Cloud host protection method and system in cloud computing environment
Patent Information
- Application Number
- CN202510539748.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-27
- Publication Date
- 2025-08-15
Smart Images
Figure CN120492085A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of cloud computing, and in particular to a cloud host protection method and system in a cloud computing environment. Background Art
[0002] With the rapid development of cloud computing technology, more and more systems and user data are being moved to the cloud. The security challenges faced by cloud hosts (Virtual Machines) in cloud computing are becoming increasingly severe. Attacks against cloud hosts are frequent, making the protection of cloud host systems a crucial issue in the field of cloud computing. Summary of the Invention
[0003] In view of this, the present invention provides a cloud host protection method and system in a cloud computing environment to solve the problem of how to protect the cloud host.
[0004] In a first aspect, the present invention provides a cloud host protection method in a cloud computing environment, the method comprising:
[0005] When receiving a data read or write request from the cloud host, it queries the cache to see if there is a corresponding disk protection policy.
[0006] If the cache already has a protection policy for the corresponding disk and the disk does not need protection, the data read and write request is forwarded to Libbd for reading data;
[0007] If the disk needs to be protected, the corresponding offset and data size are calculated based on the read and write operation offset and read and write data size, and the block size in the protection policy;
[0008] Based on the original disk access, the calculated offset and data size, the data is read and returned to the cloud host.
[0009] In a cloud computing environment, the present invention takes over the read and write requests of the cloud host through the virtual storage proxy library LibbdProxy. When receiving a data read and write request from the cloud host, if there is a protection policy and the disk does not need to be protected, the data read and write request is directly forwarded to Libbd to read the data, thereby improving data read and write efficiency. If the disk needs to be protected, the data is accurately read according to the calculated offset and data size, and the data is returned to the cloud host, thereby protecting the cloud host data from being damaged and achieving the purpose of protecting the disk.
[0010] In an optional embodiment, the method further includes:
[0011] If there is no protection policy for the corresponding disk in the cache, the protection policy for the corresponding disk is obtained from PoSrv.
[0012] The present invention obtains a protection policy from PoSrv when no protection policy corresponding to a disk is stored, thereby avoiding data protection vulnerabilities caused by missing protection policies.
[0013] In an optional embodiment, reading data according to the original access to the disk, the calculated offset, and the data size includes:
[0014] Based on the original disk access and the calculated offset, query the metadata manager to see if the relevant metadata has been cached;
[0015] If the relevant metadata is not cached, the requested data is obtained from the original access disk at the calculated offset, the data is cached, and the corresponding metadata key-value pair is generated.
[0016] The present invention obtains requested data from the original access disk when relevant metadata is not cached in the metadata manager, thereby improving data reading efficiency and generating metadata key-value pairs from cached data to facilitate subsequent data queries.
[0017] In an optional embodiment, reading data according to the original access disk, the calculated offset and the data size, further includes:
[0018] If the relevant metadata has been cached, determine whether the cached data pointer is empty;
[0019] If the cached data pointer is empty, the requested data is obtained from the corresponding offset position of the auxiliary storage disk, the data is cached, and the cached data pointer in the metadata is set;
[0020] If the cached data pointer is not empty, the data has been cached.
[0021] The present invention determines whether the cached data pointer is empty. When the cached data pointer is empty, it re-acquires the requested data and caches the data. When the cached data pointer is not empty, that is, the data has been cached, the data can be read directly from the cache. By using metadata and cached data, some disk read and write requests are converted into memory read and write, reducing the pressure on storage and improving read and write efficiency.
[0022] In an optional embodiment, after returning the data to the cloud host, the method further includes:
[0023] Check cache data;
[0024] When the cached data exceeds the limit, the LRU algorithm is used to mark the cached data as expired.
[0025] The present invention checks cached data and marks the cached data as expired when the cached data exceeds a limit, so as to regularly clear the expired data and improve system stability.
[0026] In an optional implementation, after marking the cached data as expired using the LRU algorithm, the method further includes:
[0027] Check if the cached data has changed;
[0028] If the cached data has not changed, it is discarded directly and the cached data pointer of the metadata is set to null;
[0029] If the cached data is changed, the cached data is written to the location corresponding to the offset on the auxiliary storage disk, and the cached data pointer is set to null.
[0030] The present invention processes data separately when the cached data is changed and when it is not changed to optimize resource utilization, sets the cached data pointer to empty to facilitate subsequent operations such as querying the data, and improves data management efficiency.
[0031] In a second aspect, the present invention provides a cloud host protection system in a cloud computing environment, the system comprising:
[0032] The query module is used to query whether there is a protection policy for the corresponding disk in the cache when receiving a data read or write request from the cloud host;
[0033] The first data reading module is used to forward the data read and write request to Libbd for reading data if there is a protection policy for the corresponding disk in the cache and the disk does not need protection;
[0034] A calculation module is used to calculate the corresponding offset and data size based on the offset of the read and write operation and the read and write data size and the block size in the protection policy if the disk needs protection;
[0035] The second data reading module is used to read data according to the original access disk, the calculated offset and data size, and return the data to the cloud host.
[0036] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the cloud host protection method in a cloud computing environment of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.
[0037] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the cloud host protection method in a cloud computing environment of the above-mentioned first aspect or any corresponding embodiment thereof.
[0038] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, which are used to enable a computer to execute the cloud host protection method in a cloud computing environment of the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0040] Figure 1 This is an original architecture diagram of a cloud platform according to an embodiment of the present invention;
[0041] Figure 2 is an improved cloud platform architecture diagram according to an embodiment of the present invention;
[0042] Figure 3 1 is a flow chart of a cloud host protection method in a cloud computing environment according to an embodiment of the present invention;
[0043] Figure 4 is a schematic diagram of the overall process of writing data according to an embodiment of the present invention;
[0044] Figure 5 This is a schematic diagram of a process of writing cached metadata but uncached data according to an embodiment of the present invention;
[0045] Figure 6 This is a schematic diagram of a process for writing metadata according to an embodiment of the present invention, where data has been cached;
[0046] Figure 7 is a schematic diagram of a process for reading uncached data according to an embodiment of the present invention;
[0047] Figure 8 This is a flow chart of reading cached metadata but uncached data according to an embodiment of the present invention;
[0048] Figure 9 This is a schematic diagram of a process for reading metadata according to an embodiment of the present invention, where all data has been cached;
[0049] Figure 10 is a structural block diagram of a cloud host protection system in a cloud computing environment according to an embodiment of the present invention;
[0050] Figure 11 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0051] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.
[0052] First, the nouns appearing in the embodiments of the present invention are explained:
[0053] Cloud host (VM, Virtual Machine, virtual machine): also known as cloud computer, VM, etc., refers to the computer that users can access in a cloud computing environment.
[0054] BlkDev (Block Device): A device provided to a cloud host for data storage in a cloud computing environment, equivalent to a hard disk in a traditional computer.
[0055] QEMU (Quick Emulator, VM simulator): used to virtualize the cloud host hardware environment used by users in the cloud computing environment.
[0056] Libbd (library block device, block device access library): The library provided to QEMU for BlkDev reading and writing in the cloud computing environment.
[0057] LibbdProxy (library block device proxy, block device access proxy library): a proxy library used to implement fast cloud host recovery and take over QEMU's access to Libbd.
[0058] PoSrv (Policy Server): A policy server used to interact with LibbdProxy and configure the cloud host system disk that needs to be protected based on the user's policy configuration.
[0059] With the introduction of cloud computing technology into scenarios such as electronic classrooms, requirements have been raised for automatic restoration of cloud host systems after restart. Currently, common system restoration solutions include:
[0060] 1. Restoring the system using an image requires a lot of time and disk I / O, and cannot meet the needs of fast and automatic restoration of a large number of cloud hosts.
[0061] 2. Introduce a kernel module into the system to redirect disk reads and writes to the cache, and clear the cache after restart. This solution requires strong binding with the cloud host system and is highly invasive to the user system. It needs to be adapted for each cloud host system and the security software within the cloud host, which is a lot of work.
[0062] The original architecture of the cloud platform is as follows Figure 1 As shown, the embodiment of the present invention provides a cloud host protection method in a cloud computing environment, such as Figure 2 As shown, a proxy layer LibbdProxy for reading and writing disk block devices is added to the original cloud computing architecture, thereby achieving rapid restoration of the cloud host without requiring a large amount of reading and writing and without any intrusion into the user VM system. Moreover, due to its non-invasive nature, the present invention is applicable to any cloud host system and does not require additional adaptation work for the cloud host system.
[0063] According to an embodiment of the present invention, an embodiment of a cloud host protection method in a cloud computing environment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0064] This embodiment provides a cloud host protection method in a cloud computing environment. Figure 3 This is a flow chart of a cloud host protection method in a cloud computing environment according to an embodiment of the present invention, which is applied to LibbdProxy. Figure 3 As shown, the process includes the following steps:
[0065] Step S301: When a data read / write request is received from a cloud host, a query is made as to whether there is a protection policy for the corresponding disk in the cache.
[0066] In this embodiment of the present invention, PoSrv and LibbdProxy are first deployed. LibbdProxy takes over Libbd. The cloud platform sends the corresponding disk protection policy to PoSrv. The policy parameters include the original disk to be protected, the cache disk, the block size, etc. The cloud host reads and writes data to LibbdProxy. When LibbdProxy receives a data read or write request from the cloud host, it first queries the cache to see if there is a protection policy for the corresponding disk.
[0067] Step S302: If the cache already has a protection policy for the corresponding disk and the disk does not need protection, the data read and write request is forwarded to Libbd to read the data.
[0068] In an embodiment of the present invention, if a protection policy corresponding to the disk already exists in the cache and the disk does not require protection, the data read and write request is directly forwarded to Libbd to read the data.
[0069] Step S303: If the disk needs protection, the corresponding offset and data size are calculated according to the offset of the read and write operation and the read and write data size, and the block size in the protection policy.
[0070] In this embodiment of the present invention, if the disk needs protection, the corresponding offset X2 and read / write data size Y2 are calculated based on the read / write operation offset X and read / write data size Y, combined with the block size in the protection strategy.
[0071] The specific calculation method is:
[0072] X2=ROUNDDOWN(X,BLOCKSIZE), that is, X2 is rounded down to the block size;
[0073] Y2=ROUNDUP(Y,BLOCKSIZE), that is, Y2 is rounded up to the block size boundary.
[0074] Step S304: Read the data based on the original access disk, the calculated offset and the data size, and return the data to the cloud host.
[0075] In an embodiment of the present invention, LibbdProxy obtains data based on the original access disk diskA, the calculated offset X2, and the read / write data size Y2. LibbdProxy uses the requested data to update the cached data in DATA_PTR (only when writing). If the marked data in the metadata is modified, LibbdProxy returns a success message to the cloud host.
[0076] The cloud host protection method in a cloud computing environment provided by this embodiment takes over the read and write requests of the cloud host through the virtual storage proxy library LibbdProxy in the cloud computing environment. When receiving a data read and write request from the cloud host, if there is a protection policy and the disk does not need to be protected, the data read and write request is directly forwarded to Libbd to read the data, thereby improving data read and write efficiency. If the disk needs to be protected, the data is accurately read according to the calculated offset and data size, and the data is returned to the cloud host, thereby protecting the cloud host data from being damaged and achieving the purpose of protecting the disk.
[0077] This embodiment provides a cloud host protection method in a cloud computing environment, and the process includes the following steps:
[0078] Step S401: When a data read / write request is received from a cloud host, a query is made as to whether there is a corresponding disk protection policy in the cache.
[0079] For details, please see Figure 3 Step S301 of the illustrated embodiment will not be described in detail here.
[0080] Step S402: If the cache already has a protection policy for the corresponding disk and the disk does not need protection, the data read and write request is forwarded to Libbd to read the data.
[0081] For details, please see Figure 3 Step S302 of the illustrated embodiment will not be described in detail here.
[0082] Step S403: If there is no protection policy for the corresponding disk in the cache, obtain the protection policy for the corresponding disk from PoSrv.
[0083] In the embodiment of the present invention, if there is no protection policy for the corresponding disk in the LibbdProxy query cache, the protection policy for the corresponding disk is obtained from PoSrv, and PoSrv returns the protection policy for the corresponding disk.
[0084] By obtaining the protection policy from PoSrv when no protection policy with a corresponding disk is stored, data protection vulnerabilities caused by missing protection policies can be avoided.
[0085] Step S404: If the disk needs protection, the corresponding offset and data size are calculated according to the offset of the read and write operations and the read and write data size, and the block size in the protection policy.
[0086] For details, please see Figure 3 Step S303 of the illustrated embodiment will not be described in detail here.
[0087] Step S405 , reading the data based on the original access disk, the calculated offset and the data size, and returning the data to the cloud host.
[0088] Specifically, the above step S405 includes:
[0089] Step S4051: Based on the original disk access and the calculated offset, query the metadata manager to see whether the relevant metadata has been cached.
[0090] Step S4052: If the relevant metadata is not cached, the requested data is obtained from the original access disk at the location with the calculated offset, the data is cached, and a corresponding metadata key-value pair is generated.
[0091] In this embodiment of the present invention, LibbdProxy uses the original access disk, diskA, and offset X2 to query the metadata manager to see if the relevant metadata has been cached. If not, it retrieves the requested data from the original access disk, diskA, and offset X2, caches the data, and generates a corresponding metadata key-value pair: diskA,X2->diskB,XX,DATA_PTR. Offset XX in diskB is automatically assigned based on the currently used storage size and starts at 0. DATA_PTR is the cached data pointer.
[0092] The main fields of the metadata are: the key consists of the original disk ID + the converted offset, and the value includes: DATA_PTR (cache data pointer), cache disk ID, cache disk offset (the location where cached data is stored after being swapped out), and dirty (whether the cached data has been modified, used to determine whether the cached data needs to be written to the cache disk when swapped out).
[0093] By obtaining the requested data from the original access disk when the relevant metadata is not cached in the metadata manager, the data reading efficiency is improved, and the cached data generates metadata key-value pairs to facilitate subsequent data queries.
[0094] Specifically, the above step S405 further includes:
[0095] Step S4053: If the relevant metadata has been cached, determine whether the cached data pointer is empty.
[0096] Step S4054: If the cached data pointer is empty, the requested data is obtained from the position corresponding to the offset of the auxiliary storage disk, the data is cached, and the cached data pointer in the metadata is set.
[0097] Step S4055: If the cached data pointer is not empty, the data has been cached.
[0098] In this embodiment of the present invention, if the relevant metadata has been cached, it is determined whether DATA_PTR is empty. If DATA_PTR is empty, the requested data is retrieved from the auxiliary storage disk diskB at offset XX, cached, and the DATA_PTR in the metadata is set. If DATA_PTR is not empty, it indicates that the data has been cached.
[0099] By determining whether the cached data pointer is empty, when the cached data pointer is empty, the requested data is re-acquired and cached. When the cached data pointer is not empty, that is, the data has been cached, the data can be read directly from the cache. By using metadata and cached data, some disk read and write requests are converted into memory read and write, reducing the pressure on storage and improving read and write efficiency.
[0100] In some optional embodiments, the method further comprises:
[0101] Step S406: Check cache data.
[0102] Step S407: When the cached data exceeds the limit, the cached data is marked as expired using the LRU algorithm.
[0103] In an embodiment of the present invention, LibbdProxy will check cached data in the background. When the cached data exceeds the limit, the cached data will be marked as expired using the LRU (Least Recently Used) algorithm. The LRU algorithm means that the data that has been used recently is more likely to be used again in the short term, while the data that has not been used for a long time is less likely to be used in the future.
[0104] By checking the cached data, when the cached data exceeds the limit, the cached data is marked as expired, so that the expired data can be cleaned up regularly to improve system stability.
[0105] Step S408: Check whether the cached data has been changed.
[0106] Step S409: If the cached data has not been changed, it is directly discarded and the cached data pointer of the metadata is set to null.
[0107] Step S410: If the cached data is changed, the cached data is written to the position corresponding to the offset of the auxiliary storage disk, and the cached data pointer is set to null.
[0108] In this embodiment of the present invention, LibbdProxy checks whether the cached data has been changed. If the cached data has not been changed, its data is consistent with the original data stored on disk, and retaining the cached data is meaningless, it is directly discarded and the metadata DATA_PTR is set to null. If the cached data has been changed, the cached data is written to the auxiliary storage disk diskB, offset XX, and the DATA_PTR is set to null after writing.
[0109] The cloud host protection method in a cloud computing environment provided by this embodiment optimizes resource utilization by processing data separately when the cached data has been changed and when it has not been changed, and sets the cached data pointer to empty to facilitate subsequent operations such as querying the data, thereby improving data management efficiency.
[0110] Compared with existing technologies, the main advantages of this method are:
[0111] 1. In a cloud computing environment, the virtual storage proxy library LibbdProxy takes over the read and write requests of the cloud host and protects the cloud host data from being damaged by caching the written data elsewhere.
[0112] 2. LibbdProxy converts some disk read and write requests into memory read and write requests by using metadata and cached data, reducing storage pressure and improving read and write efficiency.
[0113] 3. Non-invasive, no need to adapt to the cloud host system;
[0114] 4. High efficiency: to restore the system, you only need to delete the disk metadata, and the system / disk can be restored in seconds;
[0115] 5. The cloud host protection strategy can be flexibly configured. From the perspective of disk protection range, system disk protection / full disk protection can be implemented. From the perspective of restoration timing, restoration upon restart or scheduled restoration can be implemented.
[0116] 6. For cloud computing platforms, a storage proxy layer is added outside the cloud host, cleverly circumventing the conventional method of deploying kernel modules within the cloud host, which is highly invasive and has limited compatibility.
[0117] 7. By caching modified metadata and cached data at the storage proxy layer, the cloud host will not modify the actual system disk when reading and writing them, thus achieving the purpose of disk protection without the cloud host being aware of it.
[0118] The specific application examples of the embodiments of the present invention are introduced below:
[0119] Example 1: Protect the system disk and restore after shutdown
[0120] 1. Deploy cloud platform, PoSrv, LibbdProxy;
[0121] 2. In a typical scenario, a cloud host usually has two disks: a system disk and a data disk. The system disk needs to be protected so that it can automatically recover after restart, while the data disk is used to store user data and does not need to be recovered. Therefore, the cloud platform sends the disk policy that needs to be protected to PoSrv (the system disk needs to be automatically recovered, while the data disk does not need to be automatically recovered);
[0122] 3. After the cloud host is started, it reads and writes the disk through LibbdProxy, protects the reading and writing of the system disk, and directly forwards the reading and writing of the data disk to Libbd (such as Figure 4-Figure 9 );
[0123] 4. After the cloud host is shut down, LibbdProxy directly deletes the metadata corresponding to the system disk according to the policy;
[0124] 5. When the cloud host is restarted, since LibbdProxy has deleted the metadata corresponding to the system disk, all modifications to the system during the last startup are invalidated and the system is automatically restored, while the modifications in the data disk are retained.
[0125] Example 2: Protect all disks and restore after shutdown
[0126] 1. Deploy cloud platform, PoSrv, LibbdProxy;
[0127] 2. In a typical scenario, a cloud host usually has two disks, a system disk and a data disk. The system disk and the data disk need to be protected so that they can automatically recover after restart. Therefore, the cloud platform sends the disk policy that needs to be protected to PoSrv (the system disk and the data disk need to be automatically recovered);
[0128] 3. After the cloud host is started, it reads and writes the disk through LibbdProxy to protect the reading and writing of the system disk and data disk (such as Figure 4-Figure 9 );
[0129] 4. After the cloud host is shut down, LibbdProxy directly deletes the metadata corresponding to the system disk and data disk according to the policy;
[0130] 5. When the cloud host is restarted, since LibbdProxy has deleted the metadata corresponding to the system disk and data disk, all system modifications during the last startup are invalidated, and the system disk and data disk are automatically restored.
[0131] Example 3: Protect all disks and restore them regularly
[0132] 1. Deploy cloud platform, PoSrv, LibbdProxy;
[0133] 2. In a typical scenario, a cloud host usually has two disks: a system disk and a data disk. The system disk and the data disk need to be protected so that they can automatically recover after restart. Therefore, the cloud platform sends the disk policy that needs to be protected to PoSrv (the system disk and the data disk need to be restored regularly);
[0134] 3. After the cloud host is started, it reads and writes the disk through LibbdProxy to protect the reading and writing of the system disk and data disk (such as Figure 4-Figure 9 );
[0135] 4. After the cloud host is shut down, if the restoration conditions are met, LibbdProxy will directly delete the metadata corresponding to the system disk and data disk according to the policy;
[0136] 5. When the cloud host is restarted, if LibbdProxy has deleted the metadata corresponding to the system disk and data disk, the system disk and data disk in the cloud host will be automatically restored. Otherwise, the data will be retained.
[0137] like Figure 4 As shown, Figure 4To illustrate the overall data writing process, QEMU issues a request to the cloud host to write to Disk A (offset X, size Y). After receiving the request, LibbdProxy obtains Disk A's policy from PoSrv. If PoSrv already has a policy for Disk A, it returns it to LibbdProxy. If LibbdProxy already has a policy, it instructs Libbd to read the data at offset X2 and size Y2 from Disk A. After reading the data from Disk A, Libbd returns it to LibbdProxy. LibbdProxy updates the cloud host's data to the corresponding data block, caches the data at offset X2 and size Y2 on Disk A, and associates it with the data at offset 0 and size Y2 on Disk B, generating association metadata. During this process, the data is cached using a least-repeated (LRU) list. If the data at offset X3 and size Y3 on Disk A (associated with offset X4 and size Y4 on Disk B) has expired, the cached data is written to Disk B at offset X4 and size Y4. If the write is successful, a success message is returned to LibbdProxy, which then returns the success message to QEMU.
[0138] like Figure 5 As shown, Figure 5 This flowchart shows a write operation where metadata is cached but data is not. QEMU issues a request to the cloud host to write to disk A (offset X, size Y). After receiving the request, LibbdProxy obtains cached metadata for disk A at offset X and size Y (associated with disk B at offset 0 and size Y2). LibbdProxy instructs the read operation to read data of size Y2 from disk B at offset 0. After Libbd performs the read operation, it returns the data to Libbd, which then returns the data to LibbdProxy. LibbdProxy updates the data block based on the cloud host's write status, using the LRU list to cache the data. Upon successful write, it returns a success message to QEMU.
[0139] like Figure 6 As shown, Figure 6 Flowchart for writing metadata when data is cached: QEMU sends a request to the cloud host to write to disk A (offset X, size Y). After receiving the request, LibbdProxy obtains the cached data of disk A with offset X and size Y (associated with disk B with offset 0 and size Y2), uses the cloud host's write request to update the cached data, and returns a success message to QEMU after the write is successful.
[0140] like Figure 7 As shown, Figure 7To read the uncached data flow chart, QEMU sends a request to the cloud host to write to disk A (offset X, size Y). After receiving the request, LibbdProxy obtains the policy of disk A from PoSrv. If PoSrv has a policy for disk A, it returns the policy of disk A to LibbdProxy. If LibbdProxy already has a policy, it directly lets Libbd read the data with offset X2 and size Y2 from disk A. After Libbd reads the data from disk A, it returns it to LibbdProxy. LibbdProxy updates the data to be written by the cloud host to the corresponding data block, caches the data with offset X2 and size Y2 from disk A, and associates it with the data with offset 0 and size Y2 from disk B to generate associated metadata. In this process, the LRU list is used to cache data. After the write is successful, a success message is returned to QEMU.
[0141] like Figure 8 As shown, Figure 8 The flowchart for reading cached metadata but uncached data is shown below. QEMU issues a request to the cloud host to write to Disk A (offset X, size Y). After receiving the request, LibbdProxy retrieves the cached metadata for Disk A at offset X, size Y (associated with Disk B at offset 0, size Y2). LibbdProxy instructs the server to read data of size Y2 from Disk B at offset 0. After Libbd performs the read operation, it returns the data to Libbd, which then returns the data to LibbdProxy. LibbdProxy caches the data using an LRU list. Upon successful write, it returns a success message to QEMU.
[0142] like Figure 9 As shown, Figure 9 Flowchart for reading metadata. Data is cached. QEMU sends a request to the cloud host to write to disk A (offset X, size Y). After receiving the request, LibbdProxy obtains the cached data at disk A with offset X and size Y (associated with disk B with offset 0 and size Y2). After the write is successful, a success message is returned to QEMU.
[0143] The solution proposed in the present invention can meet the protection needs of the cloud host system and the demand for cloud host read-only (that is, automatic restoration after restart) in specific scenarios. At the same time, it does not require a lot of time and disk IO, and can meet the automatic restoration of large quantities of cloud hosts in cloud computing scenarios.
[0144] This embodiment also provides a cloud host protection system in a cloud computing environment. This system is used to implement the above-mentioned embodiments and preferred implementations. Details already described will not be repeated here. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.
[0145] This embodiment provides a cloud host protection system in a cloud computing environment, such as Figure 10 Shown, including:
[0146] The query module 1001 is used to query whether there is a protection policy for the corresponding disk in the cache when receiving a data read or write request sent by the cloud host.
[0147] The first data reading module 1002 is configured to forward a data read / write request to Libbd for reading data if a protection policy corresponding to the disk already exists in the cache and the disk does not require protection.
[0148] The calculation module 1003 is used to calculate the corresponding offset and data size according to the offset of the read and write operation and the read and write data size and the block size in the protection policy if the disk needs protection.
[0149] The second data reading module 1004 is used to read data according to the original access disk, the calculated offset and data size, and return the data to the cloud host module.
[0150] In some optional embodiments, the system further comprises:
[0151] The acquisition module is used to obtain the protection policy of the corresponding disk from PoSrv if there is no protection policy of the corresponding disk in the cache.
[0152] In some optional implementations, the second data reading module 1004 includes:
[0153] The query unit is used to query whether the relevant metadata has been cached from the metadata manager according to the offset calculated by original disk access.
[0154] The first data acquisition unit is used to obtain the requested data from the original access disk and the position with the calculated offset if the relevant metadata is not cached, cache the data, and generate a corresponding metadata key-value pair.
[0155] In some optional implementations, the second data reading module 1004 further includes:
[0156] The judging unit is configured to judge whether the cached data pointer is empty if the relevant metadata has been cached.
[0157] The second data acquisition unit is configured to acquire the requested data from the position corresponding to the offset of the auxiliary storage disk if the cached data pointer is empty, cache the data, and set the cached data pointer in the metadata.
[0158] The determination unit is configured to determine that the data has been cached if the cached data pointer is not empty.
[0159] In some optional embodiments, the system further comprises:
[0160] The first checking module is used to check cache data.
[0161] The marking module is used to mark the cached data as expired using the LRU algorithm when the cached data exceeds the limit.
[0162] In some optional embodiments, the system further comprises:
[0163] The second checking module is used to check whether the cached data has been changed.
[0164] The first setting module is used to directly discard the cached data if there is no change, and set the data pointer of the metadata cache to be empty.
[0165] The second setting module is used to write the cached data to the position corresponding to the offset of the auxiliary storage disk if the cached data is changed, and set the cached data pointer to be empty.
[0166] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.
[0167] The cloud host protection system in the cloud computing environment in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.
[0168] The embodiment of the present invention also provides a computer device having the above Figure 10 The cloud host protection system in the cloud computing environment is shown.
[0169] See also Figure 11 , Figure 11 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 11As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of a GUI on an external input / output device (such as, a display device coupled to an interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 11 A processor 10 is taken as an example.
[0170] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.
[0171] The memory 20 stores instructions that can be executed by at least one processor 10, so as to enable at least one processor 10 to execute the method shown in the above embodiment.
[0172] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0173] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.
[0174] The computer device further includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 11 The bus connection is taken as an example.
[0175] The input device 30 can receive input digital or character information and generate key signal input related to user settings and function control of the computer device, such as a touch screen, etc. The output device 40 can include a display device, etc.
[0176] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.
[0177] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.
[0178] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are intended to fall within the scope of this application.
Claims
1. A cloud host protection method in a cloud computing environment, characterized in that: Applied to LibbdProxy, the method includes: When receiving a data read or write request from the cloud host, it queries the cache to see if there is a corresponding disk protection policy. If the cache already has a protection policy for the corresponding disk and the disk does not need protection, the data read and write request is forwarded to Libbd for reading data; If the disk needs to be protected, the corresponding offset and data size are calculated based on the read and write operation offset and read and write data size, and the block size in the protection policy; Based on the original disk access, the calculated offset and data size, the data is read and returned to the cloud host.
2. The method according to claim 1, characterized in that The method further comprises: If there is no protection policy for the corresponding disk in the cache, the protection policy for the corresponding disk is obtained from PoSrv.
3. The method according to claim 1, characterized in that The method of reading data according to the original access to the disk and the calculated offset and data size includes: Based on the original disk access and the calculated offset, query the metadata manager to see if the relevant metadata has been cached; If the relevant metadata is not cached, the requested data is obtained from the original access disk at the calculated offset, the data is cached, and the corresponding metadata key-value pair is generated.
4. The method according to claim 3, characterized in that The method of reading data according to the original access to the disk and the calculated offset and data size further includes: If the relevant metadata has been cached, determine whether the cached data pointer is empty; If the cached data pointer is empty, the requested data is obtained from the corresponding offset position of the auxiliary storage disk, the data is cached, and the cached data pointer in the metadata is set; If the cached data pointer is not empty, the data has been cached.
5. The method according to claim 1, wherein After returning the data to the cloud host, the method further includes: Check cache data; When the cached data exceeds the limit, the LRU algorithm is used to mark the cached data as expired.
6. The method according to claim 5, characterized in that After marking the cached data as expired using the LRU algorithm, the method further includes: Check if the cached data has changed; If the cached data has not changed, it is discarded directly and the cached data pointer of the metadata is set to null; If the cached data is changed, the cached data is written to the location corresponding to the offset on the auxiliary storage disk, and the cached data pointer is set to null.
7. A cloud host protection system in a cloud computing environment, characterized in that: The system comprises: The query module is used to query whether there is a protection policy for the corresponding disk in the cache when receiving a data read or write request from the cloud host; The first data reading module is used to forward the data read and write request to Libbd for reading data if there is a protection policy for the corresponding disk in the cache and the disk does not need protection; A calculation module is used to calculate the corresponding offset and data size based on the offset of the read and write operation and the read and write data size and the block size in the protection policy if the disk needs protection; The second data reading module is used to read data according to the original access disk, the calculated offset and data size, and return the data to the cloud host.
8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the cloud host protection method in a cloud computing environment according to any one of claims 1 to 6 by executing the computer instructions.
9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the cloud host protection method in a cloud computing environment according to any one of claims 1 to 6.
10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the cloud host protection method in a cloud computing environment according to any one of claims 1 to 6.