Computing power resource affiliation division method and device of intelligent computing center

Abstract

The invention provides a computing power resource affiliation division method and device for an intelligent computing center, and relates to the technical field of intelligent computing centers, intelligent computing centers and computing power infrastructures. The target storage space is one of at least one storage space pre-created in the intelligent computing center; s2, under the condition that an access request of at least one user is received, the access permission of each user to the target storage space is verified, a verification result is obtained, and the at least one user comprises the first user; and S3, under the condition that the verification result shows that only the first user has the access authority to the target storage space, acquiring a first authorization instruction of the first user, and authorizing the access authority of the computing power resource in the target storage space to a second user according to the first authorization instruction.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of intelligent computing centers, smart computing centers and computing power infrastructure, specifically to a method and apparatus for allocating computing power resources in an intelligent computing center. Background Technology

[0002] With the rapid development of artificial intelligence technology, "intelligent computing centers" and "smart computing centers" have emerged.

[0003] An "intelligent computing center" refers to a facility that provides the necessary computing power, data, and algorithms for artificial intelligence applications (such as the development, training, and inference of deep learning models) by utilizing large-scale heterogeneous computing resources, including general-purpose and intelligent computing power. Intelligent computing centers encompass facilities, hardware, and software, and can provide full-stack capabilities from underlying computing power to top-level application enablement.

[0004] "Intelligent computing center" includes, but is not limited to, "intelligent computing center".

[0005] "Intelligent computing center" or artificial intelligence computing center is a type of computing infrastructure that provides computing power services, data services, and algorithm services required for artificial intelligence applications, based on artificial intelligence theory and adopting artificial intelligence computing architecture.

[0006] "Computing power" is the core of "intelligent computing center" and "smart computing center". It is the ability of computer equipment or computing / data center to process information. It is the ability of computer hardware and software to work together to perform a certain computing requirement. It is the computing power to achieve the target output by processing information data. It is a new type of productivity that integrates information computing power, network carrying capacity and data storage capacity. It mainly provides services to society through computing power infrastructure.

[0007] With the development of intelligent computing centers, the allocation of computing resources and cross-user access control have become key challenges. Currently, mainstream systems allocate storage space through static permission lists or role models, such as writing data to a preset directory and binding it to fixed user group permissions. Traditional methods rely solely on authentication and pre-configured access rules, failing to determine the legitimacy of user devices or behaviors in real time. When multiple users simultaneously request access to the same storage space, the system struggles to quickly identify abnormal operations. Resource sharing requires administrators to manually modify configurations, a process that is inefficient and carries the risk of misauthorization. Therefore, since the emergence of intelligent computing centers, achieving precise control over storage space access in dynamic scenarios and clearly defining the allocation of computing resources has been a pressing issue. Summary of the Invention

[0008] This invention provides a method and apparatus for allocating computing resources in an intelligent computing center, which enables precise control over access to storage space and the allocation of computing resources.

[0009] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0010] In a first aspect, the present invention provides a method for allocating computing resources in an intelligent computing center, including:

[0011] Step S1: Write the data of the first user into the target storage space, wherein the target storage space is one of at least one storage space pre-created in the intelligent computing center;

[0012] Step S2: Upon receiving an access request from at least one user, verify the access rights of each user to the target storage space and obtain the verification result. The at least one user includes the first user.

[0013] Step S3: If the verification result shows that only the first user has access to the target storage space, obtain the first authorization instruction from the first user, and authorize the second user to access the computing resources in the target storage space according to the first authorization instruction.

[0014] In one embodiment, the at least one storage space is a storage space created based on multi-dimensional features, the multi-dimensional features including at least one of data type, access frequency and security level;

[0015] The operation permissions for the storage space are assigned to the corresponding users based on a fine-grained policy, which is determined according to the user's operation type and time range.

[0016] In one embodiment, step S2 includes:

[0017] Step S21: Upon receiving an access request from at least one user, perform a first verification on the access permissions of the target storage space based on each user's access request, and obtain the first verification result;

[0018] The access request carries at least one of the following: user identity information, device information, and geographic location information;

[0019] After step S21, the method further includes:

[0020] Step S22: Based on the access request of the first user, perform a second verification on each of the at least one storage space to obtain a second verification result. The second verification includes at least one of the following: timestamp sequence verification of the access request, device consistency detection verification, and user behavior pattern verification. The user behavior pattern verification is used to monitor and identify abnormal cross-space access requests by learning the user's normal access behavior pattern.

[0021] Step S23: If the second verification result shows that the first user's access request triggers a cross-storage space data access request, transmit the data information corresponding to the first user's access request to the target storage space. The data information is the data stored in other storage spaces besides the target storage space triggered by the first user's access request.

[0022] Step S24: Generate an audit log; wherein the audit log is used to record at least one of the following: the operation time of the first user access, the user's identity, and the scope of permissions.

[0023] In one embodiment, step S3 includes:

[0024] Step S31: Upon receiving the first authorization instruction, authenticate the second user indicated in the first authorization instruction to obtain a third authentication result;

[0025] Step S32: If the third verification result shows that the second user is a user with authorized permissions, the computing power resources of the target storage space are allocated to the second user based on the urgency of the second user's computing task and the predicted resource consumption.

[0026] Step S33: Configure access permissions for the computing power resources for the second user according to the first authorization instruction. The access permissions for the computing power resources of the second user include at least one of operation type permissions, time window permissions, and data range permissions.

[0027] In one embodiment, after step S3, the method further includes at least one of the following:

[0028] Step S4: Transmit the target data to the second user through a preset encryption protocol;

[0029] The target data refers to the data contained in the computing resources that are within the access rights of the second user.

[0030] In one embodiment, the method further includes:

[0031] Step S5: If an access request from a third user is received, but no second authorization instruction from the first user to the third user is received, check whether the access request from the third user is legitimate;

[0032] Step S6: If the access request of the third user is legitimate, allocate access permissions to computing resources to the third user according to the operation task carried in the access request of the third user;

[0033] The third user's access to computing resources is the minimum access required to complete the operation task.

[0034] Secondly, this application provides a device for allocating computing resources in an intelligent computing center, comprising:

[0035] The data writing module is used to write the data of the first user into the target storage space, which is one of at least one storage space pre-created in the intelligent computing center, and the operation rights of the target storage space belong to the first user.

[0036] An access verification module is used to verify the target storage space when multiple users' access requests are received, and to obtain a verification result, wherein the multiple users include the first user;

[0037] The resource authorization module is used to, when the verification result shows that only the first user has access to the target storage space, authorize the second user to access the computing resources in the target storage space based on the first user's first authorization instruction.

[0038] Thirdly, the present invention provides a server, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the intelligent computing center resource allocation method as described in the first aspect above.

[0039] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method for allocating computing resources in an intelligent computing center as described in the first aspect above.

[0040] Fifthly, the present invention provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the intelligent computing center resource allocation method as described in the first aspect above.

[0041] In this invention, the method for allocating computing resources in an intelligent computing center involves writing the data of a first user into a target storage space. Upon receiving an access request from at least one user, the method verifies the access rights of each user to the target storage space to ensure that only legitimate users can access it. If the verification results show that only the first user has access rights to the target storage space, a first authorization instruction from the first user is obtained, and access rights to the computing resources in the target storage space are authorized to a second user based on the first authorization instruction.

[0042] Thus, this embodiment of the invention ensures the ownership of computing resources and data through access permission verification, preventing unauthorized access or resource abuse. Simultaneously, it supports a first user actively authorizing a specific second user, balancing resource secrecy with collaboration needs, improving resource allocation efficiency, and reducing the complexity of computing resource ownership classification in intelligent computing centers through layered verification and authorization logic, providing underlying support for large-scale computing resource scheduling. Attached Figure Description

[0043] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0044] Figure 1 This is a flowchart illustrating a method for allocating computing resources in an intelligent computing center according to the present invention.

[0045] Figure 2 This is a schematic diagram of the structure of a computing power resource allocation device for an intelligent computing center according to the present invention;

[0046] Figure 3 This is a schematic diagram of the structure of an electronic device according to the present invention. Detailed Implementation

[0047] The technical solutions of this invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0048] The technical terms involved in this invention will be briefly explained below.

[0049] The “computing power” mentioned in this invention refers to: the ability of computer equipment or computing / data center to process information; the ability of computer hardware and software to work together to perform a certain computing requirement; the computing power to achieve the target result output by processing information data; and a new type of productivity that integrates information computing power, network carrying capacity, and data storage capacity, mainly providing services to society through computing power infrastructure.

[0050] The "computational power" (CP) described in this invention refers to the ability of a data center server to process data and output results. It is a comprehensive indicator of a data center's computing power, encompassing general computing power, supercomputing power, and intelligent computing power. The commonly used unit of measurement is floating-point operations per second (FLOPS, 1 EFLOPS = 10^18 FLOPS), with higher values ​​indicating stronger overall computing power. It is estimated that 1 EFLOPS is approximately the computing power output of 5 Tianhe-2A supercomputers, 500,000 mainstream server CPUs, or 2 million mainstream laptops. The calculation formula is: CP = CP 通用 +CP 智能 +CP 超级 .

[0051] The "Network Power" (NP) mentioned in this invention refers to the performance of data transmission capability of computing facilities, which includes comprehensive capabilities such as network architecture, network bandwidth, transmission latency, intelligent management and scheduling, and involves network transmission within and between data centers. It is a comprehensive indicator for measuring network transmission scheduling capability.

[0052] The "Storage Power" (SP) described in this invention refers to the comprehensive capabilities of a data center in four aspects: data storage capacity, performance, security and reliability, and green and low-carbon operation. It is a comprehensive indicator for measuring the data storage capacity of a data center, including external storage devices such as storage arrays and internal storage devices in servers. The commonly used unit of measurement for storage capacity is exabytes (EB, 1EB = 2^60 bytes), the commonly used unit of measurement for performance is the number of read / write operations per second per unit capacity (IOPS / TB), and the disaster recovery ratio is an important indicator of security and reliability.

[0053] The "computing infrastructure" mentioned in this invention refers to a new type of information infrastructure that integrates information computing power, network carrying capacity, and data storage capacity, enabling centralized computing, storage, transmission, and application of information.

[0054] The "new information infrastructure" mentioned in this invention refers to network infrastructure such as 5G networks, fiber optic broadband networks, backbone networks, international communication networks, and satellite internet; computing infrastructure such as data centers, general computing centers, intelligent computing centers, and supercomputing centers; and new technology facilities such as artificial intelligence, blockchain, and quantum computing.

[0055] The “computing power” mentioned in this invention includes: general computing power, intelligent computing power, and supercomputing power.

[0056] The "general computing power" mentioned in this invention refers to the computing power provided by servers based on CPU (Central Processing Unit) chips, which is used to support basic general computing such as cloud computing and edge computing.

[0057] The "intelligent computing power" mentioned in this invention refers to: a computing platform deployed on a large scale based on dedicated chips such as GPU (Graphics Processing Unit), FPGA (Field Programmable Gate Array), and ASIC (Application Specific Integrated Circuit) for various artificial intelligence innovative applications, such as natural language processing and machine vision.

[0058] The “supercomputing power” mentioned in this invention refers to the computing power provided by high-performance computing clusters such as supercomputers. It utilizes the centralized computing resources of multiple computer systems working in parallel and uses a dedicated operating system to handle extremely complex or data-intensive problems. It is mainly used for computing in cutting-edge scientific fields, such as planetary simulation, drug molecule design, and gene analysis.

[0059] The "intelligent computing center" described in this invention refers to a facility that, through the use of large-scale heterogeneous computing resources, including general-purpose computing power (CPU) and intelligent computing power (GPU, FPGA, ASIC, etc.), primarily provides the necessary computing power, data, and algorithms for artificial intelligence applications (such as the development, training, and inference of deep learning models). The intelligent computing center encompasses facilities, hardware, and software, and can provide full-stack capabilities from underlying computing power to top-level application enablement.

[0060] The "intelligent computing center" mentioned in this invention includes, but is not limited to, "smart computing center".

[0061] The "intelligent computing center" mentioned in this invention, also known as an artificial intelligence computing center, is a type of computing infrastructure that provides computing power services, data services, and algorithm services required for artificial intelligence applications, based on artificial intelligence theory and adopting an artificial intelligence computing architecture.

[0062] The "computing center" mentioned in this invention refers to a facility that is mainly composed of infrastructure such as wind, thermal, hydro, and electricity, and IT hardware and software equipment, and has computing power, carrying capacity, and storage capacity, including general data centers, intelligent computing centers, supercomputing centers, etc.

[0063] The "supercomputing center" mentioned in this invention refers to a supercomputing data center, which is a data center based on supercomputers or large-scale computing clusters. It can provide large-scale computing, storage and network services and is widely used in aerospace, defense, oil exploration, climate modeling and genome sequencing and other application scenarios.

[0064] The “computing resources” mentioned in this invention refer to the technologies and facilities required for the development of the digital society that have the ability to compute, transmit, store and apply information, including but not limited to computing resources such as CPUs and GPUs, network resources such as switches and routers, computing resources such as storage arrays and distributed storage, security resources such as firewalls and intrusion detection systems, and supporting and guaranteeing resources such as wind, fire, water and electricity.

[0065] The "large language model" mentioned in this invention refers to a large-scale language model (LLM), which is a language model with a large number of parameters. It is designed to understand and generate human language. It is trained with a large amount of text data and can perform a wide range of tasks, including text summarization, translation, and sentiment analysis.

[0066] The “Multimodal Large Models” mentioned in this invention refer to models that combine multimodal information such as text, images, videos, and audio for training, including but not limited to multimodal large language models.

[0067] For details, please see Figure 1 , Figure 1 This is a flowchart of a method for allocating computing resources in an intelligent computing center, as provided in an embodiment of the present invention. Figure 1 As shown, it includes the following steps:

[0068] Step S1: Write the data of the first user into the target storage space, which is one of at least one storage space pre-created in the intelligent computing center.

[0069] In the above steps, the first user can be the user who initiates the data write operation. Within the storage management system of the intelligent computing center, data can be written to a pre-created target storage space. This target storage space is one of several independent storage spaces created by the intelligent computing center through the storage management system.

[0070] For example, by pre-allocating corresponding storage space to user A, an association is established between the user and a specific storage space. In this way, the above steps establish the ownership relationship between data and a specific storage space, laying the foundation for subsequent permission management and allocation of computing resources.

[0071] It's worth noting that the storage space can be an independent storage area partitioned off within the intelligent computing center to store user data. Different users can be assigned to different storage spaces; that is, storage spaces can be created and allocated for different users to achieve data isolation and independent management.

[0072] Step S2: Upon receiving an access request from at least one user, verify the access rights of each user to the target storage space and obtain the verification result. The at least one user includes the first user.

[0073] It should be noted that the aforementioned access permission verification can be understood as a mechanism by which the intelligent computing center checks whether a user can access a specific storage space. By verifying the user's identity and permission rules, it determines whether the user is qualified to access the storage space, ensuring data security and the orderly operation of the storage system.

[0074] In this embodiment, when the intelligent computing center receives access requests for the target storage space from one or more users (including the first user), the intelligent computing center can check whether each user has the permission to access the target storage space according to preset permission rules. This ensures that only users who meet the permission rules can access the target storage space, preventing unauthorized access and protecting data security and the independence of the storage space.

[0075] Step S3: If the verification result shows that only the first user has access to the target storage space, obtain the first authorization instruction from the first user, and authorize the second user to access the computing resources in the target storage space according to the first authorization instruction.

[0076] The computing resources mentioned above can be the sum of resources used for data computation and processing in an intelligent computing center, including computing power, storage bandwidth, and processing units. Through the authorization process described in the preceding steps, the scope and method of different users' use of these resources can be controlled. The first user is the user who initially performs data writing operations on the target storage space and has the dominant authorization right to grant access to the computing resources of that space in subsequent processes. The second user, which is another user authorized by the first user to obtain access to the computing resources of the target storage space, must use the relevant resources within the scope authorized by the first user.

[0077] In this embodiment, if the aforementioned verification results indicate that only the first user currently has access to the target storage space, the intelligent computing center can obtain the authorization instruction from the first user and then, according to the instruction, grant access to the computing resources within the target storage space to the second user (other authorized users). Thus, flexible sharing of computing resources can be achieved while ensuring the first user's absolute control over the storage space, meeting the needs of scenarios such as multi-user collaboration. For example, when switching between different user identities to access storage resources, only authorized users can access them.

[0078] Thus, by verifying user access permissions, this embodiment effectively ensures that only users with the appropriate permissions can access the target storage space and its computing resources, reducing the risk of data leakage and unauthorized access. This embodiment allows for dynamic authorization of computing resources based on the operational needs of specific users, making resource usage more flexible and efficient. Simultaneously, it supports a first user actively authorizing a specific second user, balancing resource segregation with collaboration needs, improving resource allocation efficiency, and reducing the complexity of computing resource ownership allocation in intelligent computing centers through layered verification and authorization logic, providing underlying support for large-scale computing resource scheduling.

[0079] In one embodiment, the at least one storage space is a storage space created based on multi-dimensional features, the multi-dimensional features including at least one of data type, access frequency and security level;

[0080] The operation permissions for the storage space are assigned to the corresponding users based on a fine-grained policy, which is determined according to the user's operation type and time range.

[0081] It's important to note that data type indicators suggest storage space can contain multiple data types (such as text, images, and videos), each with different requirements for storage format and retrieval methods. Categorized storage allows for targeted optimization of management and processing workflows, improving the compatibility and efficiency of the storage system. For example, text data prioritizes retrieval speed, while video data emphasizes storage capacity and streaming performance; separate storage facilitates the use of different optimization strategies. Mixing frequently accessed data (such as user cache for popular applications) with low-frequency data can negatively impact overall performance due to frequent read / write operations. Therefore, the access frequencies can be differentiated, placing high-frequency data in spaces corresponding to high-speed storage devices and low-frequency data in low-cost storage (such as hard disk drives), allowing for rational resource allocation, cost reduction, and efficiency improvement. High-security data (such as core corporate patents and sensitive user information) requires strict access control and security protection; therefore, storage spaces can be created based on the confidentiality level. Furthermore, creating independent spaces and strengthening encryption and auditing measures can reduce the risk of leakage and meet compliance requirements.

[0082] It is worth mentioning that the above-mentioned fine-grained strategy can be a way to finely divide and manage access permissions to system resources. It breaks through the simple mode of coarse-grained permission control that only distinguishes user roles (such as administrators and ordinary users), and instead defines the access permissions of users or user groups in detail based on more specific dimensions (such as user operation type, time range, data attributes, environmental factors, etc.), ensuring that users can only access and operate specific resources within the specified scope.

[0083] In some embodiments, assigning permissions based on operation type (read, write, modify, delete, etc.) can prevent data corruption caused by user errors or malicious behavior. For example, allowing only specific users to "read" data in a certain space while prohibiting "modification" ensures data integrity and accuracy. Furthermore, restricting permissions by time range can reduce security risks during unauthorized periods, while conforming to actual business operation patterns (such as restricting certain operations in a financial system during settlement periods), thus improving the standardization of business processes while ensuring security.

[0084] In one embodiment, step S2 includes:

[0085] Step S21: Upon receiving an access request from at least one user, perform a first verification on the access permissions of the target storage space based on each user's access request, and obtain the first verification result;

[0086] The access request carries at least one of the following: user identity information, device information, and geographic location information;

[0087] After step S21, the method further includes:

[0088] Step S22: Based on the access request of the first user, perform a second verification on each of the at least one storage space to obtain a second verification result. The second verification includes at least one of the following: timestamp sequence verification of the access request, device consistency detection verification, and user behavior pattern verification. The user behavior pattern verification is used to monitor and identify abnormal cross-space access requests by learning the user's normal access behavior pattern.

[0089] Step S23: If the second verification result shows that the first user's access request triggers a cross-storage space data access request, transmit the data information corresponding to the first user's access request to the target storage space. The data information is the data stored in other storage spaces besides the target storage space triggered by the first user's access request.

[0090] Step S24: Generate an audit log; wherein the audit log is used to record at least one of the following: the operation time of the first user access, the user's identity, and the scope of permissions.

[0091] It's important to note that multi-dimensional features can be used to create storage spaces. This means that independent storage spaces can be created based on features such as data type (e.g., text, images, videos), access frequency (high-frequency access hot data and low-frequency access cold data), and confidentiality level (confidential data and general public data). For example, an intelligent computing center can store customer personal information (high confidentiality level), login records (high access frequency), and input text (different data types) in different spaces to achieve data classification management and optimized resource allocation.

[0092] The fine-grained strategy described above for determining operation permissions can be understood as determining permissions based on the user's operation type (read, write, modify, delete, etc.) and time range (such as working hours or specific authorized time periods). For example, a company stipulates that employees can only read project documents (operation type "read") between 9:00 and 18:00 on weekdays, and have no access permission outside of working hours, thereby precisely controlling user operations on storage space.

[0093] In some embodiments, when a user initiates an access request, the intelligent computing center can extract identity information (such as employee account), device information (such as device identifier), and geographical location information (such as the IP address of the terminal) carried in the request, and verify whether the user has basic access permissions to the target storage space based on preset rules. For example, when an unauthorized user A attempts to access user B's authorized storage data space, the intelligent computing center can directly refuse through identity information verification. Each user's storage space is independent and does not affect each other, ensuring that only authorized users can initially access the target space.

[0094] After the first user access request passes the initial verification, the intelligent computing center can perform a deep inspection of all storage spaces. For example, timestamp sequence verification can be performed, checking whether the time order of access requests is logical. For instance, if a user accesses storage space A first and then B, and the time interval is extremely short and there is no reasonable business connection, an anomaly check may be triggered. Device consistency verification can confirm whether the user is using the same device for consecutive accesses. For example, if a user initiates a request on their office computer and then suddenly switches to an unfamiliar device to access other spaces, the intelligent computing center will further verify this. User behavior pattern verification can monitor abnormal cross-space access by learning the user's daily access habits (e.g., an engineer typically only accesses the code storage area and their operations are concentrated on code reading and modification). If this engineer suddenly attempts to access the financial statement space, the system will identify it as an abnormal request and issue a warning.

[0095] Furthermore, if the second verification finds that the first user's request triggers cross-storage space data access (e.g., when a user in the design department operates in the target space, they need to call image resources in the material storage space), the intelligent computing center, after confirming that the verification is successful, will transfer the corresponding data information (such as the required image) in other storage spaces to the target storage space for the user to use, thus satisfying business needs while ensuring the security of cross-space access.

[0096] In addition, the intelligent computing center can record the first user's operation time, user identity, and permission scope (such as only being able to read data in a certain space) in real time to form an audit log. This facilitates subsequent tracing of user operations and ensures that the use of permissions is compliant.

[0097] In one embodiment, step S3 includes:

[0098] Step S31: Upon receiving the first authorization instruction, authenticate the second user indicated in the first authorization instruction to obtain a third authentication result;

[0099] Step S32: If the third verification result shows that the second user is a user with authorized permissions, the computing power resources of the target storage space are allocated to the second user based on the urgency of the second user's computing task and the predicted resource consumption.

[0100] Step S33: Configure access permissions for the computing power resources for the second user according to the first authorization instruction. The access permissions for the computing power resources of the second user include at least one of operation type permissions, time window permissions, and data range permissions.

[0101] In other embodiments, the intelligent computing center receives a first authorization instruction, i.e., an authorization instruction from a first user, which may include the identity information of a second user who needs to access the target storage space. Subsequently, identity verification is performed using an authentication mechanism (e.g., username and password, biometrics, or multi-factor authentication) to authenticate the second user. A verification result is then generated to determine whether the second user is authorized. In this way, if authentication is successful, the second user's computing task can be assessed, including the urgency of the task and the type and quantity of computing resources required. Furthermore, historical data and resource consumption models are used to predict the resource consumption required to execute the computing task. Finally, based on the urgency and resource consumption prediction, the computing resources of the target storage space are rationally allocated to the second user to ensure their task requirements are met.

[0102] Furthermore, access permissions for the second user to computing resources can be configured based on the information provided in the first authorization instruction. Specifically, operation type permissions (such as read, write, delete, etc.), time window permissions (accessible time periods), and data range permissions (the amount or type of data that can be manipulated) can be set for the second user according to business needs. The configured permissions can be applied to the second user's account to ensure appropriate control within the target storage space.

[0103] This multi-factor authentication process ensures that only verified users can access sensitive data and computing resources, enhancing system security. Resource allocation can be based on task urgency and resource consumption predictions, enabling the computing center to efficiently utilize its resources, avoid waste, and improve system performance. Furthermore, fine-grained access permission configuration allows for setting access permissions according to specific user needs and roles, enhancing system flexibility and controllability.

[0104] In one embodiment, after step S3, the method further includes at least one of the following:

[0105] Step S4: Transmit the target data to the second user through a preset encryption protocol;

[0106] The target data refers to the data contained in the computing resources that are within the access rights of the second user.

[0107] In some specific embodiments, target data can be transmitted to a second user via a preset encryption protocol. For the specific encryption protocol, one or more encryption protocols can be pre-set in the intelligent computing center; these can be symmetric encryption, asymmetric encryption, or a combination of both, to ensure information security during data transmission. Once the second user gains access to the target data, the intelligent computing center encrypts the target data to be transmitted. Assuming the target data is the user's sensitive business data, the system will encrypt this data using the selected encryption protocol to generate ciphertext. Subsequently, the encrypted ciphertext can be sent to the second user's device via a secure network transmission channel (such as an SSL / TLS connection).

[0108] For example, an intelligent computing center needs to transmit sensitive customer information to authorized analysts. After encrypting this data using the Advanced Encryption Standard (AES) protocol, the intelligent computing center sends the encrypted files to the analysts via a secure connection, ensuring that even if intercepted during transmission, the data remains unreadable.

[0109] In other embodiments, target data can be monitored using network packet capture tools, and abnormal data can be identified through deep learning algorithms. Specifically, the intelligent computing center can use network packet capture tools (such as Wireshark) to capture network traffic during transmission and record information such as data packets, senders, and receivers. Furthermore, through deep learning algorithms, a model can be trained to identify normal data transmission behavior patterns, including normal data size, transmission frequency, and time periods. The data learned by the model can be samples of previously valid transmissions. Finally, during real-time monitoring, when the captured data packets do not match the learned normal patterns, an anomaly alarm is triggered. For example, if an abnormality in the size of the transmitted ciphertext or a significant increase in the transmission frequency is suddenly detected, the system will mark it as suspicious behavior.

[0110] For example, during transmission, the intelligent computing center detects that the size of a certain data packet far exceeds the previous average transmission size and exhibits abnormally high-frequency transmission behavior. Detecting this anomaly through deep learning, the intelligent computing center immediately alerts the administrator and recommends further investigation.

[0111] Thus, this embodiment of the application ensures the security of target data during network transmission through an encrypted transmission protocol, reducing the risk of data interception or tampering. Furthermore, by monitoring network traffic and analyzing behavioral patterns, potential abnormal access behaviors can be detected, allowing for early identification of security risks and reducing the probability of security incidents. This robust data transmission and monitoring mechanism enhances user and customer trust in the system and its data protection measures.

[0112] In one embodiment, the method further includes:

[0113] Step S5: If an access request from a third user is received, but no second authorization instruction from the first user to the third user is received, check whether the access request from the third user is legitimate;

[0114] Step S6: If the access request of the third user is legitimate, allocate access permissions to computing resources to the third user according to the operation task carried in the access request of the third user;

[0115] The third user's access to computing resources is the minimum access required to complete the operation task.

[0116] In some specific embodiments, the intelligent computing center can detect access requests initiated by a third user to the target storage space. These requests may contain specific operational task information (such as data analysis, model training, etc.). The intelligent computing center can first check if there is a second authorization instruction from the first user to the third user. If no such authorization exists, the intelligent computing center will proceed to the next step. The intelligent computing center can verify the legitimacy of the third user's access request; only if the third user's access is legitimate can access permissions be granted. After the third user's access is legitimate, the intelligent computing center can interpret the operational task in the third user's request and assess the task's demand for computing resources. For example, if the third user requests to perform a big data analysis task, the intelligent computing center analyzes the resources and time required for this task.

[0117] Therefore, based on the resource configuration required for the operation task, the intelligent computing center assigns minimum access permissions to the third user. Minimum access permissions include the specific type of computing resources required for the operation task (CPU, GPU, etc.), the operation type (read, write, computation, etc.), and the time window (e.g., available only during a specific time period). Furthermore, the intelligent computing center can apply the corresponding access permissions to the third user's account, ensuring that the third user can complete their specific operation task within the permitted scope.

[0118] Thus, by allocating only the minimum required access permissions, this embodiment ensures that only the necessary access is granted, minimizing the risk of data leakage and misuse. The intelligent computing center can also flexibly adjust resource allocation according to the operational needs of different users, improving the utilization efficiency of computing resources. Furthermore, it reduces reliance on complex authorization processes, simplifying access management. The intelligent computing center can respond quickly to temporary and low-risk access requests. In addition, this embodiment ensures that users can only access and process the information and resources necessary for their work, thereby protecting the overall security of the system.

[0119] Please see Figure 2 , Figure 2 This is a structural diagram of a computing resource allocation device for an intelligent computing center provided in an embodiment of the present invention. The device 20 includes:

[0120] Data writing module 21 is used to write the data of the first user into the target storage space, wherein the target storage space is one of at least one storage space pre-created in the intelligent computing center, and the operation rights of the target storage space belong to the first user;

[0121] The access verification module 22 is used to verify the target storage space when multiple users' access requests are received, and to obtain a verification result, wherein the multiple users include the first user;

[0122] The resource authorization module 23 is used to, when the verification result shows that only the first user has access to the target storage space, authorize the second user to access the computing resources in the target storage space based on the first authorization instruction of the first user.

[0123] In one embodiment, the at least one storage space is a storage space created based on multi-dimensional features, the multi-dimensional features including at least one of data type, access frequency and security level;

[0124] The operation permissions for the storage space are assigned to the corresponding users based on a fine-grained policy, which is determined according to the user's operation type and time range.

[0125] In one embodiment, the access verification module 22 is used for:

[0126] Upon receiving an access request from at least one user, the access permissions of the target storage space are first verified based on each user's access request to obtain the first verification result;

[0127] The access request carries at least one of the following: user identity information, device information, and geographic location information;

[0128] The access verification module 22 is also used for:

[0129] Based on the access request of the first user, a second verification is performed on each of the at least one storage space to obtain a second verification result. The second verification includes at least one of the following: timestamp sequence verification of the access request, device consistency detection verification, and user behavior pattern verification. The user behavior pattern verification is used to monitor and identify abnormal cross-space access requests by learning the user's normal access behavior pattern.

[0130] If the second verification result shows that the first user's access request triggers a cross-storage space data access request, the data information corresponding to the first user's access request is transmitted to the target storage space. The data information is the data stored in other storage spaces besides the target storage space triggered by the first user's access request.

[0131] Generate an audit log; wherein the audit log is used to record at least one of the following: the operation time of the first user access, the user's identity, and the scope of permissions.

[0132] In one embodiment, the resource authorization module 23 is used for:

[0133] Upon receiving the first authorization instruction, the second user indicated in the first authorization instruction is authenticated to obtain a third authentication result;

[0134] If the third verification result shows that the second user is a user with authorized permissions, the computing power resources of the target storage space are allocated to the second user based on the urgency of the second user's computing task and the predicted resource consumption.

[0135] According to the first authorization instruction, the second user is configured with access permissions to the computing resources. The second user's access permissions to the computing resources include at least one of operation type permissions, time window permissions, and data range permissions.

[0136] In one embodiment, the resource authorization module 23 is further configured to include at least one of the following:

[0137] The target data is transmitted to the second user using a preset encryption protocol;

[0138] The target data refers to the data contained in the computing resources that are within the access rights of the second user.

[0139] In one embodiment, the computing power resource allocation device 20 of the intelligent computing center is further configured to:

[0140] If an access request from a third user is received, but no second authorization instruction from the first user to the third user is received, check whether the access request from the third user is legitimate.

[0141] If the access request from the third user is legitimate, access permissions to computing resources are assigned to the third user based on the operation task carried in the access request.

[0142] The third user's access to computing resources is the minimum access required to complete the operation task.

[0143] The computing resource allocation device 20 for the intelligent computing center provided in this embodiment of the invention is capable of achieving the above-mentioned... Figure 1 The various processes and technical features of the embodiments of the intelligent computing center's resource allocation method shown are all corresponding one-to-one and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0144] It should be noted that the computing power resource allocation device 20 of the intelligent computing center in the embodiments of the present invention can be a device, or it can be a component, integrated circuit or chip in an electronic device.

[0145] This invention also provides an electronic device, see [link to relevant documentation]. Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device includes a memory 31, a processor 32, and a program or instructions stored in the memory 31 that run on the memory. When the program or instructions are executed by the processor 32, they can achieve the following: Figure 1 The steps in the corresponding intelligent computing center's resource allocation method embodiment, and the achievement of the same beneficial effect, will not be elaborated here.

[0146] The processor 32 can be a CPU, ASIC, FPGA, or GPU.

[0147] Those skilled in the art will understand that all or part of the steps of the above-described embodiment of the method for allocating computing resources in an intelligent computing center can be implemented by hardware related to program instructions, and the program can be stored in a readable medium.

[0148] This invention also provides a readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described functions. Figure 1 Any step in the corresponding embodiment of the method for allocating computing resources in the intelligent computing center, and achieving the same technical effect, will not be described again here to avoid repetition. The storage medium mentioned includes, for example, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0149] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the embodiment of the method for allocating computing resources in the intelligent computing center shown are all applicable and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0150] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0151] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0152] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method for allocating computing resources in an intelligent computing center, characterized in that, include: Step S1: Write the data of the first user into the target storage space, wherein the target storage space is one of at least one storage space pre-created in the intelligent computing center; Step S2: Upon receiving an access request from at least one user, verify the access rights of each user to the target storage space and obtain the verification result. The at least one user includes the first user. Step S3: If the verification result shows that only the first user has access to the target storage space, obtain the first authorization instruction from the first user, and authorize the second user to access the computing resources in the target storage space according to the first authorization instruction.

2. The method according to claim 1, characterized in that, The at least one storage space is a storage space created based on multi-dimensional features, which include at least one of data type, access frequency, and security level. The operation permissions for the storage space are assigned to the corresponding users based on a fine-grained policy, which is determined according to the user's operation type and time range.

3. The method according to claim 1, characterized in that, Step S2 includes: Step S21: Upon receiving an access request from at least one user, perform a first verification on the access permissions of the target storage space based on each user's access request, and obtain the first verification result; The access request carries at least one of the following: user identity information, device information, and geographic location information; After step S21, the method further includes: Step S22: Based on the access request of the first user, perform a second verification on each of the at least one storage space to obtain a second verification result. The second verification includes at least one of the following: timestamp sequence verification of the access request, device consistency detection verification, and user behavior pattern verification. The user behavior pattern verification is used to monitor and identify abnormal cross-space access requests by learning the user's normal access behavior pattern. Step S23: If the second verification result shows that the first user's access request triggers a cross-storage space data access request, transmit the data information corresponding to the first user's access request to the target storage space. The data information is the data stored in other storage spaces besides the target storage space triggered by the first user's access request. Step S24: Generate an audit log; wherein the audit log is used to record at least one of the following: the operation time of the first user access, the user's identity, and the scope of permissions.

4. The method according to claim 1, characterized in that, Step S3 includes: Step S31: Upon receiving the first authorization instruction, authenticate the second user indicated in the first authorization instruction to obtain a third authentication result; Step S32: If the third verification result shows that the second user is a user with authorized permissions, the computing power resources of the target storage space are allocated to the second user based on the urgency of the second user's computing task and the predicted resource consumption. Step S33: Configure access permissions for the computing power resources for the second user according to the first authorization instruction. The access permissions for the computing power resources of the second user include at least one of operation type permissions, time window permissions, and data range permissions.

5. The method according to any one of claims 1 to 4, characterized in that, After step S3, the method further includes at least one of the following: Step S4: Transmit the target data to the second user through a preset encryption protocol; The target data refers to the data contained in the computing resources that are within the access rights of the second user.

6. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Step S5: If an access request from a third user is received, but no second authorization instruction from the first user to the third user is received, check whether the access request from the third user is legitimate; Step S6: If the access request of the third user is legitimate, allocate access permissions to computing resources to the third user according to the operation task carried in the access request of the third user; The third user's access to computing resources is the minimum access required to complete the operation task.

7. A device for allocating computing power resources in an intelligent computing center, characterized in that, include: The data writing module is used to write the data of the first user into the target storage space, which is one of at least one storage space pre-created in the intelligent computing center, and the operation rights of the target storage space belong to the first user. An access verification module is used to verify the target storage space when multiple users' access requests are received, and to obtain a verification result, wherein the multiple users include the first user; The resource authorization module is used to, when the verification result shows that only the first user has access to the target storage space, authorize the second user to access the computing resources in the target storage space based on the first user's first authorization instruction.

8. A server, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method for allocating computing resources in an intelligent computing center as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for allocating computing resources in an intelligent computing center as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions, which, when executed by a processor, implement the steps of the method for allocating computing resources in an intelligent computing center as described in any one of claims 1 to 6.

Images