device log of the authorized device for the target access request, the container group log of the target container group, and the platform log of the associated platform of the target container group, and combining to obtain the access log.

[0059] The device log can be a log of the operation of the authorized device on the process of the target access request, and the authorized device records all accesses through screen recording. The container group log can be a log obtained by recording the specific access operation of the target container group on the target access request. The associated platform of the target container group can be another platform participating in the network access process of the target container group, and the platform log can be a platform-related log collected by the log collection degree.

[0060] Specifically, the network security access device of the large model task can collect the device log of the authorized device, the container group log of the target container group, and the platform log of the associated platform of the target container group through the trusted log platform for the access of the target container group for the target access request, combine to obtain the access log of the target access request, and can send the access log to the user of the target container group.

[0061] In the above scheme, the logs of network access operations at each level can be captured through the trusted log platform, so that the network access operations such as operation and maintenance operations cannot hide, full recording of the access process is achieved, and the operations that are not allowed are filtered out through analysis, in addition, the trusted log platform is deployed in the trusted execution environment based on trusted hardware, which can ensure that the related logs will not be maliciously tampered with, and the platform code is measured to ensure the trustworthiness of the related tasks.

[0062] The network access scheme provided by the embodiments of the present disclosure receives a target access request, wherein the target access request includes current access user information; in response to determining that the sending device of the target access request is an authorized device or determining that the current access user is an authorized user based on the current access user information, the target access request is sent to a target container group; the access log of the target access request is collected through a trusted log platform, and the access log is sent to the user corresponding to the target container group. By adopting the above technical scheme, for the received access request, if it is determined that the sending device of the access request is an authorized device or the access user is an authorized user, the access request is allowed to be sent to the container group, and the access log is collected through the trusted log platform and sent to the user of the container group, which realizes that only the authorized device or the authorized user can access the container group, prevents unauthorized access by relevant personnel, effectively improves the security of model task processing, and realizes safe operation and leaving traces by recording and transmitting the access log to the user through the trusted log platform.

[0063] Next, the network access scheme of the embodiments of the present disclosure will be further described through a specific example, Figure 3 The schematic diagram of the network access process provided by some embodiments of the present disclosure is as follows, Figure 3As shown, the container cluster management system can include a management container group, a container group A of task a and a container group B of task b, the target container group can be the container group A and / or the container group B, and taking the container group A as an example, the network access to the container group A can be controlled in the following ways:

[0064] 1. A task-level network isolation strategy is adopted, the container group A allows other container groups belonging to the same task to access, the management container group belongs to the same task as the container group A, and access of container groups not belonging to the same task is prevented, and access of all paths that can be shielded and are not allowed is shielded.

[0065] 2. An authorized device is set, the authorized device includes a cluster bastion host, a host bastion host and a host in the figure, and only the authorized device is allowed to access the container group A, for example, the cluster bastion host is used to access the container group A through the management container group, and the host bastion host is used to directly access the container group A.

[0066] For access through the host, i.e. security under the PaaS layer, in principle, these do not belong to the MaaS layer or the machine learning platform layer managed by the machine learning platform, but there are corresponding passwords or certificates in the IaaS layer, and a small number of operation and maintenance personnel can directly log in to these hosts.

[0067] 3. The system command line tool is limited to allow only authorized users to access. In addition to authorized users, all other users are prohibited from accessing the container group A through the system command line tool,

[0068] 4. The access of the above-mentioned authorized device and the system command line tool is recorded.

[0069] For example, for the host, strict recording measures are taken for logging in or manipulating the container group through part of the container group or container-related commands on the host, including recording the login of the user in any time period; capturing any operation related to the operation and maintenance of the container group on the host; subsequent analysis and processing to analyze which user has operated the container group, such as finding some operation behaviors of the corresponding time period login user.

[0070] Exemplarily, Figure 4 A schematic diagram of a log recording process provided by some embodiments of the present disclosure is as follows: Figure 4As shown, the log recording process in the figure can include: 1. Initialization. A security initialization process, including: a. Convergence of the permissions of the operation and maintenance personnel, only a few users are set as authorized users. b. A secure sandbox for user load, mainly a network isolation mechanism, which prevents unauthorized login using a network isolation strategy. Configuration of log acquisition software at each level, such as the IaaS layer, the PaaS layer, the MaaS layer, or the machine learning platform layer. 2. Real-time control and log collection of container group access. When the container group is running, the log collection mechanism at each level will operate to collect the corresponding logs, and the authenticity of the corresponding logs needs to be ensured. 3. The trusted log platform collects logs and can deliver them to specific users and for internal troubleshooting. The internal troubleshooting logs can be internal operation and maintenance data that is desensitized and unrelated to user data.

[0071] Through the trusted log platform, the logs of network access operations at each level can be captured, so that network access operations such as operation and maintenance operations cannot hide, and the entire access process is recorded.

[0072] The present scheme mainly solves the following problems: The container group of a user is not allowed to access without permission. If access is needed, the user needs to be authorized or access through an authorized device. And the following points need to be met: 1. The container group needs to use a pre-set entry access, and needs to have corresponding log recording for subsequent tracing; 2. If a non-standard method is used, if it can be prohibited by technical means, it needs to be shielded by technical means; if it cannot be prohibited by technical means, corresponding logs need to be recorded for tracing to locate potential problems; 3. Whether the access container group behavior is successful (if not successful, the corresponding judgment needs to be in the log) or not the expected behavior login, there needs to be corresponding trusted logs for subsequent tracing or monitoring.

[0073] The scheme limits the access of the large model related personnel container group by means of technology and process, realizes safe operation and leaves traces, guarantees that the access to the container group reaches trusted operation and maintenance, and mainly includes two aspects: in the MaaS or machine learning platform layer, the network isolation technology at the task level is used to prevent abnormal network access, only the permitted entrance is set, that is, the unpermitted access of the user is blocked as much as possible, only the designated access path is directed, and all container group network access behaviors (including unsuccessful behaviors) are recorded, including log aggregation. Because security is hierarchical, some operations below the MaaS layer have high permissions, so the behaviors of all operators of the high permissions are recorded. The log of the technical control plus the process means of the scheme is sent to the trusted log platform running in the trusted environment for subsequent processing, which can further detect the access of unauthorized users and guarantee that the relevant log data cannot be maliciously tampered with; the corresponding log can be delivered to the user, and the trustworthiness of the entire log is proved to the user through trusted computing.

[0074] Next, the architecture of the control plane in the network security access method of the large model task in the embodiments of the disclosure is further described through a specific example. The application program of the network security access method of the large model task can provide corresponding services based on the control plane. Exemplarily, Figure 5 The architecture diagram of the control plane (Control Plane) provided for some embodiments of the disclosure is as follows, Figure 5 The hardware in the control plane includes a central processing unit, a network interface card (Network Interface Card, NIC), and an accelerator (Accelerated Devices). The network interface card can include a data processing unit (Data Processing Unit, DPU). The accelerator can include one of a graphics processing unit, a tensor processing unit (Tensor Processing Unit, TPU), a field programmable gate array (Field Programmable Gate Array, FPGA), and an application specific integrated circuit (Application Specific Integrated Circuit, ASIC). Figure 5 The storage service (Storage Service) in the control plane can be a cloud storage service implemented based on a cloud server, and the specific hardware device implementing the storage service is not limited in the embodiment. The storage service can include one or more databases. As shown in Figure 5 In the embodiment, the model of the control plane can serve as a model as a service to undertake large models of various model suppliers, and then use the large models to provide inference services, fine-tuning services, and other services to the outside. Essentially, the model as a service is a platform as a service.

[0075] In the data plane, the data plane depends on infrastructure as a service, and the data plane can have a corresponding software stack that can be deployed as a service container group on a governed cloud server (ECS) node, and in response to a user's scheduling, the corresponding scheduling can be performed according to a scheduler. Figure 5 There are multiple user container groups (User Pod) and service container groups (Service Pod) in the middle cloud server virtual machine.

[0076] Generally, the related tasks of model as a service can be divided into inference tasks and training tasks (for example, dynamic fine-tuning tasks), etc. There are three roles in the task, namely, cloud server, model, and user.

[0077] Specifically, the cloud server provides cloud services (for example, infrastructure as a service or platform as a service) to serve different model providers. The model end has a large model and uses the cloud server to build its own inference task service entity. The user runs the application program provided by the cloud server and the model end. The user has corresponding isolation requirements for the model end and the cloud server. Specifically, when the user obtains model as a service from the cloud server, the user hopes that the container group of the model related task is isolated in the network, computing, and storage dimensions to ensure security.

[0078] Figure 6 A structure diagram of a network security access device for a large model task provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware, and can be integrated in an electronic device. As shown in Figure 6 The device includes:

[0079] The receiving module 601 is configured to receive a target access request, wherein the target access request includes current access user information.

[0080] The sending module 602 is configured to send the target access request to a target container group in response to determining that the sending device of the target access request is an authorized device or determining that the current access user is an authorized user based on the current access user information, wherein the target container group is used to execute a large model task.

[0081] The log module 603 is configured to collect access logs of the target access request through a trusted log platform, and send the access logs to a user corresponding to the target container group.

[0082] Optionally, the sending module 602 includes a first unit configured to:

[0083] In response to determining that the sending device is a host of the target container group, a host bastion or a cluster bastion corresponding to the management container group based on the access source information in the target access request, it is determined that the sending device of the target access request is an authorized device.

[0084] Optionally, the management container group and the target container group belong to the same task.

[0085] Optionally, the authorized device forwards the target access request after determining that the current access user is an authorized user.

[0086] Optionally, the sending module 602 comprises a second unit for:

[0087] In response to determining that the current access user information matches successfully in the authorized user set when the target access request comes from a system command line tool, it is determined that the current access user is an authorized user.

[0088] Optionally, the log module 603 is configured to:

[0089] The device log of the authorized device on the target access request, the container group log of the target container group and the platform log of the associated platform of the target container group are collected through the trusted log platform, and the access log is obtained by combination.

[0090] Optionally, the trusted log platform is deployed in a trusted execution environment based on trusted hardware.

[0091] The network security access device for large model tasks provided by the embodiments of the present disclosure can execute the network security access method for large model tasks provided by any of the embodiments of the present disclosure, and has the corresponding function modules and beneficial effects of the execution method.

[0092] The embodiments of the present disclosure also provide a computer program product, comprising computer programs / instructions, which, when executed by a processor, implement the network security access method for large model tasks provided by any of the embodiments of the present disclosure.

[0093] Figure 7 A structural schematic diagram of an electronic device provided by the embodiments of the present disclosure.

[0094] The following will be specifically referred to Figure 7The diagram illustrates a structural schematic suitable for implementing the electronic device 700 in the embodiments of this disclosure. The electronic device 700 in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (PADs), portable media players (PMPs), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0095] like Figure 7 As shown, the electronic device 700 may include a processing unit 701 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 702 or a program loaded from storage device 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0096] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic device 700 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 700 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0097] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication apparatus 709, or installed from the storage apparatus 708, or installed from the ROM 702. When the computer program is executed by the processing apparatus 701, the above-mentioned functions defined in the network security access method of the large model task of the embodiments of the present disclosure are executed.

[0098] It should be noted that the computer readable medium described above in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory, a read-only memory, an electrically erasable programmable read-only memory (EPROM), an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus or device. In the present disclosure, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer readable program code. Such a propagated data signal can take many forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to a wire, an optical cable, a radio frequency (Radio Frequency, RF) or the like, or any suitable combination of the above.

[0099] In some embodiments, the client, server, or other machines can communicate with one another and with other systems, devices, or networks of any kind using any known or later developed protocol, including protocols not yet developed, including any current or future versions of the Hypertext Transfer Protocol (HTTP). The client, server, or other machines can be interconnected through any known or later developed type of communication medium or network, including a local area network (LAN) or wide area network (WAN), the Internet, or any combination thereof.

[0100] The computer-readable medium described above can be included in the electronic device described above; alternatively, the computer-readable medium can exist as a standalone entity.

[0101] The computer-readable medium described above carries one or more programs that, when executed by the electronic device, cause the electronic device to: receive a target access request, wherein the target access request includes current access user information; in response to determining that a sending device of the target access request is an authorized device or that a current access user is an authorized user based on the current access user information, send the target access request to a target container group; collect an access log of the target access request through a trusted log platform, and send the access log to a user corresponding to the target container group.

[0102] Computer program code for carrying out operations of the present disclosure can be written in any of one or more programming languages, including object or visual programming languages such as Java, Smalltalk, C++, or conventional procedural programming languages such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0103] The computer program product of the first aspect can include a computer readable storage medium. The computer readable storage medium can include instructions. The instructions can include one or both of: instructions for causing a computer to implement a method as described above; and instructions for causing a computer to operate based on the described embodiments. The computer readable storage medium can include one or more types of computer-readable storage media or memory media. For example, the computer readable storage media can include a hard disk, a CD-ROM, an optical disk, a ROM, a RAM, a PROM, an EPROM, a FLASH, or the like. The computer readable storage medium can also include a non-tangible medium that is accessed directly from an external source, such as being downloaded over the Internet or over another network.

[0104] The units described in the embodiments of the present disclosure can be implemented by software, or by hardware. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0105] The functions described above can be performed, at least in part, by one or more hardware logic components. For example, non-limiting examples of hardware logic components that can be used include Field-Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application-Specific Standard Products (ASSPs), System-on-a-Chip (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0106] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include a lined-inked electrical connection, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, a flash memory, an optical fiber, a portable compact disc read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0107] It can be understood that, before using the technical solutions disclosed in the embodiments of the present disclosure, the type of information involved in the present disclosure, the use range, the use scenario, etc. should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.

[0108] The above description is merely preferred embodiments of the present disclosure and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and also covers other technical solutions formed by any combination of the above technical features or equivalent features without departing from the above disclosed concept. For example, the technical solutions formed by replacing the above features with the technical features disclosed in the present disclosure (but not limited to) having similar functions.

[0109] In addition, although each operation is described in a particular order, this should not be understood as requiring the operations to be performed in the specific order shown or in a sequential order. In certain circumstances, multitasking and parallel processing can be advantageous. Similarly, although several implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be combined in a single embodiment. Conversely, various features described in the context of a single embodiment can also be separated and implemented in multiple embodiments.

[0110] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A method for network security access of a large model task, characterized in that, The method comprises: receiving a target access request, wherein the target access request comprises current access user information; in response to determining that a sending device of the target access request is an authorized device or determining that a current access user is an authorized user based on the current access user information, sending the target access request to a target container group, wherein the target container group is used to execute a large model task; collecting, by a trusted log platform, an access log of the target access request, and sending the access log to a user corresponding to the target container group; wherein the determination that the sending device of the target access request is the authorized device comprises: in response to determining, based on access source information in the target access request, that the sending device is a host of the target container group, a host bastion of the target container group, or a cluster bastion corresponding to a management container group, determining that the sending device of the target access request is the authorized device, the host of the target container group being a node in a container cluster management system where the target container group is located, the host bastion of the target container group being a bastion between the host of the target container group and the outside, the cluster bastion being a bastion between the management container group and the outside, and the management container group and the target container group belonging to the same task.

2. The method of claim 1, wherein, The authorized device forwards the target access request after determining that the current access user is the authorized user.

3. The method of claim 1, wherein, The determination that the current access user is the authorized user based on the current access user information comprises: in response to determining that the current access user information matches successfully in a set of authorized users when the target access request comes from a system command line tool, determining that the current access user is the authorized user.

4. The method of claim 1, wherein, The collection, by the trusted log platform, of the access log of the target access request comprises: collecting, by the trusted log platform, a device log of the target access request by the authorized device, a container group log of the target container group, and a platform log of an associated platform of the target container group, and combining to obtain the access log.

5. The method of claim 1, wherein, The trusted log platform is deployed in a trusted execution environment based on trusted hardware.

6. A network security access apparatus for a large model task, characterized by, The method comprises: a receiving module configured to receive a target access request, wherein the target access request comprises current access user information; a sending module configured to, in response to determining that a sending device of the target access request is an authorized device or determining that a current access user is an authorized user based on the current access user information, send the target access request to a target container group, wherein the target container group is used to execute a large model task; a log module configured to collect, by a trusted log platform, an access log of the target access request, and send the access log to a user corresponding to the target container group; the sending module comprises a first unit configured to: In response to determining that the sending device is the master of the target container group, the master bastion of the target container group, or the cluster bastion corresponding to the management container group based on the access source information in the target access request, it is determined that the sending device of the target access request is an authorized device, the master of the target container group is a node in a container cluster management system where the target container group is located, the master bastion of the target container group is a bastion between the master of the target container group and the outside, the cluster bastion is a bastion between the management container group and the outside, and the management container group and the target container group belong to the same task.

7. An electronic device, comprising: The electronic device includes: a processor; a memory for storing executable instructions of the processor; the processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the network security access method of the large model task according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program is used to execute the network security access method of the large model task according to any one of claims 1-5.

Images