A radix tree-based multi-cluster resource permission management method and system

Abstract

The application relates to the technical field of computers, and particularly discloses a multi-cluster resource permission management method and system based on a radix tree. The application realizes delay minimization and consistency guarantee in the permission synchronization process by dynamically adjusting cluster synchronization strategies and monitoring cluster performance in real time, automatically judges the dynamic weight of each cluster by comprehensively considering the network delay, CPU usage, memory occupancy and disk I / O load of each cluster, divides the clusters into a priority synchronization group and a delay synchronization group according to the weight values, so that the permission synchronization request of a cluster with heavy load or large delay is preferentially processed, the lag of permission synchronization is effectively reduced, a hierarchical permission management structure is constructed by using a radix tree model, permission change information can be accurately recorded and synchronized, and the consistency of permission change data in different clusters is ensured through hash verification, and the accuracy and reliability of permission management in a multi-cluster environment are significantly improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a multi-cluster resource authority management method and system based on a radix tree. Background Art

[0002] Multi-cluster resource permission management refers to a method for managing resource access and permissions across multiple clusters (such as multiple Kubernetes clusters or other distributed system clusters). This management approach typically involves controlling access to users, services, or applications across multiple clusters, ensuring that resources in different clusters are properly authorized and securely managed. In multi-cluster scenarios, different clusters may have different resource and permission requirements. Single-cluster permission management methods cannot meet the needs of unified management of resources across multiple clusters. Therefore, multi-cluster resource permission management requires cross-cluster permission identification, authorization, and control mechanisms.

[0003] Currently, the primary approach to managing multi-cluster resource permissions is to achieve unified control across multiple clusters through a federated architecture, combined with a role-based access control model for refined permission allocation. However, permission policies at the federation layer must be asynchronously synchronized across clusters. This synchronization process is affected by network latency and cluster load, potentially leading to inconsistent states where permissions are in effect at the federation layer but not yet updated in some clusters. For example, if an administrator deletes a user's cross-cluster permissions, the user may still be able to operate resources in unsynchronized clusters, posing a security risk. Summary of the Invention

[0004] The main purpose of the present invention is to provide a multi-cluster resource authority management method based on a radix tree, aiming to solve the technical problems in the prior art.

[0005] The present invention proposes a multi-cluster resource authority management method based on a radix tree, comprising:

[0006] Obtaining network topology structures and historical permission synchronization records of multiple clusters in a multi-cluster system, and constructing an initial radix tree model based on the multiple network topology structures and historical permission synchronization records, wherein the initial radix tree model includes a root node, first-level child nodes, second-level child nodes, third-level child nodes, and leaf nodes;

[0007] Obtain the permission change request of each cluster, and generate a corresponding change record in the initial radix tree model according to the specific operation type, resource location path and changed permission parameters in the permission change request;

[0008] Extracting the complete path branch of each change record and obtaining a first hash value of the complete path branch;

[0009] acquire real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster, and acquire a dynamic weight value of the corresponding cluster according to each of the real-time network delay data, CPU usage, memory occupancy and disk I / O load;

[0010] determine whether the dynamic weight value of each cluster is greater than a preset threshold value;

[0011] if the dynamic weight value is greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster;

[0012] if the dynamic weight value is not greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster;

[0013] respectively acquire second hash values of the priority synchronization group cluster and the delay synchronization group cluster, and determine whether the second hash value of each cluster is consistent with the first hash value;

[0014] if the second hash value is consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is synchronized with the changed path branch;

[0015] if the second hash value is not consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is not synchronized with the changed path branch, and returns to the step of respectively acquiring the second hash values of the priority synchronization group cluster and the delay synchronization group cluster until the second hash value is consistent with the first hash value.

[0016] As preferred, the step of constructing an initial radix tree model according to a plurality of network topology structures and historical permission synchronization records comprises:

[0017] acquire the global permission domain, cluster identifier, resource type, resource object and permission item of the multi-cluster system, and construct a hierarchical structure with the multi-cluster system global permission domain as the root node, the cluster identifier as the first-level child node, the resource type as the second-level child node, the resource object as the third-level child node, and the permission item as the leaf node;

[0018] add network connection information in the attribute of the first-level child node according to the network topology structure;

[0019] extract the permission change rule of each resource object from the historical permission synchronization record, and correspondingly optimize the initial permission configuration of the leaf node according to each of the permission change rules to obtain an optimized permission configuration;

[0020] according to the hierarchical structure, network connection information and optimized permission configuration, each node is connected in series to form a complete initial radix tree model through a tree structure generation algorithm.

[0021] Preferably, the step of generating a corresponding change record in the initial base tree model according to the specific operation type, resource location path and changed permission parameter in the permission change request comprises:

[0022] receiving a permission change request through a request interface of the multi-cluster permission management system, and extracting a specific operation type, resource location path and changed permission parameter from the permission change request;

[0023] obtaining the hierarchical structure of the resource location path, and starting from the root node of the initial base tree model according to the hierarchical structure, matching layer by layer, and reading the pre-change permission parameter currently stored in the leaf node;

[0024] obtaining metadata according to the permission change request, and extracting an initiating node identifier according to the metadata;

[0025] obtaining the permission change time when the request interface of the multi-cluster permission management system receives the permission change request, and associating the permission change time, the initiating node identifier, the pre-change permission parameter and the changed permission parameter to the corresponding leaf node to obtain a change record.

[0026] Preferably, the step of obtaining a dynamic weight value of each cluster according to the real-time network delay data, CPU usage rate, memory occupancy rate and disk I / O load of each cluster comprises:

[0027] sending a preset number of probe data packets to each cluster and recording the round trip time of each time in real time, and obtaining real-time network delay data according to a plurality of the round trip times;

[0028] obtaining a process statistics file of each cluster, and obtaining CPU user state time, system state time, idle time and IO waiting time according to the process statistics file;

[0029] obtaining the CPU usage rate according to the CPU user state time, system state time, idle time and IO waiting time;

[0030] obtaining the total memory, used memory and cache memory of each cluster, and obtaining the memory occupancy rate according to the total memory, used memory and cache memory;

[0031] obtaining the disk read / write byte number rate and disk bandwidth of each cluster, and obtaining the disk I / O load according to the disk read / write byte number rate and disk bandwidth;

[0032] Respectively assign corresponding weight coefficients to real-time network delay data, CPU usage, memory occupancy and disk I / O load, and obtain a dynamic weight value of the corresponding cluster according to the real-time network delay data, CPU usage, memory occupancy, disk I / O load and the corresponding weight coefficients.

[0033] Preferably, the step of obtaining the second hash value of the priority synchronization group cluster and the delay synchronization group cluster respectively comprises:

[0034] Obtain the first current path branch and the first change path branch of the priority synchronization group cluster, and extract the first attribute field of all nodes in the first current path branch to obtain a first structured data set;

[0035] Extract the second attribute field of all nodes in the first change path branch to obtain a second structured data set;

[0036] Convert the first structured data set and the second structured data set into a first binary data sequence and a second binary data sequence respectively;

[0037] Obtain a difference data segment according to the first binary data sequence and the second binary data sequence, and perform a piece-by-piece update on the first structured data set according to the difference data segment to obtain a first updated binary data sequence;

[0038] Obtain the second change path branch of the delay synchronization group cluster, and locate the second current path branch of the delay synchronization group cluster according to the path identifier of the second change path branch;

[0039] Obtain a second updated binary data sequence according to the second current path branch and the second change path branch, and obtain a second hash value of the second updated binary data sequence and the first updated binary data sequence using a SHA-256 hash algorithm.

[0040] Preferably, the step of obtaining the difference data segment according to the first binary data sequence and the second binary data sequence comprises:

[0041] Perform a byte-by-byte XOR operation on the first binary data sequence and the second binary data sequence to obtain a difference data sequence;

[0042] Traverse the difference data sequence and record the difference segment start position and the difference segment length of continuous non-zero bytes to obtain a difference segment information list, wherein the difference segment information list includes a plurality of difference segments sorted in ascending order of difference segment start position;

[0043] According to each of the difference fragments, byte data at a corresponding position in the first change path branch is extracted to obtain a data block, and a plurality of the data blocks are spliced according to an order of the difference fragment information list to obtain a spliced data block;

[0044] The difference data segment is obtained by splicing the difference fragment quantity, the difference fragment start position, the difference fragment length, and the spliced data block in order.

[0045] The application also provides a multi-cluster resource permission management system based on a radix tree, comprising:

[0046] A construction module is configured to obtain network topological structures and historical permission synchronization records of a plurality of clusters in a multi-cluster system, and construct an initial radix tree model according to the plurality of network topological structures and historical permission synchronization records, wherein the initial radix tree model comprises a root node, a first-level child node, a second-level child node, a third-level child node, and a leaf node.

[0047] A generation module is configured to obtain a permission change request of each cluster, and generate a corresponding change record in the initial radix tree model according to a specific operation type, a resource positioning path, and a changed permission parameter in the permission change request.

[0048] An extraction module is configured to extract a complete path branch of each of the change records, and obtain a first hash value of the complete path branch.

[0049] An obtaining module is configured to obtain real-time network delay data, CPU usage, memory occupancy, and disk I / O load of each cluster, and obtain a dynamic weight value of a corresponding cluster according to each of the real-time network delay data, CPU usage, memory occupancy, and disk I / O load.

[0050] A first judgment module is configured to judge whether the dynamic weight value of each cluster is greater than a preset threshold.

[0051] If the dynamic weight value is greater than the preset threshold, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster.

[0052] If the dynamic weight value is not greater than the preset threshold, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster.

[0053] A second judgment module is configured to obtain a second hash value of the priority synchronization group cluster and the delay synchronization group cluster respectively, and judge whether the second hash value of each cluster is consistent with the first hash value.

[0054] If the second hash value is consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is synchronized with the changed path branch.

[0055] If the second hash value is inconsistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is different from the changed path branch, and the step of obtaining the second hash value of the priority synchronization group cluster and the delayed synchronization group cluster is returned until the second hash value is consistent with the first hash value.

[0056] Preferably, the generating module comprises:

[0057] The extraction unit is configured to receive a permission change request through a request interface of the multi-cluster permission management system, and extract a specific operation type, a resource location path and a changed permission parameter from the permission change request.

[0058] The matching unit is configured to obtain a hierarchical structure of the resource location path, and match the hierarchical structure from a root node of the initial base tree model layer by layer, and read the pre-change permission parameter stored in the leaf node.

[0059] The obtaining unit is configured to obtain metadata according to the permission change request, and extract an initiating node identifier according to the metadata.

[0060] The association generating unit is configured to obtain a permission change time when the request interface of the multi-cluster permission management system receives the permission change request, and associate the permission change time, the initiating node identifier, the pre-change permission parameter and the changed permission parameter to the corresponding leaf node to obtain a change record.

[0061] The application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the multi-cluster resource permission management method based on the base tree when executing the computer program.

[0062] The application further provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the multi-cluster resource permission management method based on the base tree when executed by a processor.

[0063] The application has the beneficial effects that: the application realizes the minimization of delay and the guarantee of consistency in the permission synchronization process by dynamically adjusting the cluster synchronization strategy and monitoring the cluster performance in real time, automatically judges the dynamic weight of the cluster by comprehensively considering the network delay, CPU usage, memory occupancy and disk I / O load of each cluster, and divides the cluster into a priority synchronization group and a delay synchronization group according to the weight value, so that the permission synchronization request of the cluster with heavy load or large delay is preferentially processed, the hysteresis of permission synchronization is effectively reduced, the hierarchical permission management structure is constructed by using the radix tree model, the permission change information can be accurately recorded and synchronized, and the consistency of the permission change data in different clusters is ensured through the hash check, the accuracy and reliability of the permission management in the multi-cluster environment are significantly improved, and the synchronization failure problem caused by network fluctuations and cluster resource consumption in the traditional permission synchronization mode is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 The method flowchart of an embodiment of the application.

[0065] Figure 2 The system structure diagram of an embodiment of the application.

[0066] Figure 3 The internal structure diagram of a computer device of an embodiment of the application.

[0067] The implementation, functional features and advantages of the application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0068] It should be understood that the specific embodiments described herein are only used to explain the application, and are not used to limit the application.

[0069] As shown in the drawings, the application provides a multi-cluster resource permission management method based on a radix tree, which comprises: Figure 1

[0070] S1, the network topology structure and the historical permission synchronization record of a plurality of clusters in a multi-cluster system are obtained, and an initial radix tree model is constructed according to the plurality of network topology structures and historical permission synchronization records, wherein the initial radix tree model comprises a root node, a first-level child node, a second-level child node, a third-level child node and a leaf node;

[0071] S2, the permission change request of each cluster is obtained, and the corresponding change record is generated in the initial radix tree model according to the specific operation type, resource positioning path and changed permission parameter in the permission change request;

[0072] S3, the complete path branch of each change record is extracted, and the first hash value of the complete path branch is obtained; ​

[0073] S4, acquiring real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster, and acquiring a dynamic weight value of a corresponding cluster according to each of the real-time network delay data, CPU usage, memory occupancy and disk I / O load;

[0074] S5, judging whether the dynamic weight value of each cluster is greater than a preset threshold value;

[0075] If the dynamic weight value is greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster;

[0076] If the dynamic weight value is not greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster;

[0077] S6, acquiring second hash values of the priority synchronization group cluster and the delay synchronization group cluster respectively, and judging whether the second hash values of each cluster are consistent with the first hash values;

[0078] If the second hash values are consistent with the first hash values, it is determined that the first current path branch of the cluster corresponding to the hash values is synchronized with the changed path branch;

[0079] If the second hash values are not consistent with the first hash values, it is determined that the first current path branch of the cluster corresponding to the hash values is not synchronized with the changed path branch, and the step of acquiring the second hash values of the priority synchronization group cluster and the delay synchronization group cluster respectively is returned until the second hash values are consistent with the first hash values.

[0080] As described in steps S1-S6 above, wherein the root node of the initial base tree model corresponds to the global authority domain of the multi-cluster system, the first-level child nodes correspond to the cluster identifiers, the second-level child nodes correspond to the resource types within the clusters, the third-level child nodes correspond to the specific resource objects, and the leaf nodes store the authority items and the initial version numbers. The purpose of embedding the dynamic weight values into the attribute fields of the corresponding cluster identifier nodes, constructing the initial base tree, and calculating the dynamic weight values is to provide a basic support for the dynamic scheduling of the subsequent authority synchronization strategy. Specifically, through the hierarchical design of the initial base tree, the multi-cluster resource authorities are logically managed in layers according to the global, cluster, resource type, and resource object, making the authority path clear and traceable, and laying a structural foundation for subsequent precise positioning of authority change nodes and efficient extraction of the first change path branch. By collecting real-time load data such as network delay and CPU usage and calculating the dynamic weight values, the running state of the cluster is converted into a quantifiable numerical index. This index can intuitively reflect the current load pressure of the cluster (e.g., a high weight value indicates low load and strong synchronization capability, and a low weight value indicates high load and weak synchronization capability), providing data basis for distinguishing between the priority synchronization group and the delayed synchronization group. By embedding the dynamic weight values into the attribute fields of the cluster identifier nodes, the base tree not only carries authority information but also can associate the cluster load state in real time. In the subsequent synchronization process, the cluster priority can be directly judged based on the weight values in the node attributes, avoiding the exacerbation of delay caused by forcibly pushing synchronization data to high-load clusters, thereby reducing the synchronization inconsistency problem caused by uneven cluster load at the source;

[0081] Among them, the step of extracting the complete path branch of each change record and obtaining the first hash value of the complete path branch is the same as the step of matching from the root node of the initial base tree model layer by layer according to the hierarchical structure. Starting from the root node, depth-first traversal is performed along the matching path, and the complete data of all nodes on the path (including the attribute fields of each level node, such as the dynamic weight values of the cluster identifier nodes, the metadata of the resource object nodes, the authority items and version numbers of the leaf nodes, etc.) are recorded in turn, forming the first change path branch data from the root node to the target leaf node (containing the hierarchical relationship and data content of all nodes on the path). Then, the extracted complete path branch data is converted into a binary data stream in hierarchical order, and the SHA-256 algorithm is used to hash the binary data stream to generate a fixed-length (256-bit) first hash value. The first hash value uniquely corresponds to the complete data of this path branch and can be used as a change verification identifier for subsequent synchronization verification;

[0082] The application obtains the network topology structure and the historical permission synchronization record of multiple clusters in a multi-cluster system, and constructs an initial base tree model according to the multiple network topology structures and the historical permission synchronization record, wherein the initial base tree model includes a root node, a first-level child node, a second-level child node, a third-level child node and a leaf node. By collecting the network topology structure and the historical permission synchronization record of the cluster, a preliminary base tree model is constructed. Through the network topology structure, the connectivity, bandwidth, delay and other potential bottlenecks between clusters can be identified. The historical permission synchronization record provides the background of permission change, which can help the system to predict the possible synchronization problems in the future. Compared with the prior art, the initial data acquisition based on the network topology and the historical synchronization record provides a reliable basis for subsequent dynamic optimization, and not only relies on real-time information, thereby improving the intelligence and prediction ability of the entire synchronization process. By obtaining the permission change request of each cluster, and generating the corresponding change record in the initial base tree model according to the specific operation type, resource location path and changed permission parameter in the permission change request, the operation type, resource location path and changed permission parameter in the permission change request are used to generate the corresponding change record and the corresponding change path in the base tree model, so that not only the permission change is simply recorded, but also the change path is embedded into the base tree model to form a clear historical operation chain, which can accurately reflect the evolution process of each permission change and provide a clear traceability path for permission consistency judgment. The prior art usually only considers single permission change or static data record, and ignores the accumulation and interaction of historical change paths, and lacks systematic modeling of dynamic permission flow.

[0083] By extracting the complete path branch of each change record and obtaining the first hash value of the complete path branch, the system establishes an unforgeable digital fingerprint (the first hash value) for each permission change by extracting the complete path and calculating the first hash value, which ensures the accuracy and consistency of permission synchronization, and the first hash value provides a reliable comparison standard for subsequent synchronization operations to judge the synchronization state of different clusters. Compared with the prior art, the hash value is not only a data verification tool, but also has a higher credibility and anti-tampering ability in the role of permission synchronization, which enhances the security of the system. By obtaining the real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster, and obtaining the dynamic weight value of the corresponding cluster according to each real-time network delay data, CPU usage, memory occupancy and disk I / O load, real-time collection of the resource status of the cluster is the key to dynamic optimization based on the actual load of the cluster. Network delay and cluster load are the main reasons for the delay and inconsistency of multi-cluster permission synchronization. By introducing these real-time data, the system can intelligently judge the load status of the cluster and decide whether it should be synchronized first. The prior art often only makes synchronization judgments based on static configuration, while this step adjusts the synchronization priority automatically when the system load is high through real-time data collection and dynamic weight calculation, thereby reducing the synchronization delay and data inconsistency caused by resource limitations. The dynamic weight value of the cluster combines real-time network delay and resource usage, which can effectively quantify the synchronization priority of the cluster. By calculating the dynamic weight value and comparing it with the preset threshold, it can flexibly judge which clusters should join the priority synchronization group and which should be postponed. The prior art usually fixes the synchronization processing, ignoring the dynamic changes of the load and delay differences between clusters. Through dynamic weight scheduling, automatic optimization based on the current load status of the cluster is realized, thereby minimizing resource consumption and maximizing system efficiency.

[0084] By judging whether the dynamic weight value of each cluster is greater than the preset threshold value, if the dynamic weight value is greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster, if the dynamic weight value is not greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster, through the division of the priority synchronization group and the delay synchronization group, the intelligent scheduling of the cluster resources is realized, the clusters in the priority synchronization group will be processed with priority synchronization, so as to avoid the conflict of the synchronization operation under the condition of high load, and the delay synchronization group can postpone the operation to avoid unnecessary synchronization contention, the synchronization operation in the prior art is often static or globally consistent, and the optimization processing cannot be performed according to the actual load, through the cluster classification management, the synchronization resource competition between the clusters can be effectively avoided, the efficiency of the whole system is improved, by respectively acquiring the second hash value of the priority synchronization group cluster and the delay synchronization group cluster, and judging whether the second hash value of each cluster is consistent with the first hash value, if the second hash value is consistent with the first hash value, it is judged that the first current path branch of the cluster corresponding to the hash value is synchronized with the changed path branch, if the second hash value is not consistent with the first hash value, it is judged that the first current path branch of the cluster corresponding to the hash value is not synchronized with the changed path branch, and returns to the step of respectively acquiring the second hash value of the priority synchronization group cluster and the delay synchronization group cluster until the second hash value is consistent with the first hash value, if not, the difference data segment analysis and replacement step is re-executed, and the position offset or byte error in the data replacement process is checked until the calculation result is consistent with the first hash value (change check identifier), the generation of the second hash value and the consistency check step further ensure the accuracy and consistency of the synchronization operation, by performing the hash calculation on each path in the permission synchronization process and comparing with the first hash value, the problems in the synchronization process can be accurately identified, if the hash values are not consistent, it means that the synchronization of the path has not been completed and needs to be re-synchronized, in the prior art, the hash value is mainly used for data verification, but through the multiple hash value comparison, the present application ensures that the permission synchronization between the clusters remains consistent at any moment, prevents the inconsistency of the permission data caused by the delay or network problem, and ensures that the system can guarantee the final consistency in the permission synchronization process of each cluster, if the second hash value is not consistent with the first hash value, it means that there is a problem in the synchronization, the system will automatically retry until the consistency is restored, unlike the prior art, this retry mechanism combines the real-time resource load and network delay judgment to intelligently determine whether the synchronization needs to be re-tried, instead of simply relying on the fixed synchronization strategy, the present application can be dynamically adjusted according to the actual network and resource status, avoids redundant and inefficient synchronization attempts, and improves the stability of the whole system, in summary, the present application considers the real-time resource status, permission change record and network topology structure of multiple clusters, adopts the innovative radix tree model, dynamic priority judgment and hash value consistency check technical means,The common delay and inconsistency problems in the existing multi-cluster permission synchronization method are solved, through intelligent decision, real-time data collection, dynamic adjustment and adaptive fault tolerance mechanism, so that the system can efficiently and reliably complete the permission synchronization when facing complex network conditions and cluster load, and the permission synchronization mechanism based on real-time resource dynamic weight and path hash value verification provides higher accuracy, lower delay and stronger system stability.

[0085] In one embodiment, the step S1 of constructing an initial base tree model according to a plurality of network topologies and historical permission synchronization records comprises:

[0086] S11, obtaining the global permission domain, cluster identifier, resource type, resource object and permission item of the multi-cluster system, taking the global permission domain of the multi-cluster system as the root node, and constructing a hierarchical structure according to the hierarchical relationship of the cluster identifier, resource type, resource object and permission item, wherein the first-level child nodes correspond to each cluster identifier, the hardware configuration parameters (such as server model, CPU core number, memory capacity, etc.) of the cluster are associated with each identifier as node attributes for storage, the second-level child nodes correspond to the resource type (such as computing resource, storage resource, network resource, etc.) in the cluster, the node attributes include the hardware configuration details (such as disk capacity, read-write speed, etc.) of the resource type, the third-level child nodes correspond to specific resource objects (such as a server, a hard disk, a network port, etc.), the attribute fields record the hardware identifiers (such as device ID, IP address, etc.) of the objects, and the leaf nodes store specific permission items (such as read permission, write permission, management permission, etc.) and are associated with initial version numbers;

[0087] S12, adding network connection information in the attributes of each cluster identifier node (first-level child node) according to the network topology structure, recording the physical connection mode (such as direct connection, connection through switch, etc.) of the cluster and other clusters, storing the network bandwidth, default routing path and other parameters between clusters, and establishing an association pointer between the corresponding nodes for clusters with hierarchical relationship (such as parent cluster and child cluster) to reflect the topology hierarchy;

[0088] S13, extracting the permission change rule of each resource object from the historical permission synchronization record, optimizing the initial permission configuration of the leaf node, obtaining the optimized permission configuration, if the historical permission item of a resource object has not been changed for a long time, setting its default permission value as the historical stable value, adding a conflict marker attribute in the leaf node for the permission item with frequent conflicts in historical synchronization to provide a basis for subsequent synchronization strategy adjustment, and setting an initial weight coefficient (as the basis value for dynamic weight calculation) for each cluster identifier node based on the average delay time of historical synchronization;

[0089] S14, according to the above hierarchical structure, optimization of permission configuration, attribute configuration and association, the nodes are connected to form a complete initial base tree model by tree structure generation algorithm (such as tree construction method based on adjacency list).

[0090] As described in steps S11-S14, the application constructs a hierarchical structure by taking the global permission domain of the multi-cluster system as the root node, dividing nodes according to the hierarchical relationship of cluster identification, resource type, resource object, and permission item, and constructing a hierarchical structure of the multi-cluster system by taking the global permission domain as the root node. This can achieve unified management and control of resources. In the prior art, multi-cluster management usually adopts a single cluster management method, which cannot effectively handle permission synchronization and control problems between multiple clusters. By defining the global permission domain as the root node, a unified framework can be provided for permission allocation of multiple clusters at the top layer, avoiding the problem of management confusion caused by non-unified permission allocation. Existing methods often involve a lot of manual configuration when managing permissions between clusters, and lack global unified management. The application uses the global permission domain as the root node, and after structuring the permission and resource object hierarchy of the management cluster, it helps to reduce manual intervention and improve the automation and accuracy of permission management. This hierarchical structure allows the permission management system to decompose from the cluster identification to the resource object and permission item layer by layer. Each layer's node is associated with its specific resource or permission item, has a clear hierarchical structure, and is easy to manage and maintain. Through this hierarchical node division, the resource and permission configuration of each cluster can be clearly identified, avoiding permission confusion or repeated configuration. In existing cluster management methods, it is usually difficult to manage cluster resources by layers, resulting in permission redundancy and lack of targeted configuration. By dividing the permission items by layers, the application can more accurately adjust the permissions of each layer, thereby improving the flexibility and accuracy of permission configuration.

[0091] The first-level child node corresponds to each cluster identifier, and each identifier is associated with the hardware configuration parameter of the cluster as a node attribute storage. By storing the hardware configuration parameter of the cluster in the first-level child node, it can be ensured that the permission management system can dynamically adjust the permission configuration according to the hardware characteristics. The hardware configuration of the cluster is an important factor affecting the allocation of permissions. By storing the hardware configuration of the cluster, more targeted resource management can be achieved, and the problem of permission conflict or resource shortage between different hardware environments can be avoided. In the prior art, the hardware configuration of the cluster is often not closely combined with the permission management system, which may lead to the fact that the permission management does not consider the actual situation of the hardware configuration. By taking the hardware configuration as a node attribute, the system can more intelligently optimize the allocation of resource permissions according to the hardware conditions, and the performance and response speed of the system are improved. The second-level child node corresponds to the resource type in the cluster, and the node attribute includes the hardware configuration details of the resource type. In the cluster, the hardware configuration of the resource type will affect the use efficiency and performance of the resource. By storing the hardware configuration details in the node of the resource type, more accurate resource information can be provided for the permission management system, so as to improve the efficiency of resource use and avoid the permission conflict caused by excessive allocation or insufficient allocation of resources. The prior art does not make full use of the hardware details of the resource type, which may easily cause unbalanced resource allocation or unreasonable permission setting. However, the present application adds hardware details in the second-level node, which helps the system to optimize the permission configuration according to the hardware requirements of different resources and improve the resource utilization rate. The third-level child node corresponds to a specific resource object, and the attribute field records the hardware identifier of the object. By recording the node through the hardware identifier of the specific resource object, the hardware characteristics of each object can be accurately tracked at the resource level. This approach avoids the confusion and inaccuracy of permission allocation in large-scale resource management. The hardware identifier can help the system to identify the status and demand of different resource objects and achieve accurate resource management. The prior art often fails to accurately distinguish the hardware identifiers of different resources at the resource level, which leads to insufficient detail in the permission setting of the resources. By recording the hardware identifier in the third-level node, each resource object can be accurately identified, and the accuracy and efficiency of resource management are improved. The leaf node stores a specific permission item and is associated with an initial version number. By associating and storing the permission item and the initial version number in the leaf node, the history record of the permission change can be better tracked, and a basis for subsequent permission optimization is provided. The version control of the permission item ensures that the update and rollback of the permission are clearer and more traceable. In the traditional method, the permission update is difficult to trace and optimize, which may lead to inconsistent or incorrect configuration problems in frequent permission changes. However, the present application adds the version number in the leaf node, so that the permission change can be more systematically managed, thereby improving the efficiency and accuracy of the permission update.

[0092] By adding network connection information in the attribute of the first-level child node through the network topology structure, by adding network connection information, especially the physical connection mode and bandwidth parameters between clusters, the system can better understand the network performance and connection stability between clusters, which provides data support for optimizing network delay and bandwidth bottleneck in the permission synchronization process, helps to reduce synchronization delay and inconsistency, and the network connection information between clusters in the prior art is often not fully utilized, it is difficult to optimize in time when the network delay and load change, and the present application can dynamically adjust the permission synchronization strategy between clusters by adding network topology information in the node attribute, reduce the synchronization delay, improve the overall performance of the system, record the physical connection mode of the cluster and other clusters, store the network bandwidth, default routing path and other parameters between clusters, for clusters with hierarchical relationship, establish an association pointer between the corresponding nodes to reflect the topology hierarchy, by establishing the association pointer between the cluster nodes, the hierarchical relationship between the clusters can be clearly defined, and the physical and logical connection between the clusters can be reflected, this method makes the system better handle the dependency relationship between clusters during permission synchronization, avoids problems in permission management caused by changes in the topology between clusters, in the traditional method, the topology relationship between clusters is often not explicitly reflected, resulting in unstable permission synchronization between clusters, and the present application can ensure that the system clearly understands the hierarchical relationship between clusters, thereby improving the stability and consistency of permission synchronization between clusters;

[0093] By extracting the permission change rule of each resource object from the historical permission synchronization record, the initial permission configuration of the leaf node is optimized to obtain the optimized permission configuration, by extracting the permission change rule from the historical permission synchronization record, it can be identified which permission items are stable for a long time and which permission items are frequently changed, so that different permission optimization strategies are performed on different resource objects, which can significantly improve the accuracy and efficiency of permission management, especially in large-scale clusters, which can avoid redundancy and inconsistency of permission configuration, the existing method usually lacks analysis of historical permission change rules, so that permission management can only rely on static configuration and cannot cope with dynamic changes, and the present application can optimize according to the actual permission change trend, greatly improving the intelligence and self-adaptation ability of the system, by optimizing the initial permission configuration of the leaf node, the system can have high accuracy in initial configuration, avoiding frequent permission adjustment and correction in the later stage, which helps to reduce the debugging and maintenance work during system deployment, and improves the stability and reliability of the system, in the prior art, the initial configuration of the permission item usually lacks intelligent adjustment, which may lead to unreasonable initial permission configuration, thereby increasing the adjustment cost in the later stage, and the present application can ensure that the system has high configuration accuracy in the starting stage by optimizing the initial permission configuration, reducing the workload of subsequent optimization;

[0094] If the historical permission item of a resource object has not been changed for a long time, the default permission value of the resource object is set as the historical stable value, for the permission item that frequently conflicts in the historical synchronization, a conflict mark attribute is added in the leaf node to provide basis for subsequent synchronization strategy adjustment, based on the average delay time of the historical synchronization, initial weight coefficients are set for the identified nodes of each cluster, through the data of the historical delay time, reasonable initial weight coefficients are set to optimize the permission synchronization strategy among clusters, ensure that the priority of permission update matches the delay time, reduce invalid synchronization requests, the traditional synchronization method does not consider the delay factor, which may cause the synchronization request to still occur frequently in the case of large network delay, increase the system burden, and the present application sets the weight coefficient according to the historical delay time, which can speed up the synchronization when the network condition is good, and reduce the synchronization frequency when the network delay is high, so as to realize more intelligent and efficient permission management, through the above hierarchical structure, the optimization of permission configuration, attribute configuration and association relationship, the nodes are connected in series to form a complete initial base tree model through the tree structure generation algorithm, through the use of the tree structure generation algorithm, the information of multiple clusters, resources, permissions and networks can be efficiently connected to form a complete initial base tree model, and the structure has high expansibility and maintainability, facilitating subsequent permission management and optimization, the permission management structure in the prior art is usually scattered, and it is difficult to manage and expand efficiently, especially in the case of increasing clusters, which is easy to cause management confusion, and the generation of the tree structure model in the present application can connect all node information in order, so that the permission management structure of the whole system is more clear, and the tree structure is convenient for later modification, expansion and optimization, especially in the case of gradually expanding clusters, the tree structure can easily handle the newly added clusters or resources, while maintaining efficient management.

[0095] In one embodiment, the step S2 of generating a corresponding change record in the initial base tree model according to the specific operation type, resource location path and changed permission parameter in the permission change request comprises:

[0096] S21, receiving a permission change request through a request interface of a multi-cluster permission management system, and extracting a specific operation type, a resource location path and a changed permission parameter from the permission change request;

[0097] S22, obtaining the hierarchical structure of the resource location path, and starting from the root node of the initial base tree model and matching layer by layer according to the hierarchical structure, and the matching step is:

[0098] S23, locate the first-level child node corresponding to the cluster identifier in the resource location path, locate the second-level child node corresponding to the resource type under the first-level child node, locate the third-level child node corresponding to the resource object under the second-level child node, and find the leaf node storing the specific permission item corresponding to the changed permission parameter in the permission change request under the third-level child node;

[0099] S24, read the changed permission parameter currently stored by the leaf node;

[0100] S25, obtain the metadata according to the permission change request, and extract the initiator identifier according to the metadata;

[0101] S26, obtain the permission change time when the request interface of the multi-cluster permission management system receives the permission change request, and associate the permission change time, the initiator identifier, the changed permission parameter and the changed permission parameter to the corresponding leaf node to obtain the change record, and simultaneously assign a unique ID to the change record for subsequent synchronization tracking.

[0102] As described in the above steps S21-S26, the permission change request contains the initiator node identification information, the request subject content (including operation type, target resource path, and changed permission parameters), and the request timestamp (i.e., permission change time). Then, the system performs legality verification on the permission change request (such as verifying the permission management qualification of the initiator node and the completeness of the request format). After the verification is passed, the resolution process can be entered. The specific operation type is obtained by extracting the specific type of permission change from the request, including but not limited to adding permission, modifying permission, deleting permission, and adjusting the validity period of permission, which is used to clarify the operation logic of the target node. The resource positioning path is obtained by analyzing the resource positioning path in the request. The path needs to conform to the hierarchical structure of the initial base tree (i.e., root node, first-level child node, second-level child node, third-level child node, and leaf node). The changed permission parameters are obtained by extracting specific permission parameters, including operation permission, permission effective time, permission expiration time, and permission priority, which need to be consistent with the permission item format stored in the leaf node. Each leaf node uniquely corresponds to the detailed information of one permission. The permission change time is the current system time recorded by the system when generating the change record. Specifically, it is the real-time time when the permission change operation is received by the system and passes the legality verification, enters the resolution and leaf node positioning process, and is used to mark the specific moment when the permission change occurs, ensuring the uniqueness of the time dimension of the change record. The initiator node identification is derived from the header information or the initiator metadata carried in the request body of the permission change request, including the unique ID of the initiator node (previously assigned by the multi-cluster system to each node that can initiate permission change, with global uniqueness), the IP address of the initiator node (extracted from the source address of the request through the network protocol, used to locate the network location of the initiator node), and the initiator identity information (obtained by analyzing the identity authentication information carried in the request, used to confirm the permission qualification of the initiator);

[0103] The application receives a permission change request through the request interface of the multi-cluster permission management system, and extracts the specific operation type, resource location path and changed permission parameter from the permission change request. Through the receiving interface of the permission change request, the system can capture the specific operation type, resource location path and changed permission parameter and other key information of the permission change, ensuring that the system can accurately receive and analyze the information in the request, thereby avoiding error processing due to unclear request analysis. In the prior art, the permission request often lacks a systematic parameter extraction method, and the request is not analyzed in detail. The resource location may be inaccurate or the permission matching may be incorrect. By explicitly extracting the operation type, path and permission parameter, the system can accurately understand the permission change, avoiding delays or errors caused by improper request analysis. By obtaining the hierarchical structure of the resource location path and matching from the root node of the initial base tree model layer by layer, the traditional permission management system usually only handles surface path matching, which may ignore the hierarchical and structural relationship of the path, resulting in permission matching errors or missed matching. By obtaining the hierarchical structure of the resource location path and matching layer by layer, accurate positioning of the resource is achieved. The matching of each layer is not only based on the cluster identifier, resource type and object positioning, but also fully considers the hierarchical structure of the path, ensuring fine-grained matching of the resource. This layer-by-layer matching method is more detailed and reliable than traditional single path matching. By layer-by-layer matching, each resource location can be accurately locked, and more complex resource hierarchical structures can be adapted, reducing inconsistencies or errors;

[0104] The matching step is to locate the corresponding first-level child node through the cluster identifier in the resource location path, locate the corresponding second-level child node under the first-level child node according to the resource type, locate the corresponding third-level child node under the second-level child node according to the resource object, and find the leaf node storing the specific permission item corresponding to the changed permission parameter in the permission change request under the third-level child node. In the traditional permission management system, permission matching may be performed directly through a single resource identifier or cluster identifier, which may cause resource identifier conflicts in multiple clusters, or permission omission or incorrect matching in a resource structure with many levels. Through the multi-level node positioning method, the system can accurately start from the root node and search layer by layer downward, and accurately locate the permission item of each resource, ensuring that each permission request can be accurately positioned to the target resource in a complex multi-cluster environment, rather than relying on a simple matching condition. The step-by-step positioning of the child node improves the accuracy of multi-cluster permission management, especially when the resource hierarchy is complex, ensuring fine management of the system;

[0105] By reading the pre-change permission parameter currently stored in the leaf node, in the prior art, there is no direct storage of the pre-change permission parameter information or no explicit way to trace the data, and the present application clearly reads the pre-change permission parameter, so that each permission change can be clearly reflected in the system, which helps the data traceability and the audit function of the permission management. After positioning to the leaf node, the pre-change permission parameter currently stored is read, so that the process of permission change is more transparent, and the current permission state can be accurately recorded, which is crucial for subsequent permission change record and audit function, ensuring that the system can obtain the pre-change state in time, and track and backtrack the permission change through historical data;

[0106] The traditional permission management system often ignores the identification of the request initiation node by acquiring metadata through the permission change request and extracting the initiation node identification according to the metadata, lacks control and audit of the request source, which may lead to difficulty in tracing back to which node initiates the permission change request when the permission change is abnormal, and the present application can ensure the transparency of permission management and enhance the security and tamper-proofing capability by recording the initiation node identification, acquiring metadata and extracting the initiation node identification, ensuring the traceability of the source of the permission change request, which not only helps the system to track the source of each permission request, ensures the transparency and security of the permission change process, but also provides an important basis for subsequent permission audit, and the permission change time when the request interface of the multi-cluster permission management system receives the permission change request is acquired, and the permission change time, initiation node identification, pre-change permission parameter and post-change permission parameter are associated to the corresponding leaf node to obtain a change record, and a unique ID is assigned to the change record, in the prior art, there may be no mandatory requirement to assign a unique ID to each permission change or no accurate time record, which will affect the traceability of the permission management system, especially when there is a permission change dispute, there is a lack of effective basis, and the present application can accurately trace each permission change by assigning a unique ID to each change and recording the change time, avoiding the problems of data loss or inconsistent permission changes, by acquiring the timestamp of the permission change and assigning a unique ID, not only the time sequence of the permission change can be accurately recorded, but also a unique identifier can be assigned to each change, so that all permission change records can be searched and traced through the unique ID, ensuring the accuracy and traceability of each change operation, in the traditional technology, the change record may be stored separately in other database tables, and additional matching and association operations are required when querying, increasing the data access complexity, and the present application directly associates the permission change record with the leaf node, not only simplifying the query process, but also reducing the permission synchronization delay and inconsistency problems that may be caused by different data synchronization, associating the change record with the leaf node enables the change information to be directly stored in the corresponding resource permission item, which not only makes the permission change record more intuitive and easy to query, but also ensures the integrity and consistency of resource management.

[0107] In one embodiment, the step S4 of acquiring real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster and acquiring a dynamic weight value of the corresponding cluster according to each of the real-time network delay data, CPU usage, memory occupancy and disk I / O load comprises:

[0108] S41, sending a preset number of probe data packets to each cluster and recording the round trip time in real time, and acquiring real-time network delay data according to a plurality of the round trip times;

[0109] S42, acquire the process statistics file of each cluster, and acquire CPU user state time, system state time, idle time and IO waiting time according to the process statistics file;

[0110] S43, acquire CPU usage according to the CPU user state time, system state time, idle time and IO waiting time;

[0111] S44, acquire total memory, used memory and cache memory of each cluster, and acquire memory occupancy rate according to the ratio of the sum of the used memory and cache memory to the total memory;

[0112] S45, acquire disk read-write byte number rate and disk bandwidth of each cluster, and acquire disk I / O load according to the ratio of the disk read-write byte number rate to the disk bandwidth;

[0113] S46, respectively assign corresponding weight coefficients to real-time network delay data, CPU usage, memory occupancy rate and disk I / O load, and calculate the dynamic weight value of the corresponding cluster by weighted summation according to the real-time network delay data, CPU usage, memory occupancy rate, disk I / O load and their corresponding weight coefficients.

[0114] As described in the above steps S41-S46, when calculating real-time network delay data, the maximum value and the minimum value need to be removed before calculating the average value of all remaining round trip times to obtain the real-time network delay data. The calculation formula of CPU usage is: ; wherein, represents CPU usage, represents idle time, represents CPU user state time, represents system state time, Indicate the IO waiting time; before calculating the dynamic weight value, real-time network delay data, CPU usage, memory occupancy and disk I / O load need to be normalized standard processing, the application sends a preset number of probe data packets to each cluster and records the round trip time of each time in real time, and obtains real-time network delay data according to multiple round trip times, traditional delay monitoring may be affected by instantaneous fluctuations, and it is difficult to fully reflect the change of network quality, through the preset number of detections, the reliability of data is greatly improved, which is helpful for the system to make optimization adjustment according to the real network state, by sending a preset number of probe data packets and recording the round trip time of each time in real time, stable network delay data can be obtained in a long time, dynamic changes in the network environment can be fully captured, including short-time burst delay fluctuation and network congestion, accurate network delay is ensured, in the resource permission management of multiple clusters, the round trip time directly affects the real-time of data synchronization, through multiple detections, accidental network fluctuations can be effectively filtered out, an average and more stable network delay data is obtained, thereby reducing the permission synchronization error caused by delay;

[0115] By obtaining the process statistics file of each cluster, and obtaining CPU user state time, system state time, idle time and IO waiting time according to the process statistics file, by obtaining the process statistics file, the use of CPU in different states can be accurately analyzed, and the subdivision of user state time, system state time, idle time and IO waiting time makes the understanding of cluster load more comprehensive, which helps to accurately identify the performance bottleneck, and the CPU usage in different states reflects the current workload of the cluster, which can reflect the execution status of each process in the cluster in real time, so as to predict and optimize the load, analyzing various CPU times can help the system to judge whether there is unreasonable resource contention, such as excessive system call or frequent IO operation, so as to realize optimization configuration and improve the overall performance of the cluster. Through the monitoring of CPU state, potential problems of high system load can be found in time, avoiding the delay problem caused by insufficient resources in the synchronization process. By obtaining CPU usage rate through CPU user state time, system state time, idle time and IO waiting time, CPU usage rate is a comprehensive index considering multiple dimensions such as user state, system state and idle time, which helps to comprehensively analyze CPU load state. This comprehensive analysis can help the system to more accurately judge the current computing capacity of the cluster. High CPU usage rate usually indicates that the cluster load is too heavy or the computing task is busy. By calculating CPU usage rate, the computing resource status of the cluster can be monitored in real time, and the computing resource or task scheduling can be adjusted in time to avoid performance degradation due to resource overload. When the system detects abnormal CPU usage rate, it can actively trigger the load balancing mechanism to reasonably schedule tasks and improve the overall performance of the cluster. Compared with relying only on memory or disk usage to judge the load, CPU usage rate can more directly reflect the change of computing performance.

[0116] By obtaining the total memory, used memory and cache memory of each cluster, and obtaining the memory occupancy rate according to the ratio of the sum of used memory and cache memory to the total memory, memory is one of the core resources of cluster performance. By analyzing the total memory, used memory and cache memory in detail, the actual occupancy of cluster memory can be more accurately judged, and performance degradation caused by insufficient memory can be avoided. Although cache memory may occupy physical memory in some scenarios, it does not occupy actual computing resources. In the calculation of memory occupancy rate, cache memory is distinguished from used memory, which can better reflect the memory usage efficiency of the cluster. Through accurate calculation of memory occupancy rate, the system can adjust the memory allocation strategy in time to avoid swapping and overflow caused by high memory occupancy, thereby improving the utilization rate of cluster resources. Memory occupancy rate and CPU usage rate are often closely related. By jointly analyzing these two indicators, the bottleneck of the cluster can be more accurately identified, and reasonable resource scheduling can be made.

[0117] The disk I / O performance directly affects the data transmission and processing speed by obtaining the disk read-write byte rate and disk bandwidth of each cluster and obtaining the disk I / O load according to the ratio of the disk read-write byte rate to the disk bandwidth. By combining the disk read-write byte rate and the disk bandwidth, the read-write performance of the disk can be comprehensively evaluated to ensure that the cluster does not appear bottleneck when processing a large amount of data. The disk I / O load is too high, which will cause the performance of the whole system to decline, and even cause the system to crash. By monitoring the disk I / O load in real time, problems can be found in time and measures can be taken (such as expanding storage, adjusting data flow, etc.), reducing the risk of disk overload. The disk I / O load data can provide a basis for the optimization scheme of the disk, such as using more efficient storage devices or redesigning the storage layout, so as to improve the overall performance of the cluster. By respectively assigning corresponding weight coefficients to real-time network delay data, CPU usage, memory occupancy and disk I / O load, and performing weighted summation calculation according to the real-time network delay data, CPU usage, memory occupancy, disk I / O load and their corresponding weight coefficients, the dynamic weight value of the corresponding cluster is obtained. In multi-cluster resource permission management, network delay, CPU, memory, disk I / O and other factors will affect the performance. By assigning weight coefficients to each index, the comprehensive performance of each cluster can be comprehensively evaluated to ensure balanced scheduling of each resource. The resource status of different clusters is different, and the weighted summation method can dynamically adjust the weight of each cluster to reflect its current actual performance status. Compared with static resource allocation, the dynamic adjustment method can more flexibly adapt to changes in cluster load, avoid resource waste or deficiency, and help the system intelligently adjust resource allocation and permission synchronization strategy according to the real-time resource status of the cluster, thereby effectively avoiding synchronization delay and inconsistency problems caused by network delay or resource overload. Through multi-dimensional data collection and weighting algorithm, the present application can dynamically adjust resource allocation according to the real-time performance status of the cluster in the asynchronous synchronization process, solving the problems of permission synchronization delay and inconsistency caused by network delay and uneven load. Compared with the prior art, the present application can more accurately and flexibly manage resources, improving the cluster resource utilization rate and the overall reliability of the system.

[0118] In one embodiment, the step S6 of respectively obtaining the second hash value of the priority synchronization group cluster and the delay synchronization group cluster comprises:

[0119] S61, obtaining the first current path branch and the first change path branch of the priority synchronization group cluster, and extracting the first attribute field of all nodes in the first current path branch to obtain a first structured data set;

[0120] S62, extracting the second attribute field of all nodes in the first change path branch to obtain a second structured data set;

[0121] S63, transforming the first and second structured data sets into first and second binary data sequences respectively;

[0122] S64, obtaining a difference data segment according to the first and second binary data sequences, and performing a piecewise update on the first structured data set according to the difference data segment to obtain a first updated binary data sequence;

[0123] S65, obtaining a second change path branch of the delay synchronization group cluster, and locating a second current path branch of the delay synchronization group cluster according to the path identifier of the second change path branch;

[0124] S66, obtaining a second updated binary data sequence according to the second current path branch and the second change path branch, and obtaining a second hash value of the second updated binary data sequence and the first updated binary data sequence using the SHA-256 hash algorithm.

[0125] As described above in steps S61-S66, wherein the second hash value is a hash value corresponding to the delay synchronization group cluster and the priority synchronization group cluster calculated by the SHA-256 hash algorithm including the second updated binary data sequence and the first updated binary data sequence, the input of the SHA-256 algorithm is the complete binary stream of the data sequence B, and the output is a 256-bit fixed-length hash value, and the calculation process follows the compression function, constant and initial hash value setting of the SHA-256 standard, wherein the second updated binary data sequence is obtained in the same way as the first updated binary data sequence, that is, by generating a difference data segment through exclusive or operation between the binary data sequence of the second current path branch and the binary data sequence of the second change path branch, and then performing a piecewise update, and before obtaining the second updated binary data sequence from the delay synchronization group cluster, the change path branch data needs to be compressed and stored in the distributed cache system, and the cache address and expiration time are recorded, because the load state and synchronization priority of the priority synchronization group cluster and the delay synchronization group cluster are different, differential strategy is needed to balance the synchronization efficiency and system stability, specifically, the dynamic weight value of the delay synchronization group cluster is lower than the preset threshold, which is in a high load state, the synchronization priority of the delay synchronization group cluster is lower, a certain time delay is allowed, the complete path branch data is cached once by using compression storage, real-time transmission failure caused by high load is avoided, the volume of the compressed binary stream is smaller, which is suitable for temporary storage through the cache system, and then decompression processing is performed after the cluster load decreases, if the difference data segment is directly transmitted, the difference calculation result may be unstable due to the fluctuation of the cluster load (such as real-time change of the local path branch data), which increases the probability of inconsistent hash values;

[0126] The application can accurately locate the current synchronization and change state in the cluster by obtaining the first current path branch and the first change path branch of the priority synchronization group cluster, so as to ensure that the synchronization process is only concentrated on the critical path and the necessary change path, avoid the redundant calculation and invalid synchronization caused by full path traversal, and greatly improve the data processing efficiency compared with the full path synchronization mode that may be involved in the prior art, reduce the redundant data transmission, especially in the asynchronous cluster environment, effectively reduce the synchronization problems caused by network delay and cluster load, and extract the first attribute field of all nodes in the first current path branch to obtain the first structured data set, extract the second attribute field of all nodes in the first change path branch to obtain the second structured data set, extract the first attribute field of all nodes in the first current path branch, and focus on the key data field of the current path to reduce unnecessary data processing and storage burden, and extract the structured data field instead of the data of the entire path node, thereby improving the pertinence and accuracy of data processing and avoiding unnecessary field extraction, which is not refined to the node attribute level in the prior art, resulting in redundant calculation and data consistency problems in the synchronization process, and extracting the second attribute field of all nodes in the first change path branch can accurately obtain the specific attributes of the change part for synchronization.

[0127] By converting the first structured data set and the second structured data set into a first binary data sequence and a second binary data sequence respectively, the structured data is converted into a binary data sequence, so that the data can be efficiently and compactly transmitted and stored, the binary data has a smaller storage space and transmission burden, compared with the traditional text data format, the binary format can significantly reduce the transmission time of data in the network, especially in the asynchronous synchronization scene with high network delay, the efficiency and response speed of data synchronization can be significantly improved, the conversion processing of the binary format not only improves the transmission efficiency, but also guarantees the reliability and consistency of the data, the difference data segment is obtained through the first binary data sequence and the second binary data sequence, the difference data segment makes the synchronization process limited to the updated data, rather than synchronizing all data, by comparing the two binary data sequences, the difference between them can be accurately found, so that only the difference part is transmitted and updated, this differential synchronization method greatly improves the efficiency of the synchronization process, avoids the redundant data transmission and processing burden caused by full synchronization in the traditional method, and is especially important for high-concurrency and low-latency multi-cluster resource management systems;

[0128] According to the difference data segment, the first structured data set is updated piece by piece to obtain a first updated binary data sequence, a second changed path branch of the delayed synchronization group cluster is obtained, and a second current path branch of the delayed synchronization group cluster is located according to the path identifier of the second changed path branch, and a second updated binary data sequence is obtained through the second current path branch and the second changed path branch, and the piece-by-piece update operation ensures the granularity control of data synchronization, so that the update process is more flexible and accurate, and unlike the full update in the prior art, the piece-by-piece update can not only reduce the data transmission amount, but also avoid data conflict and inconsistency problems, especially in the case of complex cluster network environment and limited bandwidth, the piece-by-piece update can significantly reduce the bandwidth required for synchronization and improve the overall synchronization efficiency. This step-by-step update mode improves the fault tolerance and real-time performance of the system, and is particularly suitable for large-scale distributed systems, and by generating the updated binary data sequence, it is ensured that all updated data in the synchronization process has been accurately identified and processed, and the update data sequence provides a clear basis for subsequent synchronization operations, reduces the risk of data loss and error update, and compared with the global update in the prior art, the update binary sequence of the application can make each cluster obtain necessary update information and avoid interference of too much irrelevant data, thereby improving the update efficiency and accuracy;

[0129] The second hash value of the second updated binary data sequence and the first updated binary data sequence is obtained by using the SHA-256 hash algorithm, the updated binary data sequence is hashed by using the SHA-256 hash algorithm, which can ensure the integrity and consistency of the data, and the irreversibility of the SHA-256 hash algorithm can accurately verify each update step in the synchronization process and trace the error source when a problem occurs, which can ensure the safety and consistency of the update data compared with the method that may ignore the hash check in the prior art, and can avoid data damage or error synchronization caused by network problems, cluster failures and other external factors, thereby effectively solving the synchronization delay and permission inconsistency problems caused by network delay, cluster load and other factors in multi-cluster resource permission management.

[0130] In one embodiment, the step S64 of obtaining the difference data segment according to the first binary data sequence and the second binary data sequence comprises:

[0131] S641, performing byte-by-byte exclusive or operation on the first binary data sequence and the second binary data sequence to obtain a difference data sequence;

[0132] S642, traverse the difference data sequence and record the difference segment start position and difference segment length of continuous non-zero bytes to obtain a difference segment information list, wherein the difference segment information list includes a plurality of difference segments whose start positions are sorted in ascending order;

[0133] S643, extract the byte data at the corresponding position in the first change path branch according to each difference segment to obtain a data block, and splice a plurality of the data blocks in the order of the difference segment information list to obtain a spliced data block;

[0134] S644, obtain the number of difference segments of the difference segment information list, and splice the number of difference segments, difference segment start positions, difference segment lengths, and spliced data blocks in order to obtain a difference data segment.

[0135] As described in steps S641-S644, wherein the order of the difference segment information list is sorted in ascending order according to the start positions of the difference segments in the binary data sequence, that is, the difference segments are arranged in the order of their appearance in the binary data sequence of the first current path branch of the target cluster. The order of splicing the number of difference segments, difference segment start positions, difference segment lengths, and spliced data blocks to obtain a difference data segment is to write the number of difference segments first, then the start position of each difference segment, then the length of each difference segment, and finally the spliced data block to obtain the difference data segment. Then, the difference data segment needs to be CRC32 checked, the check value is calculated and attached at the end of the data segment for the receiving end to verify the data integrity. The binary data sequence refers to the byte stream set formed by digitizing the complete path branch (the hierarchical data from the cluster identification node to the specific permission item leaf node) corresponding to the permission change request in the local radix tree copy of the primary synchronization group cluster. The binary data sequence can be determined by matching the corresponding nodes layer by layer in the local radix tree copy of the target cluster according to the target resource path in the permission change request, then traversing all nodes of the path branch, extracting the attribute field of each node to form a structured data set, and finally converting the structured data set into a continuous binary byte sequence using a preset serialization protocol. If the path branch data length is less than the preset value, it is filled with fixed bytes to complete it. If it exceeds the preset value, it is compressed using a lossless compression algorithm to form the final binary data sequence, ensuring that the sequence length is uniform and comparable.

[0136] The application can accurately capture the bit-by-bit difference between the two data sequences by performing byte-by-byte XOR operation on the first binary data sequence and the second binary data sequence, which is different from the traditional comparison method. This method can accurately capture the change of each byte, rather than relying on simple bit or byte level comparison. This accuracy helps to reduce errors, especially when the data sequence is long or complex, which can avoid misjudgment. The difference data sequence can be quickly generated by XOR operation without complex multiple comparison process, saving computing resources. Unlike traditional byte-by-byte comparison, XOR operation is a highly parallel operation that can improve overall efficiency. XOR operation directly converts the same byte position to zero, effectively eliminating redundant data and focusing only on the difference part of the data, thereby reducing the computational burden in subsequent processing. The commonly used comparison method in the prior art may rely on string matching, hash value comparison, etc., which is often inefficient when the data volume is large, or produces a large delay in the synchronization update process. The present application can directly obtain the difference data sequence through XOR operation, thereby speeding up subsequent processing;

[0137] By traversing the difference data sequence and recording the starting position and length of the continuous non-zero byte difference segment, a difference segment information list is obtained, wherein the difference segment information list includes a plurality of difference segments with the difference segment starting positions sorted from small to large. Recording the continuous non-zero byte difference segment can effectively reduce the storage space occupation and highlight the data blocks that have differences in multiple positions. Compared with the traditional method, the single byte redundancy record is avoided, and the data storage structure can be further optimized. The continuous difference bytes are aggregated into a difference segment, which can effectively reduce the complexity of subsequent data processing. In the subsequent splicing, modification, update and other processes, the amount of data to be operated is reduced, thereby improving the processing speed. By recording the starting position and length of the difference segment, the data segment to be operated can be accurately specified during data transmission or update, avoiding unnecessary data transmission and calculation, and improving the transmission efficiency. The traditional method may need to compare and transmit byte by byte, which will lead to inefficiency and inconsistency in large-scale data synchronization process. The present application reduces the complexity and delay of data processing by aggregating the difference segments. The difference segment information list is sorted by starting position to ensure that the subsequent splicing operation is performed in the correct order, which can avoid data disorder or splicing error during processing, and ensure that the finally generated data block is accurate. By sorting the difference segments, the final synchronized data block can be successfully and efficiently spliced and updated. After sorting the difference segment starting positions, the system can execute tasks more orderly, avoiding conflicts during multi-thread operation or cluster data processing, thereby improving the stability of concurrent processing;

[0138] The data blocks are obtained by extracting byte data corresponding to the position in the first change path branch from each difference segment, and the spliced data blocks are obtained by splicing a plurality of data blocks in the order of the difference segment information list. By extracting and splicing the byte data related to the difference segment, it can be ensured that the permission change data only includes the necessary part, avoiding unnecessary data redundancy and processing. For large-scale data update, excessive repeated calculation is avoided, and efficiency is improved. By splicing the data blocks in the order of the difference segment, the consumption of memory and computing resources can be minimized. In the process of synchronizing multiple clusters, the bandwidth occupation and memory pressure can be effectively reduced. The splicing operation ensures the integrity of the data blocks, avoiding inconsistency of permissions due to loss or disorder in the data synchronization process. The prior art may be relatively rough in data synchronization, which may result in a too large range of synchronized data, thereby affecting efficiency. By finely splicing the difference data, the data synchronization accuracy and speed can be effectively improved.

[0139] By obtaining the number of difference segments of the difference segment information list, and splicing the number of difference segments, the starting position of the difference segment, the length of the difference segment, and the spliced data blocks in order to obtain the difference data segment, the difference data can be accurately described and synchronized by recording the number of difference segments, the starting position, the length, and other information. This not only ensures the accuracy of data synchronization, but also helps the system to efficiently synchronize and update data in a multi-cluster environment. By splicing the number of difference segments, the position, the length, and the data blocks together, the number of communications and data transmissions can be reduced, the synchronization efficiency can be improved, and the amount of data transmitted between clusters is compressed, thereby reducing the network burden. The difference data segment obtained by splicing can be used as the basis for incremental update, avoiding unnecessary repeated calculation caused by full update. Incremental update helps to quickly respond to permission change requirements and shorten update delay. Traditional permission synchronization methods often rely on full update or complex permission record management, resulting in synchronization delay and inconsistency problems. Through the incremental synchronization method of the present application, efficiency can be significantly improved, network delay can be reduced, and the inconsistency problem of the prior art in permission synchronization can be solved.

[0140] As shown in Figure 2 The application also provides a multi-cluster resource permission management system based on a radix tree, which comprises:

[0141] A construction module is configured to obtain network topological structures and historical permission synchronization records of a plurality of clusters in a multi-cluster system, and construct an initial radix tree model according to the plurality of network topological structures and historical permission synchronization records. The initial radix tree model comprises a root node, a first-level child node, a second-level child node, a third-level child node, and a leaf node.

[0142] The generating module is configured to obtain a permission change request of each cluster, and generate a corresponding change record in an initial base tree model according to a specific operation type, a resource location path, and a changed permission parameter in the permission change request;

[0143] The extracting module is configured to extract a complete path branch of each change record, and obtain a first hash value of the complete path branch;

[0144] The obtaining module is configured to obtain real-time network delay data, CPU usage, memory occupancy, and disk I / O load of each cluster, and obtain a dynamic weight value of a corresponding cluster according to the real-time network delay data, CPU usage, memory occupancy, and disk I / O load of each cluster;

[0145] The first judging module is configured to judge whether the dynamic weight value of each cluster is greater than a preset threshold value;

[0146] If the dynamic weight value is greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster.

[0147] If the dynamic weight value is not greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster.

[0148] The second judging module is configured to obtain a second hash value of the priority synchronization group cluster and the delay synchronization group cluster respectively, and judge whether the second hash value of each cluster is consistent with the first hash value.

[0149] If the second hash value is consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is synchronized with the changed path branch.

[0150] If the second hash value is not consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is not synchronized with the changed path branch, and the step of obtaining the second hash value of the priority synchronization group cluster and the delay synchronization group cluster respectively is returned until the second hash value is consistent with the first hash value.

[0151] In one embodiment, the generating module comprises:

[0152] The extracting unit is configured to receive a permission change request through a request interface of a multi-cluster permission management system, and extract a specific operation type, a resource location path, and a changed permission parameter from the permission change request;

[0153] The matching unit is configured to obtain a hierarchical structure of the resource location path, and match layer by layer from a root node of an initial base tree model according to the hierarchical structure, and read a changed permission parameter stored in a leaf node.

[0154] The acquisition unit is configured to acquire metadata according to the permission change request, and extract an initiating node identifier according to the metadata;

[0155] The association generation unit is configured to acquire a permission change time when a request interface of the multi-cluster permission management system receives the permission change request, and associate the permission change time, the initiating node identifier, the pre-change permission parameter, and the post-change permission parameter to a corresponding leaf node to obtain a change record.

[0156] It should be noted that each module and unit in the multi-cluster resource permission management system based on the radix tree corresponds to a step in the multi-cluster resource permission management method based on the radix tree.

[0157] As shown in Figure 3 The present application also provides a computer device, which can be a server, and the internal structure thereof can be as shown in Figure 3 The computer device includes a processor, a memory, a network interface, and a database connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store all data required by the process of the multi-cluster resource permission management method based on the radix tree. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the multi-cluster resource permission management method based on the radix tree.

[0158] Those skilled in the art can understand that Figure 3 The structure shown in the above description is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied.

[0159] An embodiment of the present application also provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by the processor to implement any one of the above multi-cluster resource permission management methods based on the radix tree.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, storage, databases, or other media in this application and in examples used herein, unless specifically stated otherwise, can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct RAM bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0161] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, device, article, or method that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, device, article, or method. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, device, article, or method that includes the element.

[0162] The above description is only the preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, based on the content of the present application specification and drawings, is also included in the patent protection scope of the present application.

Claims

1. A method for managing permissions of multi-cluster resources based on a radix tree, characterized in that, The method comprises the following steps: acquiring network topologies and historical permission synchronization records of multiple clusters in a multi-cluster system, and constructing an initial base tree model according to the multiple network topologies and historical permission synchronization records, wherein the initial base tree model comprises a root node, a first-level child node, a second-level child node, a third-level child node and a leaf node; acquiring permission change requests of each cluster, and generating corresponding change records in the initial base tree model according to specific operation types, resource location paths and post-change permission parameters in the permission change requests; extracting a complete path branch of each change record, and acquiring a first hash value of the complete path branch; acquiring real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster, and acquiring a dynamic weight value of the corresponding cluster according to the real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster; judging whether the dynamic weight value of each cluster is greater than a preset threshold value; if the dynamic weight value is greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster; if the dynamic weight value is not greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster; acquiring second hash values of the priority synchronization group cluster and the delay synchronization group cluster respectively, and judging whether the second hash value of each cluster is consistent with the first hash value; if the second hash value is consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is synchronized with the post-change path branch; if the second hash value is not consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is not synchronized with the post-change path branch, and the step of acquiring the second hash values of the priority synchronization group cluster and the delay synchronization group cluster respectively is returned until the second hash value is consistent with the first hash value.

2. The radix tree based multi-cluster resource permission management method of claim 1, wherein, The step of constructing an initial base tree model according to multiple network topologies and historical permission synchronization records comprises: acquiring a global permission domain, a cluster identifier, a resource type, a resource object and a permission item of a multi-cluster system, and constructing a hierarchical structure with the global permission domain of the multi-cluster system as a root node, the cluster identifier as a first-level child node, the resource type as a second-level child node, the resource object as a third-level child node, and the permission item as a leaf node; adding network connection information in the attribute of the first-level child node according to the network topology; extracting permission change rules of each resource object from the historical permission synchronization records, and optimizing the initial permission configuration of the leaf node according to each permission change rule to obtain an optimized permission configuration; connecting each node to form a complete initial base tree model through a tree structure generation algorithm according to the hierarchical structure, the network connection information and the optimized permission configuration.

3. The radix tree based multi-cluster resource permission management method of claim 1, wherein, The step of generating corresponding change records in the initial base tree model according to specific operation types, resource location paths and post-change permission parameters in the permission change requests comprises: receiving a permission change request through a request interface of a multi-cluster permission management system, and extracting specific operation types, resource location paths and post-change permission parameters from the permission change request; Obtain the hierarchy of the resource location path, and match from the root node of the initial base tree model according to the hierarchy, and read the pre-change permission parameters currently stored in the leaf node located; Obtain the metadata according to the permission change request, and extract the initiating node identifier according to the metadata; Obtain the permission change time when the request interface of the multi-cluster permission management system receives the permission change request, and associate the permission change time, the initiating node identifier, the pre-change permission parameters and the post-change permission parameters to the corresponding leaf node to obtain the change record.

4. The radix tree based multi-cluster resource permission management method of claim 1, wherein, Obtain the real-time network delay data, CPU usage rate, memory occupancy rate and disk I / O load of each cluster, and obtain the dynamic weight value of the corresponding cluster according to each of the real-time network delay data, CPU usage rate, memory occupancy rate and disk I / O load, including: Send a preset number of probe data packets to each cluster and record the real-time round trip time each time, and obtain the real-time network delay data according to a plurality of the round trip times; Obtain the process statistics file of each cluster, and obtain the CPU user state time, system state time, idle time and IO waiting time according to the process statistics file; Obtain the CPU usage rate according to the CPU user state time, system state time, idle time and IO waiting time; Obtain the total memory, used memory and cache memory of each cluster, and obtain the memory occupancy rate according to the total memory, used memory and cache memory; Obtain the disk read / write byte number rate and disk bandwidth of each cluster, and obtain the disk I / O load according to the disk read / write byte number rate and disk bandwidth; Respectively assign a corresponding weight coefficient to the real-time network delay data, CPU usage rate, memory occupancy rate and disk I / O load, and obtain the dynamic weight value of the corresponding cluster according to the real-time network delay data, CPU usage rate, memory occupancy rate, disk I / O load and the corresponding weight coefficients thereof.

5. The radix tree based multi-cluster resource permission management method of claim 1, wherein, The steps of respectively obtaining the second hash value of the priority synchronization group cluster and the delay synchronization group cluster, including: Obtain the first current path branch and the first change path branch of the priority synchronization group cluster, and extract the first attribute field of all nodes in the first current path branch to obtain a first structured data set; Extract the second attribute field of all nodes in the first change path branch to obtain a second structured data set; Convert the first structured data set and the second structured data set into a first binary data sequence and a second binary data sequence, respectively; Obtain the difference data segment according to the first binary data sequence and the second binary data sequence, and update the first structured data set by segment according to the difference data segment to obtain a first updated binary data sequence; Obtain the second change path branch of the delay synchronization group cluster, and locate the second current path branch of the delay synchronization group cluster according to the path identifier of the second change path branch; According to the second current path branch and the second changed path branch, a second updated binary data sequence is obtained, and a second hash value of the second updated binary data sequence and the first updated binary data sequence is obtained by using a SHA-256 hash algorithm.

6. The radix tree based multi-cluster resource permission management method of claim 5, wherein, The step of obtaining the difference data segment according to the first binary data sequence and the second binary data sequence comprises: performing byte-by-byte exclusive or operation on the first binary data sequence and the second binary data sequence to obtain a difference data sequence; traversing the difference data sequence and recording the difference segment start position and the difference segment length of continuous non-zero bytes to obtain a difference segment information list, wherein the difference segment information list comprises a plurality of difference segments sorted in ascending order of difference segment start position; extracting byte data at a corresponding position in the first changed path branch according to each difference segment to obtain a data block, and splicing a plurality of the data blocks in the order of the difference segment information list to obtain a spliced data block; obtaining the number of difference segments of the difference segment information list, and splicing the number of difference segments, the difference segment start position, the difference segment length and the spliced data block in order to obtain the difference data segment.

7. A radix tree based multi-cluster resource permission management system for implementing the method of any one of claims 1 to 6, characterized in that, comprise: a construction module configured to obtain network topology structures and historical permission synchronization records of a plurality of clusters in a multi-cluster system, and to construct an initial base tree model according to the plurality of network topology structures and historical permission synchronization records, wherein the initial base tree model comprises a root node, a first-level child node, a second-level child node, a third-level child node and a leaf node; a generation module configured to obtain permission change requests of each cluster, and to generate corresponding change records in the initial base tree model according to a specific operation type, a resource location path and a changed permission parameter in the permission change request; an extraction module configured to extract a complete path branch of each change record, and to obtain a first hash value of the complete path branch; an obtaining module configured to obtain real-time network delay data, CPU usage, memory occupancy and disk I / O load of each cluster, and to obtain a dynamic weight value of a corresponding cluster according to each real-time network delay data, CPU usage, memory occupancy and disk I / O load; a first judgment module configured to judge whether the dynamic weight value of each cluster is greater than a preset threshold value; if the dynamic weight value is greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a priority synchronization group cluster; if the dynamic weight value is not greater than the preset threshold value, the cluster corresponding to the dynamic weight value is divided into a delay synchronization group cluster; a second judgment module configured to obtain second hash values of the priority synchronization group cluster and the delay synchronization group cluster respectively, and to judge whether the second hash value of each cluster is consistent with the first hash value; if the second hash value is consistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is synchronized with the changed path branch. If the second hash value is inconsistent with the first hash value, it is determined that the first current path branch of the cluster corresponding to the hash value is not synchronized with the changed path branch, and the step of obtaining the second hash value of the priority synchronization group cluster and the delayed synchronization group cluster respectively is returned until the second hash value is consistent with the first hash value.

8. The radix tree based multi-cluster resource permission management system of claim 7, wherein, The generation module comprises: The extraction unit is configured to receive a permission change request through a request interface of the multi-cluster permission management system, and extract a specific operation type, a resource location path, and a changed permission parameter from the permission change request. The matching unit is configured to obtain a hierarchical structure of the resource location path, and match from a root node of an initial radix tree model layer by layer according to the hierarchical structure, and read a pre-change permission parameter stored in a leaf node. The acquisition unit is configured to acquire metadata according to the permission change request, and extract an initiating node identifier according to the metadata. The association generation unit is configured to obtain a permission change time when the request interface of the multi-cluster permission management system receives the permission change request, and associate the permission change time, the initiating node identifier, the pre-change permission parameter, and the changed permission parameter to the corresponding leaf node to obtain a change record. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 6.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

Images