Computing resource access method and device, computer equipment and storage medium

Abstract

The invention relates to a computing resource access method and device, computer equipment and a storage medium. The method comprises the steps that an access control function module of an information center network responds to a computing resource access request initiated by proxy service of a target computing resource, and a computing resource online broadcast packet generated by the proxy service and carried in the computing resource access request is acquired; obtaining resource information of the target computing resource from the computing resource online broadcast packet, and generating a computing resource identifier of the target computing resource according to the resource information; and storing the resource information and the computing resource identifier into a distributed cache function module of the information center network so as to complete access registration of the target computing resource. By adopting the method, the computing resources can be accessed to the information center network.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a computing resource access method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of communication technology, a network architecture centered on information (data, resources, services, etc.) has emerged, namely the information-centric network. This network optimizes large-scale content distribution and traffic balancing through technologies such as decoupling content and location and built-in caching. This network can improve network efficiency and security through content naming routing mechanisms.

[0003] In traditional technologies, information-centric networks are typically used to access network resources, such as storage devices and routers. However, for accessing other types of resources, such as computing resources like CPUs, GPUs, FPGAs, and network links, there are resource management problems such as low access efficiency and delayed status updates. Therefore, there is an urgent need for a method to access computing resources to information-centric networks. Summary of the Invention

[0004] Therefore, it is necessary to provide a computing resource access method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can enable the access of computing resources to an information center network, addressing the aforementioned technical problems.

[0005] Firstly, this application provides a computing resource access method, applied to an access control function module of an information center network, comprising:

[0006] In response to a computing resource access request initiated by the proxy service of the target computing resource, obtain the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request;

[0007] The resource information of the target computing resource is obtained from the online broadcast packet of the computing resource, and a computing resource identifier of the target computing resource is generated based on the resource information.

[0008] The resource information and the computing resource identifier are stored in the distributed cache module of the information center network to complete the access registration of the target computing resource.

[0009] In one embodiment, the resource information includes: the resource type of the target computing resource, the core capability attribute information of the target computing resource, and geographic partition information for characterizing the physical location of the target computing resource; generating a computing resource identifier for the target computing resource based on the resource information includes: generating a checksum for the target computing resource based on the resource type, the core capability attribute information, and the geographic partition information; obtaining a pre-set initial state version number; and generating a computing resource identifier for the target computing resource using the resource type, the core capability attribute information, the geographic partition information, the checksum, and the initial state version number.

[0010] In one embodiment, if the computing resource online broadcast packet carries a temporary resource identifier to characterize the target computing resource as a temporary resource, generating the computing resource identifier of the target computing resource using the resource type, the core capability attribute information, the geographic partition information, the checksum, and the initial state version number includes: obtaining the temporary license duration of the target computing resource; constructing the computing resource identifier using the resource type, the core capability attribute information, the geographic partition information, the checksum, the initial state version number, and the temporary license duration; the temporary license duration in the computing resource identifier is used to instruct the distributed caching function module to cancel the computing resource identifier and send a resource offline notification for the target computing resource if the current time exceeds the temporary license duration.

[0011] In one embodiment, the online broadcast packet for computing resources further includes: a logical resource pool identifier associated with the target computing resource; the step of storing the resource information and the computing resource identifier in the distributed caching function module of the information center network to complete the access registration of the target computing resource includes: storing the resource information and the computing resource identifier in the distributed caching function module of the information center network and binding the logical resource pool identifier to complete the access registration of the target computing resource.

[0012] In one embodiment, before generating the computing resource identifier of the target computing resource based on the resource information, the method further includes: receiving a digital certificate of the target computing resource sent by the proxy service; the digital certificate being sent to the proxy service by a certification authority; verifying the digital certificate; if the digital certificate verification is successful, obtaining the real-time resource status of the target computing resource; and generating the computing resource identifier of the target computing resource if the real-time resource status of the target computing resource meets the target access rules.

[0013] In one embodiment, before generating the computing resource identifier of the target computing resource when the real-time resource status of the target computing resource meets the target access rule, the method further includes: obtaining the resource type of the target computing resource from the resource information; obtaining a resource access rule that matches the resource type from a pre-built mapping relationship, and using it as the target access rule; the mapping relationship stores the correspondence between different resource types and different resource access rules.

[0014] In one embodiment, the digital certificate carries a public key and the validity period information of the digital certificate; the certificate verification of the digital certificate includes: using the public key to perform signature verification on the digital certificate and obtaining the signature verification result of the digital certificate; using the validity period information to perform validity verification on the digital certificate and obtaining the validity period verification result of the digital certificate; if both the signature verification result and the validity period verification result indicate that the verification is successful, the digital certificate is determined to be verified successfully.

[0015] In one embodiment, the computing resource identifier carries a status version number of the target computing resource; after storing the resource information and the computing resource identifier in the distributed caching module of the information center network to complete the access registration of the target computing resource, the method further includes: responding to a resource attribute data update request initiated by the proxy service, obtaining resource attribute update data matching the resource attribute data update request; obtaining an update status version number based on the resource attribute update data, and sending a resource update message carrying the computing resource identifier, the update status version number, and the resource attribute update data to the distributed caching module; the resource update message is used to instruct the distributed caching module to verify the update status version number, and after the verification is successful, update the computing resource identifier using the update status version number, and store the updated computing resource identifier and the resource attribute update data.

[0016] In one embodiment, the status version number includes a major version number and a minor version number; obtaining the update status version number based on the resource attribute update data includes: incrementing the major version number to obtain the update status version number when the resource attribute update data represents an update to the core capability attribute information of the target computing resource; and incrementing the minor version number to obtain the update status version number when the resource attribute update data represents an update to the real-time attribute information of the target computing resource.

[0017] Secondly, this application also provides a computing resource access device, applied to an access control function module of an information center network, comprising:

[0018] The access request response module is used to respond to a computing resource access request initiated by the proxy service of the target computing resource and obtain the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request.

[0019] The resource identifier generation module is used to obtain the resource information of the target computing resource from the computing resource online broadcast packet, and generate the computing resource identifier of the target computing resource based on the resource information;

[0020] The computing resource access module is used to store the resource information and the computing resource identifier into the distributed cache function module of the information center network to complete the access registration of the target computing resource.

[0021] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any embodiment of the first aspect.

[0022] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any embodiment of the first aspect.

[0023] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any embodiment of the first aspect.

[0024] The aforementioned computing resource access method, apparatus, computer equipment, computer-readable storage medium, and computer program product respond to a computing resource access request initiated by a proxy service of a target computing resource through the access control function module of the information center network. They obtain a computing resource online broadcast packet generated by the proxy service carried in the computing resource access request; extract resource information of the target computing resource from the computing resource online broadcast packet; and generate a computing resource identifier for the target computing resource based on the resource information. The resource information and the computing resource identifier are then stored in the distributed caching function module of the information center network to complete the access registration of the target computing resource. In this embodiment, when a target computing resource needs to access the information center network, a computing resource online broadcast packet is generated through the proxy service of the target computing resource. This packet is used to construct a computing resource access request, which is sent to the proxy service. The proxy service responds to the request, receives the computing resource online broadcast packet, extracts the resource information of the target computing resource from it, generates a computing resource identifier, and then stores the resource information and the computing resource identifier in the distributed caching function module of the information center network. This method enables computing resource access to the information center network. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart illustrating a computing resource access method in one embodiment;

[0027] Figure 2 This is a schematic diagram of the process for generating a computing resource identifier for a target computing resource in one embodiment;

[0028] Figure 3 This is a schematic diagram of the process for verifying target computing resources in one embodiment;

[0029] Figure 4 This is a schematic diagram of the process for updating target computing resources in one embodiment;

[0030] Figure 5 This is a diagram of an ICN system architecture for intelligent scheduling of computing resources in one embodiment.

[0031] Figure 6 This is a schematic diagram of the new resource access process in one embodiment;

[0032] Figure 7This is a schematic diagram of the existing resource status update process in one embodiment;

[0033] Figure 8 This is a structural block diagram of a computing resource access device in one embodiment;

[0034] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0036] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0037] In one embodiment, such as Figure 1 As shown, a method for accessing computing resources is provided. This embodiment illustrates the application of this method to the access control function module of an information center network. In this embodiment, the method includes the following steps:

[0038] Step S101: In response to the computing resource access request initiated by the proxy service of the target computing resource, obtain the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request.

[0039] The target computing resource refers to the computing resource that needs to access the information center network. The proxy service refers to the resource agent built into the target computing resource. This proxy service is a lightweight software module deployed within the computing resource, responsible for automated operations such as resource status monitoring, sending online requests, and reporting status updates. It is the core carrier for resource-system interaction. A computing resource access request refers to a request to connect the target computing resource to the information center network; this request can be initiated proactively by the proxy service. The computing resource online broadcast packet is a "resource online broadcast packet" generated by the proxy service based on the LMMP extended protocol, carrying information related to the target computing resource.

[0040] Specifically, when a target computing resource needs to access the information center network, a computing resource online broadcast packet can be generated through the built-in proxy service, and a computing resource access request can be initiated to the access control function module of the information center network. After receiving the request, the access control function module can respond to the request and obtain the aforementioned computing resource online broadcast packet from the computing resource access request.

[0041] Step S102: Obtain the resource information of the target computing resource from the computing resource online broadcast packet, and generate the computing resource identifier of the target computing resource based on the resource information.

[0042] Resource information refers to information related to the target computing resource. This information can be stored in the computing resource online broadcast packet, while the computing resource identifier is used to uniquely identify the target computing resource. Specifically, after receiving the computing resource online broadcast packet, the access control function module can also extract the resource information of the target computing resource from it, and then use the resource information to generate the computing resource identifier of the target computing resource.

[0043] Step S103: Store the resource information and computing resource identifier into the distributed cache function module of the information center network to complete the access registration of the target computing resource.

[0044] The distributed caching module is a caching module used to store information related to computing resources accessing the information center network. After obtaining the resource information and computing resource identifier, the access control module can also store the resource information and computing resource identifier into the distributed caching module of the information center network, thereby completing the access and registration of the target computing resource.

[0045] In the aforementioned computing resource access method, the access control function module of the information center network responds to the computing resource access request initiated by the proxy service of the target computing resource, obtains the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request, retrieves the resource information of the target computing resource from the computing resource online broadcast packet, and generates a computing resource identifier for the target computing resource based on the resource information, and stores the resource information and computing resource identifier in the distributed cache function module of the information center network to complete the access registration of the target computing resource. In this embodiment, when the target computing resource needs to access the information center network, the proxy service of the target computing resource generates a computing resource online broadcast packet, thereby using the resource online broadcast packet to construct a computing resource access request and send it to the proxy service. The proxy service can respond to the request, obtain the computing resource online broadcast packet, extract the resource information of the target computing resource from it, generate a computing resource identifier, and then store the resource information and computing resource identifier in the distributed cache function module of the information center network. In this way, the access of the computing resource to the information center network is realized.

[0046] In one embodiment, the resource information includes: the resource type of the target computing resource, the core capability attribute information of the target computing resource, and geographic partitioning information representing the physical location of the target computing resource; such as Figure 2 As shown, step S102 may further include:

[0047] Step S201: Generate a check code for the target computing resource based on the resource type, core capability attribute information, geographical partition information, and initial state version number.

[0048] Resource type can be used to characterize the type of target computing resource. For example, the target computing resource can be a GPU, storage node, or CPU, etc. This resource type can be used to distinguish between major categories and subcategories of intelligent computing resources. Core capability attribute information can be used to quantitatively describe the core capabilities of the target computing resource. For example, for a GPU, its core capability attribute information can refer to the GPU's computing power and video memory, etc. Geographic partition information is used to identify the physical location of the target computing resource.

[0049] The checksum is mainly used to verify the tamper-proof identification of computing resources. The checksum can be obtained based on the resource type, core capability attribute information and geographical partition information. For example, the SHA-256 hash value of the resource type, core capability attribute information and geographical partition information can be used as the checksum of the target computing resource.

[0050] Specifically, the access control module can extract the resource type, core capability attribute information, and geographical partition information of the target computing resource from the resource information. Then, it can combine the resource type, core capability attribute information, and geographical partition information to generate a verification code for the target computing resource.

[0051] Step S202: Obtain the pre-set initial state version number.

[0052] The initial state version number refers to the initial value of the target computing resource's state version number. The state version number can be used to identify the updated version of the target computing resource's attributes. The initial value of the version number can be preset, for example, using v1.0 as the initial state version number. When the target computing resource is connected, the preset initial state version number can also be used as the current state version number of the target computing resource.

[0053] Step S203: Using resource type, core capability attribute information, geographical partition information, check code and initial state version number, generate the computing resource identifier of the target computing resource.

[0054] Finally, the computing resource identifier of the target computing resource can be generated by combining the resource type, core capability attribute information, geographical partition information, check code, and initial state version number.

[0055] In this embodiment, the computing resource identifier of the target computing resource can be generated by combining the resource type, core capability attribute information, geographical partition information, check code, and initial state version number. Therefore, the constructed computing resource identifier can carry resource information such as the resource type, core capability attribute information, geographical partition information, and dynamic attribute version information of the target computing resource. Thus, it can be used to accurately evaluate and compare the merits of different resources, and can be used to achieve optimized resource allocation and efficient collaborative work. The computing resource identifier generated by this method can improve the management and utilization efficiency of computing resources.

[0056] Furthermore, if the broadcast packet for the online computing resource carries a temporary resource identifier to indicate that the target computing resource is a temporary resource, step S203 may further include: obtaining the temporary license duration of the target computing resource; constructing a computing resource identifier using the resource type, core capability attribute information, geographical partition information, checksum, initial state version number, and temporary license duration; the temporary license duration in the computing resource identifier is used to instruct the distributed caching function module to cancel the computing resource identifier and send a resource offline notification for the target computing resource when the current time exceeds the temporary license duration.

[0057] The temporary resource identifier can be used to characterize that the target computing resource is temporary. If a target computing resource is temporary, such as a test device, a temporary identifier (MAC + random number) can be added to the computing resource launch broadcast packet generated through the proxy service to characterize the target computing resource as temporary. The temporary license duration refers to the duration for which the temporary resource is permitted to be used. If the target computing resource is temporary, the computing resource identifier can also be constructed by combining the temporary license duration; that is, the computing resource identifier can also carry temporary license duration information.

[0058] Specifically, if the broadcast packet for a computing resource going online carries a temporary resource identifier, it indicates that the target computing resource is a temporary resource. In this case, the access control module can also obtain the temporary license duration of the target computing resource, and then construct a computing resource identifier using the resource type, core capability attribute information, geographical partition information, check code, initial state version number, and temporary license duration. Since the computing resource identifier can be stored in the distributed caching module, the distributed caching module can also take the computing resource offline based on the temporary license duration in the computing resource identifier. That is, if the current time exceeds the temporary license duration, the computing resource identifier is cancelled and a resource offline notification is sent for the target computing resource.

[0059] For example, the structure of a computing resource identifier can be as follows:

[0060] Resource Type | Geographic Zone | Core Attributes | Status Version Number | Checksum | Extended Attributes

[0061] As can be seen, the computing resource identifier may include the following fields: resource type identifier, geographic partition identifier, core capability attribute identifier, status version number, checksum, and extended attribute field. The extended attribute field can be used to store the temporary license duration of temporary resources. Therefore, the computing resource identifier of a certain computing resource can be as follows:

[0062] Computing power - GPU | CN-East-Shanghai-A-01 | 100TFLOPS-32GB | v1.2 | SHA256 (first 4 layers) | Temporary license until 20250718

[0063] It can be seen that the type of computing resource is GPU, the physical location is rack 01 in Shanghai A data center in East China, the computing power is 500 TFLOPS, the video memory is 32GB, and the current version number is 1.2, etc.

[0064] In this embodiment, if the target computing resource is a temporary resource, the computing resource online broadcast packet can also carry a temporary resource identifier. At this time, the access control function module can generate a computing resource identifier by combining the temporary license duration of the target computing resource, so that the distributed caching function module can complete the cancellation of the computing resource identifier and the offline of the target computing resource based on the temporary license duration. This method can further improve the intelligence of temporary computing resource management.

[0065] In one embodiment, the online broadcast packet for computing resources further includes: a logical resource pool identifier associated with the target computing resource; step S103 may further include: storing the resource information and the computing resource identifier in the distributed cache function module of the information center network, and binding the logical resource pool identifier to complete the access registration of the target computing resource.

[0066] The logical resource pool identifier can be used to identify the logical resource pool to which the target computing resource is bound. This logical resource pool identifier can be configured during the initialization of the target computing resource. In this embodiment, the computing resource online broadcast packet can also contain the logical resource pool identifier associated with the target computing resource. When registering the target computing resource for access, in addition to storing the resource information and the computing resource identifier in the distributed cache function module of the information center network, the target computing resource can also be bound to the logical resource pool identifier to complete the access registration of the target computing resource.

[0067] In this embodiment, the online broadcast packet for computing resources may also include a logical resource pool identifier. When registering for access, in addition to storing the resource information and the computing resource identifier, it is also necessary to bind the target computing resource with the logical resource pool identifier. This method can further improve the completeness of the access registration of the target computing resource.

[0068] In one embodiment, such as Figure 3 As shown, before generating the computing resource identifier for the target computing resource based on the resource information, it may also include:

[0069] Step S301: Receive the digital certificate of the target computing resource sent by the proxy service; the digital certificate is sent from the certification authority to the proxy service;

[0070] Step S302: Verify the digital certificate. If the digital certificate verification is successful, obtain the real-time resource status of the target computing resource.

[0071] The digital certificate of the target computing resource can be sent by the certification authority to the proxy service. Specifically, when the proxy service initiates a computing resource access request, it can also send the digital certificate issued by the certification authority to the access control function module. The access control function module can also verify the digital certificate, and only after the authentication is successful will it further obtain the real-time resource status of the target computing resource, such as by collecting the real-time resource status through the LMMP protocol.

[0072] Step S303: If the real-time resource status of the target computing resource meets the target input rules, generate the computing resource identifier of the target computing resource.

[0073] After obtaining the real-time resource status, the access control function module can also determine whether the real-time resource status meets the target access rules. The target access rules are used to measure whether the target computing resource can access the information center network. If the target access rules are met, the generation of the computing resource identifier of the target computing resource is executed to register the target computing resource for access. If not, the access of the target computing resource is rejected.

[0074] In this embodiment, before accessing the target computing resources, a two-factor dynamic verification of certificate verification and resource access verification can be performed on the target computing resources. This method can further ensure the compliance of the computing resources.

[0075] Furthermore, before step S303, the method may include: obtaining the resource type of the target computing resource from the resource information; obtaining the resource admission rule that matches the resource type from the pre-built mapping relationship, as the target admission rule; the mapping relationship stores the correspondence between different resource types and different resource admission rules.

[0076] The mapping relationship can be a mapping relationship table, which can store the correspondence between different resource types and different resource admission rules. In this embodiment, it is also necessary to first determine the resource type of the target computing resource, and then determine the resource admission rule that matches the above resource type according to the mapping relationship, as the target admission rule.

[0077] For example, the admission rule mapping table can be shown in Table 1:

[0078] Table 1. Admission Rule Mapping Relationship Table

[0079]

[0080] Taking the target computing resource as an edge GPU node as an example, if the real-time resource status of the target computing resource is a node latency of 15ms, since the latency of 15ms is greater than the threshold of 10ms, the real-time resource status of the target computing resource does not meet the target access rule, and therefore the access of the target computing resource is rejected.

[0081] In this embodiment, a resource admission rule that matches the resource type of the target computing resource can also be determined through mapping relationship, and used as the target admission rule. This method can improve the efficiency of obtaining the target admission rule.

[0082] In addition, the digital certificate carries a public key and the validity period information of the digital certificate; step S302 may further include: using the public key to perform signature verification on the digital certificate and obtaining the signature verification result of the digital certificate; using the validity period information to perform validity verification on the digital certificate and obtaining the validity period verification result of the digital certificate; if both the signature verification result and the validity period verification result indicate that the verification is successful, it is determined that the digital certificate has been verified.

[0083] In this embodiment, the verification of a digital certificate may include two parts: signature verification and validity period verification. In this embodiment, the digital certificate may carry a public key and validity period information. The access control function module can perform signature verification using the public key of the digital certificate and determine whether the digital certificate has expired using the validity period information in the digital certificate. The digital certificate is only considered to have passed verification if both the signature verification and validity period verification results indicate that the verification has passed.

[0084] If either signature verification or validity verification fails, such as when the digital certificate expires or signature verification fails, then the digital certificate verification is deemed unsuccessful, and the access control module can refuse access to the target computing resource.

[0085] In this embodiment, signature verification and validity period verification can also be performed on the digital certificate. Only after both signature verification and validity period verification are passed can the digital certificate be determined to be verified. This method can further improve the completeness of digital certificate verification.

[0086] In one embodiment, such as Figure 4 As shown, after step S103, the following may also be included:

[0087] Step S401: In response to the resource attribute data update request initiated by the proxy service, obtain the resource attribute update data that matches the resource attribute data update request.

[0088] A resource attribute data update request refers to a status update reporting request initiated by the proxy service. When the resource attribute data of the target computing resource is updated, the attribute data update can be reported through this resource attribute data update request. The resource attribute update data refers to the data carried in the resource attribute data update request, that is, the updated resource attribute data of the target computing resource.

[0089] Specifically, if the proxy service of the target computing resource detects that the resource attributes of the target computing resource have been updated, it can send a resource attribute data update request to the access control function module to inform the access control function module that the resource attributes of the target computing resource have been updated. After receiving the resource attribute data update request sent by the proxy service, the access control function module can obtain the updated resource attribute data carried in the resource attribute data update request.

[0090] Step S402: Based on the resource attribute update data, obtain the update status version number, and send a resource update message carrying the computing resource identifier, the update status version number, and the resource attribute update data to the distributed cache function module. The resource update message is used to instruct the distributed cache function module to verify the update status version number, and after the verification is successful, update the computing resource identifier using the update status version number, and store the updated computing resource identifier and the resource attribute update data.

[0091] The updated status version number refers to the updated status version number of the target computing resource. This update can be obtained based on resource attribute update data. Specifically, after obtaining the resource attribute update data, the access control module can derive the updated status version number based on that data and send a resource update message carrying the computing resource identifier, the updated status version number, and the resource attribute update data to the distributed caching module. Upon receiving the resource update message, the distributed caching module can verify the updated status version number, such as checking its continuity. If the verification passes, it uses the updated status version number to update the computing resource identifier and stores the updated identifier along with the resource attribute update data.

[0092] In this embodiment, when resource attribute data is updated, a resource attribute data update request can be initiated through a proxy service to synchronize the resource attribute data. This method enables dynamic updating of computing resource identifiers and resource attribute data, further improving the accuracy of computing resource management.

[0093] Furthermore, the status version number includes: a major version number and a minor version number; step S402 may further include: when the core capability attribute information of the target computing resource represented by the resource attribute update data is updated, incrementing the major version number to obtain the updated status version number; when the real-time attribute information of the target computing resource represented by the resource attribute update data is updated, incrementing the minor version number to obtain the updated status version number.

[0094] In this embodiment, the status version number can be composed of two parts: a major version number and a minor version number. The major version number is used to characterize the update status of the core capability attribute information of the target computing resource, while the minor version number is used to characterize the update status of the real-time attribute information of the target computing resource.

[0095] Specifically, the access control module can update data based on resource attributes. First, it determines whether the update is to the core capability attribute information or the real-time attribute information of the target computing resource. If the update is to the core capability attribute information, the access control module can increment the major version number to obtain the updated status version number. If the update is to the real-time attribute information, the proxy service can increment the minor version number to obtain the updated status version number.

[0096] For example, when the GPU computing power is upgraded from 100 TFLOPS to 200 TFLOPS (core attribute change), the version number is upgraded to v2.0, only the "core attributes + version number + checksum" are updated; when the utilization rate is upgraded from 70% to 85% (real-time performance attribute change), the version number is upgraded to v1.1, only the changed parameters and the new version number are transmitted, and the transmission volume is reduced by 80%.

[0097] In this embodiment, the updated status version number can be obtained by updating the resource attribute data, thereby achieving synchronous updating of the status version number.

[0098] In one embodiment, a heterogeneous resource partitioning discovery and dynamic identifier registration method based on an ICN architecture is also provided to address issues such as uncontrolled resource discovery scope, lax permission verification, and asynchronous identifier and status in existing technologies. Specifically, this includes:

[0099] Limit the discovery scope by using geographical partitioning and logical resource pools to reduce network redundancy;

[0100] A two-factor authentication system of "digital certificate + access rules" is constructed, combined with an automatic temporary license cancellation mechanism to improve security;

[0101] Design a hierarchical identifier with a status version number to enable incremental updates of resource information and reduce transmission overhead;

[0102] Customize resource type-specific admission rules for intelligent computing scenarios to improve scenario adaptability.

[0103] Among them, the ICN system architecture is as follows Figure 5 As shown, specifically, as Figure 6 As shown, accessing new resources may include the following steps:

[0104] (1) Initiating an access request: The new resource generates a "resource online broadcast packet" based on the LMMP extension protocol through the built-in Agent. This packet includes the geographic partition code (e.g., "CN-East-Shanghai-A-01", which is read by the hardware chip), logical resource pool ID (e.g., "Pool-AI-T-001", configured during initialization), resource type (e.g., "computing power-GPU"), temporary identifier (MAC + random number), and basic capability description (e.g., "bandwidth 10Gbps"), and sends an access request to the access control function module. Active probing: The new resource Agent sends a broadcast packet through the LMMP extension protocol. The packet header carries:

[0105] Resource base type (e.g., "computing power - GPU", "network link");

[0106] Temporary device identifier (such as MAC address + random number, used for identity differentiation during initial interaction);

[0107] Basic capability descriptions (such as "supports computing power scheduling" and "bandwidth 10Gbps").

[0108] (2) The broadcast packet is sent via the data link layer and the target is the “access control function module” of the network control layer, which triggers the system to discover new resources.

[0109] (3) Access permission verification:

[0110] The resource agent submits a preset digital certificate (including a public key) to the access control function module. The certificate is issued by a trusted Certificate Authority (CA) and contains a unique hardware identifier (such as the CPU serial number "SN123456"), a vendor ID (such as "NVIDIA-001"), and a validity period (such as "2025-07-01 to 2025-12-31").

[0111] The access control module verifies the validity of the signature using the CA public key. If the certificate expires or is revoked, it logs "Unauthorized access: Certificate expired (SN123456)" and refuses access.

[0112] If certificate verification fails (e.g., invalid signature, expired), the access control module will directly return an "access denied" instruction and record an exception log (e.g., "illegal resource access attempt, certificate invalid"), terminating the access process.

[0113] After the certificate is approved, the "Resource Type-Admission Rule" mapping table (as shown in Table 1) is invoked, and the status is collected and compared in real time via the LMMP protocol.

[0114] For example, if the edge GPU node latency is detected as 15ms, the system returns "Access Denied: Latency 15ms > Threshold 10ms".

[0115] For temporary resources (such as test equipment), the certificate extension field is marked with "valid for 24 hours", and this information is embedded when the identifier is generated; after the expiration, the distributed cache module automatically cancels the identifier and sends a "resource offline notification".

[0116] (4) Generate a unique identifier:

[0117] Hierarchical identifier structure:

[0118] Resource Type | Geographic Zone | Core Attributes | Status Version Number | Check Code | Extended Attributes

[0119] For example: Computing power - GPU | CN-East-Shanghai-A-01 | 100TFLOPS - 32GB | v1.2 | SHA256 (first 4 layers) | Temporary license until 20250718

[0120] Generation steps:

[0121] The identification and parsing module receives "resource type + geographic partition + core attributes";

[0122] The initial version number is set to v1.0;

[0123] Calculate the SHA-256 hash of the first 4 layers of fields as the checksum;

[0124] Add an "Extended Attributes" field (expiration date) to temporary resources.

[0125] Status updates are linked:

[0126] When the GPU computing power is upgraded from 100 TFLOPS to 200 TFLOPS (core attribute change), the version number is upgraded to v2.0, only the "core attributes + version number + checksum" are updated; when the utilization rate is upgraded from 70% to 85% (performance change), the version number is upgraded to v1.1, only the changed parameters and the new version number are transmitted, and the transmission volume is reduced by 80%.

[0127] The specific meanings of each field are shown in Table 2:

[0128] Table 2. Identifier Field Diagram

[0129]

[0130] (5) Complete resource registration:

[0131] Resource identifiers and attribute information are entered into the distributed cache function module and bound to the resource pool index (such as the "Pool-AI-T-001" index table). Once registration is complete, the resource is officially included in the system management pool and can be identified by subsequent scheduling processes.

[0132] like Figure 7 As shown, the specific implementation of the existing resource status process is as follows:

[0133] (1) Status change perception: The resource agent monitors the following key status parameters in real time:

[0134] Performance status: such as GPU computing power utilization (triggered when threshold ≥ 80%), network link bandwidth utilization (triggered when threshold ≥ 90%).

[0135] Health status: such as hardware failure (e.g., fan failure), protocol connection interruption (e.g., communication timeout with distributed cache);

[0136] Configuration changes: such as resource expansion (increased number of GPUs) and performance parameter adjustments (such as upgraded video memory capacity).

[0137] (2) Response triggering process:

[0138] When the above-mentioned status changes are detected and the preset threshold is reached, the resource agent proactively sends a "identifier + new version number v1.1 + change value" message to the "distributed cache function" to initiate a status update request, instead of waiting for the system to periodically query.

[0139] (3) Synchronization and feedback:

[0140] After receiving a request, the distributed caching module verifies the version continuity (if the current version is v1.0, then v1.2 is rejected). If the verification passes, the module updates the resource information stored locally and returns a "status synchronization confirmation" message. If the information verification fails (e.g., the identifier does not exist), a secondary verification process is triggered (e.g., reconfirming the legality of the resource with the access control module).

[0141] This embodiment achieves an innovative discovery mechanism, combining active detection (new resource access) with passive response (status update), and limiting the scope through geographical partitioning. This covers all scenarios while preventing network storms, overcoming the limitations of traditional single-trigger methods. It also achieves precise control of the broadcast range by combining geographical partitioning hardware coding and logical resource pool IDs. Furthermore, it implements two-factor dynamic verification: digital certificate verification of identity + scenario-based rule matching of resource compliance, binding temporary licenses to the lifecycle of the identifier. It also achieves identifier-status linkage, with hierarchical identifiers including status version numbers, supporting incremental updates. Therefore, it can overcome the barriers of heterogeneous resource protocols, enabling cross-vendor collaborative management. Addressing the "protocol silos" problem of "numerous proprietary protocols and inconsistent information formats" across different vendors' devices, the solution uses a "protocol adaptation gateway" to uniformly convert heterogeneous protocols such as NVLink (GPU protocol) and SNMP (network device protocol) into the HTTP / 2+JSON standardized format. Combined with "dynamically extended hierarchical identifiers" (including resource type, performance parameters, etc.), it achieves "seamless cross-vendor access" for multiple types of resources such as GPUs, network links, and storage devices. Furthermore, it can improve resource utilization and reduce idle waste. Addressing the resource "mismatch" or "idleness" issues caused by traditional static configuration, the solution achieves efficient resource matching through "precise demand perception + intelligent scheduling basis." It also strengthens resource access security and business operation stability. Addressing the security risks of "weak permission verification and easy information tampering" in traditional solutions, the solution constructs multiple layers of protection through a "hierarchical permission verification system."

[0142] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0143] Based on the same inventive concept, this application also provides a computing resource access device for implementing the computing resource access method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more computing resource access device embodiments provided below can be found in the limitations of the computing resource access method described above, and will not be repeated here.

[0144] In one embodiment, such as Figure 8 As shown, a computing resource access device is provided, applied to the access control function module of an information center network, including: an access request response module 801, a resource identifier generation module 802, and a computing resource access module 803, wherein:

[0145] The access request response module 801 is used to respond to a computing resource access request initiated by the proxy service of the target computing resource and obtain the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request.

[0146] The resource identifier generation module 802 is used to obtain the resource information of the target computing resource from the computing resource online broadcast packet, and generate the computing resource identifier of the target computing resource based on the resource information;

[0147] The computing resource access module 803 is used to store the resource information and the computing resource identifier into the distributed cache function module of the information center network to complete the access registration of the target computing resource.

[0148] In one embodiment, the resource information includes: the resource type of the target computing resource, the core capability attribute information of the target computing resource, and geographic partition information for characterizing the physical location of the target computing resource; the resource identifier generation module 802 is further configured to generate a checksum of the target computing resource based on the resource type, the core capability attribute information, and the geographic partition information; obtain a pre-set initial state version number; and generate a computing resource identifier of the target computing resource using the resource type, the core capability attribute information, the geographic partition information, the checksum, and the initial state version number.

[0149] In one embodiment, the computing resource online broadcast packet carries a temporary resource identifier to characterize the target computing resource as a temporary resource. The resource identifier generation module 802 is further used to obtain the temporary license duration of the target computing resource; construct the computing resource identifier using the resource type, the core capability attribute information, the geographical partition information, the verification code, the initial state version number, and the temporary license duration; the temporary license duration in the computing resource identifier is used to instruct the distributed caching function module to cancel the computing resource identifier and send a resource offline notification for the target computing resource if the current time exceeds the temporary license duration.

[0150] In one embodiment, the computing resource online broadcast package further includes: a logical resource pool identifier associated with the target computing resource; and a computing resource access module 803, which is further configured to store the resource information and the computing resource identifier in the distributed cache function module of the information center network, and bind the logical resource pool identifier to complete the access registration of the target computing resource.

[0151] In one embodiment, the resource identifier generation module 802 is further configured to receive a digital certificate of the target computing resource sent by the proxy service; the digital certificate is sent to the proxy service by a certification authority; the digital certificate is verified; if the digital certificate verification is successful, the real-time resource status of the target computing resource is obtained; if the real-time resource status of the target computing resource meets the target access rules, a computing resource identifier of the target computing resource is generated.

[0152] In one embodiment, the resource identifier generation module 802 is further configured to obtain the resource type of the target computing resource from the resource information; obtain the resource admission rule that matches the resource type from the pre-built mapping relationship, and use it as the target admission rule; the mapping relationship stores the correspondence between different resource types and different resource admission rules.

[0153] In one embodiment, the digital certificate carries a public key and the validity period information of the digital certificate; the resource identifier generation module 802 is further configured to use the public key to perform signature verification on the digital certificate and obtain the signature verification result of the digital certificate; use the validity period information to perform validity verification on the digital certificate and obtain the validity period verification result of the digital certificate; and determine that the digital certificate has been verified if both the signature verification result and the validity period verification result indicate that the verification is successful.

[0154] In one embodiment, the computing resource identifier carries a status version number of the target computing resource; the computing resource access device further includes: a computing resource update module, configured to respond to a resource attribute data update request initiated by the proxy service, obtain resource attribute update data matching the resource attribute data update request; obtain an update status version number based on the resource attribute update data, and send a resource update message carrying the computing resource identifier, the update status version number, and the resource attribute update data to the distributed caching function module; the resource update message is used to instruct the distributed caching function module to verify the update status version number, and after successful verification, update the computing resource identifier using the update status version number, and store the updated computing resource identifier and the resource attribute update data.

[0155] In one embodiment, the status version number includes a major version number and a minor version number; the computing resource update module is further configured to increment the major version number to obtain the updated status version number when the resource attribute update data representing the core capability attribute information of the target computing resource is updated; and to increment the minor version number to obtain the updated status version number when the resource attribute update data representing the real-time attribute information of the target computing resource is updated.

[0156] Each module in the aforementioned computing resource access device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0157] In one embodiment, a computer device is provided, which may be an access control function module, and its internal structure diagram may be as follows: Figure 9As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores online broadcast packet data for computing resources. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a method for accessing computing resources.

[0158] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0159] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0160] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0161] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0162] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0163] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0164] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0165] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for accessing computing resources, characterized in that, An access control function module applied to an information center network, the method comprising: In response to a computing resource access request initiated by the proxy service of the target computing resource, obtain the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request; The resource information of the target computing resource is obtained from the online broadcast packet of the computing resource, and a computing resource identifier of the target computing resource is generated based on the resource information. The resource information and the computing resource identifier are stored in the distributed cache module of the information center network to complete the access registration of the target computing resource.

2. The method according to claim 1, characterized in that, The resource information includes: the resource type of the target computing resource, the core capability attribute information of the target computing resource, and geographic partitioning information used to characterize the physical location of the target computing resource; generating a computing resource identifier for the target computing resource based on the resource information includes: Based on the resource type, the core capability attribute information, and the geographical partition information, a check code for the target computing resource is generated; Retrieve the pre-set initial state version number; The computing resource identifier of the target computing resource is generated using the resource type, the core capability attribute information, the geographical partition information, the verification code, and the initial state version number.

3. The method according to claim 2, characterized in that, If the broadcast packet for the computing resource goes live carries a temporary resource identifier to indicate that the target computing resource is a temporary resource, the step of generating the computing resource identifier of the target computing resource using the resource type, the core capability attribute information, the geographic partition information, the checksum, and the initial state version number includes: Obtain the temporary license duration for the target computing resource; The computing resource identifier is constructed using the resource type, the core capability attribute information, the geographical partition information, the verification code, the initial state version number, and the temporary license duration. The temporary license duration in the computing resource identifier is used to instruct the distributed caching function module to cancel the computing resource identifier and send a resource offline notification for the target computing resource when the current time exceeds the temporary license duration.

4. The method according to claim 2, characterized in that, The online broadcast packet for the computing resource also includes: a logical resource pool identifier associated with the target computing resource; the step of storing the resource information and the computing resource identifier in the distributed cache module of the information center network to complete the access registration of the target computing resource includes: The resource information and the computing resource identifier are stored in the distributed cache module of the information center network and bound to the logical resource pool identifier to complete the access registration of the target computing resource.

5. The method according to claim 1, characterized in that, Before generating the computing resource identifier of the target computing resource based on the resource information, the method further includes: The agent receives the digital certificate of the target computing resource sent by the proxy service; the digital certificate is sent to the proxy service by the certification authority. The digital certificate is verified, and if the digital certificate verification is successful, the real-time resource status of the target computing resource is obtained. If the real-time resource status of the target computing resource meets the target input rules, a computing resource identifier for the target computing resource is generated.

6. The method according to claim 5, characterized in that, Before generating the computing resource identifier of the target computing resource when the real-time resource status of the target computing resource meets the target access rules, the method further includes: Obtain the resource type of the target computing resource from the resource information; From the pre-built mapping relationship, obtain the resource admission rule that matches the resource type, and use it as the target admission rule; the mapping relationship stores the correspondence between different resource types and different resource admission rules.

7. The method according to claim 5, characterized in that, The digital certificate carries a public key and its validity period information; the certificate verification process includes: The digital certificate is signed and verified using the public key to obtain the signature verification result of the digital certificate; The validity period information is used to verify the validity period of the digital certificate, and the validity period verification result of the digital certificate is obtained. If both the signature verification result and the validity period verification result indicate that the verification is successful, the digital certificate is determined to be verified successfully.

8. The method according to any one of claims 1 to 7, characterized in that, The computing resource identifier carries the status version number of the target computing resource; after storing the resource information and the computing resource identifier in the distributed cache module of the information center network to complete the access registration of the target computing resource, the method further includes: In response to the resource attribute data update request initiated by the proxy service, obtain the resource attribute update data that matches the resource attribute data update request; Based on the resource attribute update data, an update status version number is obtained, and a resource update message carrying the computing resource identifier, the update status version number, and the resource attribute update data is sent to the distributed caching function module. The resource update message is used to instruct the distributed caching function module to verify the update status version number, and after the verification is successful, to update the computing resource identifier using the update status version number, and to store the updated computing resource identifier and the resource attribute update data.

9. The method according to claim 8, characterized in that, The status version number includes: a major version number and a minor version number; obtaining the update status version number based on the resource attribute update data includes: When the core capability attribute information of the target computing resource, which is represented by the resource attribute update data, is updated, the major version number is incremented to obtain the update status version number. When the resource attribute update data characterizes an update to the real-time attribute information of the target computing resource, the sub-version number is incremented to obtain the update status version number.

10. A computing resource access device, characterized in that, An access control function module applied to an information center network, the device comprising: The access request response module is used to respond to a computing resource access request initiated by the proxy service of the target computing resource and obtain the computing resource online broadcast packet generated by the proxy service carried in the computing resource access request. The resource identifier generation module is used to obtain the resource information of the target computing resource from the computing resource online broadcast packet, and generate the computing resource identifier of the target computing resource based on the resource information; The computing resource access module is used to store the resource information and the computing resource identifier into the distributed cache function module of the information center network to complete the access registration of the target computing resource.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images